Military Secrets for Sale on Stolen USB Drives

nTrfAce writes "Per a BBC Article, "US forces in Afghanistan are checking reports that stolen computer hardware containing military secrets is being sold at a market beside a big US base. Shopkeepers at a market next to Bagram base, outside Kabul, have been selling memory drives stolen from the facility, the Los Angeles Times newspaper says.""

Comments

Strong encryption

[VincenzoRomano]

I hope that those soldiers were using strong encryption for file systems.
I hope that those soldiers were not storing sensible data on those drives.
I hope that those soldiers were not storing weird photos involving prisoners ...
Real world tends to be different from hopes!

Re:Strong encryption

[meringuoid]

I hope that those soldiers were not storing weird photos involving prisoners ...

If soldiers have been abusing prisoners, I'd prefer them to photograph themselves doing it and then store those photographs on disks which are later stolen and leaked to the press.

Otherwise, how will we ever know what our armed representatives abroad are doing in our names?

Re:Strong encryption

[Saven Marek]

> I hope that those soldiers were using strong encryption for file systems.

Remember encryption isn't the be all and the end all. What happens when you lose your own keys?

And keys on a laptop itself, well that's all portable too. Laptop + usb key means nothing since you have to carry the encryption keys with you. Without doing that your data is useless, and carrying them with you means when the laptop is stolen, you have the key stolen with it.

Instant access to your data. If they have your key they also can unencrypt anything else of yours, so you have not just lost the USB drive but more than that. How much do you think an encryption for sale on the black market is?

Let me tell you it ain't cheap so there's profit to be made. Where there is profit there is motive. By using encryption you are adding additional motive to the thieves.

So why use the problems with encryption without the benefit? It doesn't make sense. Kapsky and Dilinger's 1999 paper addressed this issue on when widespread use of portable computing was just beginning.

Re:Strong encryption

[hobbes75]

Why is this moderated as Flamebait ? The wish to publicise improper behaviour so that it may change to the better is hardly a flamebait in my eyes.

Re:Strong encryption

[ObsessiveMathsFreak]

Otherwise, how will we ever know what our armed representatives abroad are doing in our names?

But shouldn't soliders have the right to strip prisioners naked and photgraph their anuses, without fear of government surveillance?

Re:Strong encryption

[Anonymous Coward]

Otherwise, how will we ever know what our armed representatives abroad are doing in our names?

Easy. Instead of relying on the onesided reports from US news sources try reading foreign newspapers. They're available on the web, many in English. Much as you probably don't want to believe it most of them actually tell the truth.

Re:Strong encryption

[Baracat]

Bah... Probably they will find on this HD's only porn...

Re:Strong encryption

[x2A]

not if it's goatse guy!

Re:Strong encryption

[x2A]

Losing your key is just like losing your data... it's not called "lost" for no reason. And what happens? You learn a lesson.

And no, encryption might not be 100%, but it's still more than 0%.

(But then I couldn't exactly be able to trust someone to look after information if they can't even look after physical objects)

Re:Strong encryption

[chrismcdirty]

I really doubt that most of them tell the actual truth. Like in America, their job is to sell the news. Most of the time, they put a spin on it to please their citizens, or to upset their citizens. If the citizens hate Americans, they'd likely make their news biased against America.

For example, would you have me read British news concerning America? Iranian? French? Libyan? German? How am I, the ignorant American, supposed to know which ones are truly impartial, and which ones are putting their Anti-/Pro-American spin on the news, just like the news companies here in America?

Re:Strong encryption

[RandoX]

"The truth" is subjective.

Re:Strong encryption

[audi100quattro]

There are enough Orwell's running around our government, you don't really want to be added to that list...

Re:Strong encryption

[snoozebutton]

By reading as many differing sources as possible, and making your own conclusions.

Re:Strong encryption

[Anonymous Coward]

Otherwise, how will we ever know what our armed representatives abroad are doing in our names?

You mean "with our money". I certainly hope that you understand the difference between government and the individual. If you do, you will realize that government can't possibly do anything "in our names", unless exactly 100% of us support the decision. Obviously, 100% support is impossible, because society is nothing but a collection of unique individuals, not a living, thinking being in itself. Therefore, on any given issue, government only speaks for the power elite and whatever percentage of the people supports the decision. Never does government speak "for the people" (as in 100%), because that is clearly an impossibility.

Re:Strong encryption

[NuclearDog]

Yes, but the citizens of Afghanistan don't see the distinction. Neither do most of the rest of the citizens of the world. They see "Hey look, the US military did bad thing $X here! Damn those Americans!"

Regardless of whether you support them or not, the US military _does_ represent your country, and it _does_ represent you.

ND

Re:Strong encryption

[Boronx]

How am I, the ignorant American, supposed to know which ones are truly impartial, and which ones are putting their Anti-/Pro-American spin on the news, just like the news companies here in America?

It simply doesn't matter what their bias is. What matters is whether they report honestly.

Take the Wall Street Journal. I disagree very strongly with their bias, but I can't deny it's one of the best papers in the world and worth reading.

Re:Strong encryption

[Tony Hoyle]

You voted for Bush - twice.

How is the military carrying out his commands not representative of you? You don't get off that easily.

Re:Strong encryption

[hackwrench]

Only if the government isn't footing the bill.

Re:Strong encryption

[patio11]

There is not too much subjective about the statement "some US troops sexually abused prisoners in Iraq". Thats a fact. Here's another: "the US military found out about it before the press did, through a whistleblower, and immediately started investigating and preparing charges, and as a result some of the culprits are now doing hard time". Unfortunately, the pictures for Truth #2 don't sell nearly so many papers.

Re:Strong encryption

[pianophile]

You voted for Bush - twice.

I didn't, and neither did approximately half of US voters.

How is the military carrying out his commands not representative of you? You don't get off that easily.

I hope that someday you are personally blamed for the actions of your government, too, you jerk.

Re:Strong encryption

[Pollardito]

I hope that those soldiers were not storing sensible data on those drives.

just our battle plan for the war on terror, that's not sensible enough to worry about. oh, you meant sensitive?

Re:Strong encryption

[Beryllium Sphere(tm)]

More details at the Abu Ghraib timeline.

Re:Strong encryption

[audi100quattro]

That foreword to Animal Farm wasn't in the book I read in High School, It is now though. But yes, I meant Orwellian as in "doublethink"

Re:Strong encryption

[symbolic]

There is already ample evidence. vv

Re:Strong encryption

[vertinox]

There is not too much subjective about the statement "some US troops sexually abused prisoners in Iraq". Thats a fact.

Try to define "sexually".

Then try to define "abused".

Those aren't hard code facts. Because sexually could mean anything from showing them pictures of nakked women to gang rape.

Abuse is also subjective... Does abuse mean calling them bad names or did they hold them down and shove electric cattle prods in their orifices.

By that statemnt we don't know what really happened... Just that some type of sexual abuse went on. Some people might read it and thing it was nothing other than college prank sexual harrasment event while other readers might envision a 3rd world torture chamber were people are starved, burned, electrocuted and beaten to an inch of their life.

The truth is most likely inbetween, but that simple statement does not give the real facts of the matter. Just assumptions depending on your bias.

Re:Strong encryption

[_Sharp'r_]

If they have your key they also can unencrypt anything else of yours

Darn, so all those passphrases I keep in my head get magically stolen along with the key they go with?

What kind of idiot keeps keys that can decrypt everything they own on a portable device, but doesn't make it so that you have to know a passphrase to use the key?

Well, leaving aside government users.

Re:Strong encryption

[Jackmn]

And keys on a laptop itself, well that's all portable too. Laptop + usb key means nothing since you have to carry the encryption keys with you. Without doing that your data is useless, and carrying them with you means when the laptop is stolen, you have the key stolen with it. Instant access to your data.

In most modern systems the keys themselves are encrypted with a passphrase (this is how GnuPG handles your private keys). With a suitably strong passphrase the encrypted keys aren't of much use.

Re:Strong encryption

[meringuoid]

If your life was saved due to someone pulling another person's (not a normal person, someone who takes joy in seeing women and children burning alive) fingernails out with pliers, would you complain?

I very much hope that I would.

I am not saying that the ends justify the means

Oh yes you are.

Re:Strong encryption

[Master of Transhuman]

Your statement that SOME of the culprits are doing hard time is partly correct (doubtful that much of it is what we would actually call "hard time" - long time, maybe, but not "hard" time.)

The rest of the culprits got off or were never charged - including those who ordered it in the first place.

Pictures of THAT would have been nice. But the media failed to print them, preferring instead to hawk government statements that were clearly lies.

Lies sell papers, too - in fact, more so than the truth.

Re:Strong encryption

[someone1234]

If someone would really burn others alive, they shouldn't cry for some pulled fingernails.

Re:Strong encryption

[Master of Transhuman]

How about raping Iraqi women and children?

Does that qualify?

And, yes, according to all serious reports, that was done. They simply haven't dared to release the photos and videos yet.

Or do you think the Congressmen who have seen them and described them as "disturbing" are lying?

Re:Missing Classified Hard Drives

[x2A]

Windows - it's that insecure, you don't even need physical access to a machine to steal it's componants! ;-)

I'm no military fan...

[Anonymous Coward]

...but how do they know the 'secrets' are actually that and not some kind of decoy?

Re:I'm no military fan...

[slavemowgli]

Short answer: they don't.

Re:I'm no military fan...

[mrogers]

Military Intelligence has released a list of the secrets that have been recovered and those that are still at large. Among the recovered secrets:

• The B2 Stealth Bomber is just a decoy made out of balsa wood and black paper; smart bombs are actually delivered by UPS
• Lee Harvey Oswald acted alone; the FBI and Secret Service were so embarrassed by their failure to protect the President from some wandering nutjob that they spent the next 30 years trying to create the impression there had been some kind of conspiracy
• A 1989 Cheers episode that made reference to the Kennedy assassination was seized by the CIA minutes before it was scheduled to air; the tape went missing, and so far 11 American civilians have been killed in the effort to prevent it reaching a wider audience
• Aging Cuban guerillas launched a successful coup in Washington DC while the nation's attention was focussed on the last episode of Sex and the City. President-for-Life Fidel Castro described it as "a good day to bury good news".

Re:I'm no military fan...

[charlesnw]

A 1989 Cheers episode that made reference to the Kennedy assassination was seized by the CIA minutes before it was scheduled to air; the tape went missing, and so far 11 American civilians have been killed in the effort to prevent it reaching a wider audience

Make that 12 civillians....

Why?

[bl00d6789]

Let me be the first to ask: Why the hell is the military storing sensitive data on USB drives, which are prone to both theft and failure?

Re:Why?

[michaelhood]

Policy and practice are often quite distant from each other in reality. Especially in government; military or otherwise.

Re:Why?

[1u3hr]

Let me be the first to ask: Why the hell is the military storing sensitive data on USB drives, which are prone to both theft and failure?

Most likely it's just sneakernet; moving files from laptop to PC etc. After transferring the files they forget to wipe the USB stick. The army will probably try to stop this by mandating it not be done. Which will work for a while till troops rotate and a new batch come in. The only real solution is to physically disable USB ports, which would be difficult with the number of legitimate USB peripherals now. Otherwise everything needs to be transparently encrypted. The military fears losing access to critical data in battle more than possible security breaches though.

Re:Why?

[plankrwf]

How else to spread sensitive information?
At least this way, no president needs to leak anything himself

Re:Why?

[arivanov]

The army will probably try to stop this by mandating it not be done.

Once upon a time it could force that it is not done. This is what levels of security above C and OSes like Trusted Solaris were all about. Not about being unhackable, but about it being impossible to copy data from a higher security container to a lower. Granted, someone with high enough security clearance and rights to declare his USB drive "secure" could have gotten past that as well, but the average PHB wannabie corporate ladder climber could not do anything about it. He could not "take work home".

This is also coming back. The slashdot crowd keeps bitching about Vista DRM being Digital Wrongs Management and being mostly promoted by pigopolists. Once again wrong. Along with AD it will allow any corporation to force a mandatory encryption policy on all the data on all media in the house at the click of a mouse. Throw in this the usage of TPM chips on all Vista ready PCs and this will make any data that a corporation wants to make unrecoverable without proper access credential on a PC really unrecoverable. All of this centrally controlled. This will also result in much faster adoption of Vista in the enterprise than people can even think off, especially for mobile devices.

This also means that if Linux is to compete for the desktop it will have to have the same features regardless of Stallmans desires. This is one thing on which Linus is absolutely right. The usage of DRM by pigopolists is a current fad which is only a minor fraction of its actual use. The real use of DRM is to enforce a security policy on data across an enterprise. Having this will be essential to the success of any OS out there in 2-3 years. Also, there is no problem with DRM being opensource. Essentially DRM is nothing but a crypto application. Same as with every good crypto - having the source should not allow one to break it.

Re:Why?

[blowdart]

Once upon a time it could force that it is not done.

Whilst not as fine grained as you are talking about you can completly disable USB drives, at least on Windows 2000, XP and Windows 2003 by tweaking file system permissions or the registry. Microsoft even detail it in a knowledge base article and it can be enforced by a domain policy if you're running AD.

Re:Why?

[mcvos]

Why the hell is the military storing sensitive data on USB drives, which are prone to both theft and failure?

More importantly, why is the sensitive data not encrypted? You'd expect that people handling sensitive information receive some sort of training in how to handle that inofmration.

Alas, similar things have been happening in the Netherlands during the last couple of years: a public prosecutor throwing his PC with unencrypted info about criminal cases in the trash, a USB stick with sensitive military info left in a taxi, that sort of thing. And what I'm mainly upset about isn't even that people are sloppy with the hardware; that sort of thing can always happen (even if it shouldn't), but that they're not forced to use software that can only store their data in encrypted format.

Re:Why?

[Anonymous Coward]

Pretty common military security procedure. The hard-drives with classified information must be stored and often accessed on a secure area. Using USB drives enables reusing the PC for other purposes, thus reducing cost.

Computers used to be expensive, so DoD and contractors try to maximize their use. Before USB, replaceable HD were being used.

Re:Why?

[Fred_A]

You can do so in any Unix by not putting the users in the usb group and setting the permissions accordingly.

Or by not enabling the usb-storage driver.

Re:Why?

[value_added]

The usage of DRM by pigopolists is a current fad which is only a minor fraction of its actual use. The real use of DRM is to enforce a security policy on data across an enterprise. Having this will be essential to the success of any OS out there in 2-3 years.

Sounds plausible, but there's a problem in your logic. Money.

How much money is there in enterprise-level security? Now compare that with the balance sheets of the music and the film industry. Seems to me that the weight and influence of the those industries far exceeds the interests or fiduciary responsibilities of security professionals.

Hardly a fad.

Re:Why?

[FiveDollarYoBet]

Why the hell is the military storing sensitive data on USB drives, which are prone to both theft and failure?

How about....
Why are local nationals allowed on base?
Why are they not being searched thoroughly enough when they leave?

Re:Why?

[Martin Foster]

I had the opportunity to visit a Canadian Government IT tradeshow given in Ottawa. One of the firms marketing their devices specialized in USB/Portal drives which had finger print scanners built-in. According to the salesman these things were selling like hotcakes, especially in the US military.

As mentioned before, they tend to be used for things like sneaker nets, where bandwidth requirements of the data inside (G2/Int) would simply bog down the communications network. This is especially critical your using VHF/HF radios to pass on your voice/data communications.

They are also used to carry around orders as a lot of briefing rooms now have projectors and computers even in the field. Simply put, the same uses you and I have for such devices the military will find useful as well.

That being said, the norm for such devices with any critical information is to have them stored in appropriate storage containers based on classification. For example, a CONFIDENTIAL document needs only to be stored steel container with a specific vault, while a COSMIC TOP SECRET document would need a vault. Interestingly enough the classicisation remains on such devices even after the file has been removed.

Re:Why?

[advocate_one]

Pretty common military security procedure. The hard-drives with classified information must be stored and often accessed on a secure area. Using USB drives enables reusing the PC for other purposes, thus reducing cost

No it bloody doesn't... once classified data has been processed on the PC (whether it was on a USB disk or not) that PC is classed as classified itself. That's because temporary files get stored on the local hard disk... that's why machines used to process secret data have to have their hard disks in removeable caddies so that the hard disks can be secured when the PC is not in use... it's a bit impractical to secure the PC's themselves in secure cabinets, but you can at least lock the hard disks away...

Also, any USB stick/drive that is connected to the PC at the time that secret data is being processed must also be treated a classified afterwards. If you print off any classified data to a printer, that printer could be classed as classified afterwards as well... An awfull lot of real printers (not crappy winprinters) use hard disks to store the temporary data while printing the pages. My HP PSC1310 actually is running some form of Linux on an internal hard disk... I found this out cos when installing Debian the other day, I had the printer connected and switched on and the debian installer saw the ext2 partitioned disc via USB and gave me the option to install Debian to it...

Re:Why?

[Antique Geekmeister]

Why write on paper rather than on stone blocks? Because it's cheaper and portable! Seriously, some actual use of USB drives shows how handy they are for storing data in a place where electricity is unreliable and laptops are prone to failure with a repair time of weeks or months. How to protect them from theft is a real problem, of course.

But a $10 USB drive can hold a soldier's email from home, some music to share with their friends, their transfer orders, a map of the local area's targets for the next day, and the combination for the food locker. Like paper and pencil, they're just too useful to deny to the troops: the key is to make sure they're used properly.

Re:Why?

[Foobar of Borg]

Been hitting the Kool-Aid pretty hard, haven't you? I bet you believe that we actually found the WMDs, too!

Re:Why?

[jsight]

An awfull lot of real printers (not crappy winprinters) use hard disks to store the temporary data while printing the pages. My HP PSC1310 actually is running some form of Linux on an internal hard disk... I found this out cos when installing Debian the other day, I had the printer connected and switched on and the debian installer saw the ext2 partitioned disc via USB and gave me the option to install Debian to it...

Er, what? How exactly did you jump from seeing that it had storage, to deciding that it contained a hard drive and was running Linux?

Re:Why?

[aaronl]

DRM has absolutely nothing to do with security. The Vista DRM is all about Microsoft telling you what you're allowed to do with your OS, and RIAA/MPAA telling you what you're allowed to do with your content.

Personally, I don't want TPM. It allows my computer to be uniquely identified down to the hardware. It's the same reason that people were so upset over the privacy implications of the Pentium III CPU serial number. The whole DRM nonsense that is destroying technology today is ridiculous. It's like your TV telling you that you're not allowed to watch something because it isn't carrying a government approved rating.

To take your woefully incorrect idea just a little further, that policy which you suggest would mean that you couldn't back up the data. It would be locked to the TPM chip and the user credentials. It would be unrecoverable. BTW - Vista won't run on mobile devices, so that part of your argument is just meaningless.

Between the DRM, the hardware requirements, that so much of the system has been rewritten, new incompatabilities, and who knows what else, Vista adoption *will* be slow in the enterprise. Hell, in my department, the earliest I'll even have the option to run Vista is the next hardware cycle in *2009*. You see people killing off their Windows Server installs all over the place, because the product is heavy, expensive, and the licensing is almost the worst in the industry. Vista and it's brethren are making it all worse, with fifty different versions of the desktop and the server OS.

Linux doesn't need DRM in 2-3 years, either. No OS in common use in business will have DRM in that time frame. Windows 2000 and XP don't have lock-in DRM, 2003 server doesn't have it, Linux doesn't have it. Vista isn't going to be in wide use 2-3 years from now, as I mentioned.

You can't have a secure system by using DRM. You have to prevent the access in the first place. You can't have removeable media or outside network access. You can't let things leave site. You have to protect printers and the documents they create. You need *policy* right along with it. All your DRM will do is lose data and make peoples' lives hell, while providing no real benefit.

Re:Why?

[Brushfireb]

Pure Crap.

As much money as the music and film industry have, it doesnt hold a candle to the banking, financial services, legal services, and insurance businesses, all of which would be interested in the GP's DRM mention.

Nice try.

B

Re:Why?

[swillden]

How much money is there in enterprise-level security?

Well, as someone who makes a living in enterprise-level security -- there is an enormous amount of money in it. Most of the clients I work with consider spending $100 per year, per employee on workstation-level security a no-brainer, and are willing to spend significantly more, and that doesn't even consider the back room infrastructure, or the cost of all of the security people and the admins that implement their policies.

Now compare that with the balance sheets of the music and the film industry.

Yes, do, and look up some real numbers. The entertainment industry is small potatoes. The annual revenues of the entire media industry in the US totals to about $150B. That's music, film, newspaper, magazine, television and video games. The I/T industry alone dwarfs that by more than an order of magnitude, and the I/T industry is, in turn, relatively small potatoes compared to the rest of corporate world. Hell, GM -- all by itself -- pulls in 30% more than the entire media industry.

Seems to me that the weight and influence of the those industries far exceeds the interests or fiduciary responsibilities of security professionals.

Now you switched from talking about money to talking about influence. Due to their visibility, the entertainment industry has much more influence than their size and economic clout warrant.

So where does that leave us on the question of what we think trusted computing is *really* for?

Like most real-world answers: it's not that simple. There are multiple reasons and multiple influences. It just so happens that in this case the needs of enterprise security systems line up nicely with the desires of media moguls and Microsoft's eagerness to both find a solution to their security woes and lock people into their platform, so the reasons reinforce one another.

I don't think the media companies could convince anyone to build trusted computing for them, and I don't think Microsoft could convince many of the players to build NGSCB for them, but the enterprise security issues mean that IBM, Dell, etc., are interested. It's the confluence of interests that will drive it to completion.

Re:Why?

[advocate_one]

ext2 format existing on the partition visible via the debian partitioning tool... plus the device is completely self contained in that you can use it to make copies of documents with the scanner printer combo and the built in card reader allows you to print photos off the cards without having to hook it up to a computer either... It's running Linux... live with it

Re:Why?

[Rich0]

This also means that if Linux is to compete for the desktop it will have to have the same features regardless of Stallmans desires. This is one thing on which Linus is absolutely right. The usage of DRM by pigopolists is a current fad which is only a minor fraction of its actual use. The real use of DRM is to enforce a security policy on data across an enterprise.

Easy solution to this - pass a law that states that anybody who buys or rents hardware is required to be given a human-readable list of all keys stored in that hardware, and a human-readable list of any keys mathematically associated with them (ie corresponding private keys). A list of all parties with copies of these keys must also be disclosed. Said hardware is also required to support user replacement of keys in case the buyer doesn't like somebody on the aforementioned list of copy-holders.

When ABC Co buys laptops they would use these keys to enforce their security policies, and they would not distribute the keys to regular employees (unless the employees buy their laptops).

You'll never see this happen, since the main reason DRM is being pushed is for copyright protection, and this relies on people not possessing the keys to the hardware they own.

If DRM were implemented in this manner, I'd be the first to sign up for it. Imagine - hardware-based crypto and OS security impossible to bypass with a boot CD (unless it is an owner-authorized boot CD). No running of binaries not approved by the system owner! It would be great. The problem is that the vendors consider themselves the system owners.

Re:Why?

[Master of Transhuman]

It's a "reliable" OS if it isn't doing anything but that one thing - and there isn't a bug that allows the Registry to hose itself at some point...

I don't how many times I've seen XP simply stop functioning (in some respect - not a complete systems crash - just some particular feature no longer works) without ANY possible clue as to what caused it. A system restore solves the problem - proving that it was indeed some sort of Registry screwup or some important DLL file got mangled. Without a system restore...good luck finding out what went wrong.

Re:Why?

[Master of Transhuman]

You're right about the printers. Some printers and networked attached printers have 20GB hard drives. I saw a video presentation yesterday by Adrian Crenshaw ("IronGeek") who demonstrated that you can manipulate a network printer to store porn and warez and serve it up to anywhere in the world with a Web browser with NO password or anything. Seriously scary from a security standpoint.

I remember one problem the Navy had at one of their sites was someone manipulated a network switch to reroute all print jobs to the networked printer to some place in Russia, then back to the printer.

Re:Why?

[Master of Transhuman]

Definitely. It was ridiculous in Vietnam. Every single Vietnamese national on base was probably a spy for the Cong. They were EVERYWHERE on base.

The US is I believe the ONLY country that allows foreign nationals to work in its embassies and other national facilities in other countries. Every other country is amazed that we're that stupid.

Re:Why?

[jericho4.0]

Are you on crack? The music and film industries are tiny compared to the number of companies that need to keep secrets (all of them).

Re:Why?

[jamar0303]

perhaps it was the fact that it was ext2 partitioned (I personally have never seen a non-linux platform be able to access a disk that is ext2 formatted).

Re:Why?

[jsight]

Interesting... I'd be curious to see the details of what it's running (CPU, Kernel info, etc). I'm really surprised there isn't more info on this out there.

why/when.

[rew]

Why and when are rules ignored?

Here in the Netherlands, there has been a series of cases where sensitive information has leaked through stolen/lost hardware, and every time some official was breaking the rules.

The rules were unworkable: DO NOT TAKE YOUR WORK HOME.

So, no reading of a report on the train, no after-dinner report writing. Nothing. Ambitious people break the rules to perform better. So they take stuff home anyway. As long as the hardware doesn't get stolen, nothing is noticed. Big publicity when sensitive information makes it to the press.

But if they were to start policing the policy, a lot of the ambitious people would eventually give in to the rules, and simply watch tv after dinner, and read the newspaper on the train. Results? Productivity drop.

Re:why/when.

[plankrwf]

This is a known problem indeed. (Someone modd parent up, I haven't gotten modpoints right now).
I remember a case at a client in which we had to mail a very sensitive, very important document very quickly.
Turned out we couldn't mail it using the clients own mailsystem, as... it didn't allow Word-attachments (or Zip or ...) to be sent along...
In the end we ended up taking the document on a floppy (yes, this was some years ago), to a 'learning centre' computer which was attached to the internet, and we ended up mailing it with... hotmail...
Roel

Re:why/when.

[Darren.Moffat]

"Results? Productivity drop."

I personally disagree, in my experience you actually in the longer term get a productivity increase. Why ? because the people are more relaxed and more refreshed with a balanced lifestyle that isn't all "work work work". People who constantly take work home are marters to the job or just really bad at planning.

Re:why/when.

[forgotten_my_nick]

Reminds me of a friend of mine who had to support an application for the the Israeli military. Over the phone they finally realised that he needed to be at the machine to fix it. Took months getting approval.

When he finally got approved he was allowed enter as far some guard post, at which point another guy came out and talked to him through a fence. He never once saw the machine.

Re:why/when.

[Vo0k]

Well, what will cause more serious drop to the productivity of the government, no afterhours for the ambitious or a gas bomb killing off 98% of the government members when the security information is leaked and the bomb hidden in the parliament building, thanks to some ambitious security officer's laptop stolen?

I bet this all could be avoided by enforcing proper use of strong encryption. Ok, the hardware got stolen but the thief won't break the cipher. No biggie. Otherwise, it could be easily considered treason and collaboration with the enemy. "I lost these documents" or "someone stole them from me" would be the first excuse for someone who sold them.

Re:why/when.

[Fred_A]

Why is everybody whining when this is obviously a great win for western values? The afghans have gotten from raising sheep to stealing and sellinf government property in only a few years ! They are now obviously a fully fledged western capitalistic society.

Re:why/when.

[cocotoni]

I don't want to sound like I come from that Monty Python sketch, but that is nothing.

Long time ago we had to transfer some sensitive data between two military bases. The data was saved to a floppy (8" floppy at that), put in sealed envelope, in the locked suitcase chained to the carriers wrist, into APC, to the airport, helicopter, APC, and straight to us. The whole nine yards.

And then we found that the caporal on the other end found it bizzare that there was something shuffling in the envelope, and to secure it better he put a couple of staples through the envelope. And through the disk.

Since the data was both sensitive and urgent (no time for the whole nine yards again), we ended by transferring it using modem over unsecured phone carrier.

Re:why/when.

[Ohreally_factor]

And then we found that the corporal on the other end found it bizzare that there was something shuffling in the envelope, and to secure it better he put a couple of staples through the envelope. And through the disk.

Security thru immobilization!

Re:why/when.

[x2A]

"or a gas bomb killing off 98% of the government members when the security information is leaked and the bomb hidden in the parliament building"

OR the combined melodrama of a cowering public that believes that 98% of government members are going to be within fatal range of a gas bomb at one time, a scenario that would obviously go undetected if it weren't for data being stolen...

No don't tell me, I wanna guess

Re:why/when.

[Hal_Porter]

No, retrofitting paradigms and thinking outside the box are old fashioned. This isn't the 1980's anymore.

They need a Revolution in Paradigms. My company would be happy to organise training for say $10K per person hour. We have courses on Medieval Counterinsurgency Techniques, and Depopulation By Firepower(tm) too.

Re:why/when.

[darkmeridian]

At the beginning of my law firm intership last summer, recruits were told not to discuss work out in public. Not ever. Not on the elevators, not around the streets of Manhattan, not the shuttle flight between Boston (home office) and New York (the branch office). There are lots of lawyers and other folks out there who can trade on that information because some of our work involved mergers. I thought this was hype until some guy on the elevator from another firm was discussing a case that sounded familiar. It was the case I was working on---on the other side! I told him I was on the other side and he should stop talking. He did.

But imagine how much your productivity would drop if you couldn't talk about work on the elevator, in the cab, streets, hour-long airplane flights, etc.

Re:why/when.

[Vo0k]

Some inaugurational parliament gathering, these aren't too secret and most of country officials attend these. And if several smaller bombs go off simultaneously in all access corridors to the gathering hall, simply allowing the gas to seep inside while all the exit routes are cut off (by the gas), all the people inside will get poisoned.
That's why I didn't talk about a conventional bomb, as it would require huge amount of explosives. But several smaller containers with mustard gas in the air vents of all the access routes - the gas will eventually fill the whole building, so the fatal range will be just that, and only those near exits will get to escape in time.

What you need besides the gas is the air duct plans, method to override/bypass the security, and that's about it. You plant several bombs activated by radio (even using the local power supply to keep them active) weeks or months ahead, one at a time - small, unsuspecting-looking packages. Then push the button when you see on TV that the house is full.

Re:why/when.

[Maximum Prophet]

Absolutely correct, but in some jobs productivity is measured by the number of hours you put into it. Many professions like Lawyering and even Doctoring are billed by the hour, not by acomplishments.

Re:why/when.

[Bob3141592]

So, no reading of a report on the train, no after-dinner report writing. Nothing. Ambitious people break the rules to perform better. So they take stuff home anyway. As long as the hardware doesn't get stolen, nothing is noticed. Big publicity when sensitive information makes it to the press.

If thisis only about company sensitive information, then fine. But if you're talking about military secret or confidential, then the rules are a bit different. You can't read a classified document on the way home on the train, as other people around you could see it. And unless your home was certified as a secure site, it would be illegal to have the docement there. You'd also need special paperwork to take the document out of it's original building.

I have to ask who is doing this stealing. If it's by uncleared civilians, then what are they doing in proximity to classified material? Otherwise the stealing must be done by cleared personnel, which is a whole different story of criminal intent. Something doesn't add up here.

Re:why/when.

[x2A]

you've been watching 24, huh ;-)

Re:why/when.

[rahrens]

I have the same feeling about this. The military is absolutely anal about classified information. Like another poster mentioned, PCs used for classified info have HDs in carriers so they can be removed from the PC for storage when not in use, in addition such PCs are required to have the usb ports disabled through group security policy, if not at the registry level, as well as floppies. They are not allowed to have cd or dvd burners, read only for classified PCs. Such PCs are not allowed to have network connectivity with UNclassified PCs, either, and classified networks are NOT allowed to be connected physically to the Internet.

So I suspect that this reporter saw something on a stolen usb drive and just assumed that it would be classified. It may have been sensitive, but of a lower classification that would not have required the measures I mentioned above. Not that loosing such info wouldn't be bad - it very well could have, but that doesn't equate to classified info.

Of course, while we're speculating, he could have seen a document that was created by the soldier that owned the usb drive, who then failed to follow procedures for classifying documents properly, and mentioned classified info in an unclassified document, on an unsecured system. That has been known to happen, especially under combat conditions, and is just as bad as what the article is talking about...

Re:why/when.

[JourneymanMereel]

Not to second guess you so far after the fact, but did you try sending it by simply giving it a .txt extention? Even today, content filtering is rarely done and file type filtering is mostly done using extentions.

Re:why/when.

[aaarrrgggh]

Productivity after hours is a function of what type of work you are doing. If you spend most of the day being distracted every 30 minutes by a phone call that must be answered, it is quite hard to write a report-- getting two hours undisturbed on the train or after dinner can be a significant boost.

BUT, if the extra time is constrained by the same factors as the normal day, there will be no productivity gain.

The same is true for manual/trade labor - you only get a week's worth of work out of people, no matter how many hours you put in, if it is a long-term situation.

Re:why/when.

[Rogue Pat]

The rules were unworkable: DO NOT TAKE YOUR WORK HOME.

I'm sorry but that is a bit too easy. There's a lot of common sense that can be applied to make things more secure. In addition, the IT department can provide solutions, some of which are very easy. Also for the "ambitious people".

My company is also strict with documents. Only hard copies with a classification "Open" are allowed to leave the building. We're not allowed to talk in public places about work [which by the way can be quite an interesting experience on an intercontinental flight to Japan with a co-worker that's 30 years your senior and the only apparent thing you have in common is work, which happens to be a no-go topic...]

Our laptops have an extra bootpassword. Their hard drives are encrypted a la Apple's FileVault. If i need to take data with me to present it somewhere else i use a company-provided USB memory stick with a fingerprint reader or a password on it. And should i need to work from home late at night i can logon to our server via a secure Citrix link up.

Yes, if one takes documents with them beyond the walls of a guarded office there will be one more "attack vector", but with a number of solutions, sensitive data can still be protected much better than seems to be common practice.

Re:why/when.

[Vo0k]

nope. just got imagination. And pissed off about the current govt. Any idea where to buy mustard gas?

Re:why/when.

[x2A]

'fraid not, but what I do know is that you have a constitutionally protected right to bare arms so that you can remove a government that's failing you in the way this one is...

(mod +1 incite-ful (nicked from someone's sig)) :-p

Re:why/when.

[Johnyy_Bravo]

I beg to differ. Most people are clock-watchers and "relaxed" all day, with a little nap in the afternoon when the boss isn't watching.

Re:why/when.

[Master of Transhuman]

Mustard gas isn't that fatal.

Try nerve gas. The Japanese cults can show you how to make it.

Re:why/when.

[Master of Transhuman]

Good point.

Better they sell US military secrets than heroin to the CIA that then comes straight into ghetto kids arms.

Re:why/when.

[readin]

When you sign up to do classified work, you have to accept the restrictions that come with it. There are benefits like job security, better pay, and interesting work. But the fact remains that protecting classified work is part of the job.

Reading a report on a train? If you're doing classified work, you have to expect that someone may be after your information. Reading on a train provides an excelling opportunity to read over your shoulder.

After dinner report writing? Safer, but if you do it by habit, someone targetting you will figure it out and find some way to bug your computer.

Yes, the rules cause a productivity drop, but it is an even bigger productivity drop if your work becomes meaningless because it's no longer secret.

As for policing the policy, that should rarely be what causes people to obey the rules. You do need enforcement for a few people, but far better is to create a culture where rules are expected to be followed as a normal part of the workday. The boss, when making a request, understands that it takes longer to accomplish it because of the security rules. The worker accepts the rules no matter how silly they seem because he understands that he doesn't know all the tricks the rules are designed to protect against.

Microsoft USB drives...

[Anonymous Coward]

I was wondering why my free Microsoft USB drive hasn't arrived yet. It's so obvious it's fulfilling it's patriotic duty as an information decoy. With that move, I don't think MS will be harrased by regulations n' stuff.

Re:Microsoft USB drives...

[Aqua_boy17]

Dayum, I had completely forgotten that I put in for one of those too. Where the hell is my free USB drive Microsoft? And while you're at it, can you include a layout of Osama's cave for me?

"I want MY cigarrettes Nurse Ratchet!"

Yet another chill pill moment

[Xiph]

The stuff that's stolen is probably not aimed getting highly sensitive data, but at getting a bit of cash from selling the hardware:

"He reportedly said he was selling the items for their value as hardware alone."

that lack of organization also suggest the problem isn't huge, a claim also supported by

"Coalition officials regularly survey bazaars across Afghanistan for the presence of contraband materials, but thus far have not uncovered sensitive or classified items"

So it's not large scale, hyperterrorsquads selling supersensitive secret soldier material to themselves. but rather small bits of pieces, that together will probably seem as just that. small bits of pieces. It is however always unfortunate that personal and classified information is handled carelessly, but if we can't even handle this properly at home, why should it be any better in Afghanistan.
I'll give the answer right here: First, get better at handling information security at home, before you start using the technology abroad.
Don't give sensitive material to people who haven't been screened on how they handled it (I thought this was already a goal the tried to achieve)

Re:Yet another chill pill moment

[ReidMaynard]

yes, I heard the same story on NPR. they had a few additional facts.

Coalition officials are easy to spot and all usb drives were hidden untill the officals left.

The (BBC?) reporter returned the next day to find a southern Afgan native (read insurgant) specifically looking for these USB drives to gleen any coalition information of value to the insurgants. He would not be interviewed 'on the record' but the reporter seemed quite shaken by the whole thing.

More details in the original LA Times article

[rchatterjee]

The BBC article is based on a LA Times article which contains more details like the fact that on the thumb drives they found a list of soldier's SSNs which which they were able to track down the soldier's home addresses.

Original LA Times article

Re:More details in the original LA Times article

[Voltageaav]

A brand new article with new info. http://www.latimes.com/news/nationworld/world/la-f g-disks13apr13,1,5101806.story?coll=la-headlines-w orld

Re:More details in the original LA Times article

[Ohreally_factor]

A computer drive sold openly Wednesday at a bazaar outside the U.S. air base here holds what appears to be a trove of potentially sensitive American intelligence data, including the names, photographs and telephone numbers of Afghan spies informing on the Taliban and Al Qaeda.

It's a good thing those foreigners can't read English. Looks like we dodged a bullet on this one.

Re:More details in the original LA Times article

[Voltageaav]

Even though it's Interesting, this is a perfect example of the lack of reguard the Media has for national security. I'm glad they found out about the thumb drives being stolen. It's a major problem and definately needs to be fixed. However, it draws attenion to it before the military fixed the problem. This gives any Terrorist not aware that this is going on a heads up, here's cheep classified info. I don't have a problem with them reporting on it, but wait untill the hole in security has been fixed. They also posted a LOT of sensitive information in the article. Untill they put it in the article, none of this stuff was publicly available and much of it is still classified. All told, the media has been pretty responsible lately.

Re:More details in the original LA Times article

[Master of Transhuman]

Well, that's useless. Who cares what the home address is of a soldier in another country (unless it's maybe the general of the entire army?)

What is Al Qaeda going to do - send nasty mail to his family?

Or spam? "Join with us! Praise Allah! Your dick will be bigger!"

Amusing comment in _Slate_

[Black Parrot]

"Intelligence seems to be one of the few things the military doesn't overpay for - one Afghan spying on al Qaeda gets $15 for every successful mission."

Re:Amusing comment in _Slate_

[NeoSkandranon]

But how far does $15 go in Kabul?

Far enough to make it worth the informant's while I'd guess.

Re:Amusing comment in _Slate_

[ELProphet]

Which actually makes sense. $15 is about the average pay in that area of the world; think about it. When Homer started snitching on teh other inmates, they rather obviously noticed his Plasma TV, his Segway, etc. If our intelligence started paying 3, 4, 5 000 for an operation, it would be noticed rather quickly. This is also why (in my opinion) no one has come forward with any information on bin Laden.

SSNs

[Anonymous Coward]

SSN should stand for Supposedly Secret Number.

Everybody knows your SSN. Every employer you've had, every school you've been to, everybody you've applied for credit from, every company that's provided a service like long distance to you. Also, every firm any of those organizations have contracted out their data handling to.

Fewer people know what shoe size you wear.

Re:SSNs

[Animaether]

Indeed.. which used to make me wonder why people are supposedly so protective of their social security number. But from reading plenty of Slashdot (not sure that's healthy, I know) it seems as though having a SSN is like having the master key to all information you could ever possibly want on a person, without further authentication required.

So it seems to me that people knowing your SSN isn't bad per se, it's the fact that with -just- the SSN, they can do things they really shouldn't be able to.

It's like credit card vs debit card, in a way...
If you have all the info on a credit card, you can happily shop away online, book tickets over the phone, etc. This is what SSN is seems to be.
If you have somebody's debit card PIN number... well lucky you, but you'll still also need the card itself (or a copy, but that's another discussion). This is what SSN should be (not a card, per se.. but certainly further authentication requirements).

Re:SSNs

[Tony Hoyle]

The biggest supermarket chain in the UK (Tesco) implmented Chip and pin, did the whole security bit.

*except* on their 'self service' tills. With these you just swipe your card and walk out - no pin *or* signature required.

So if you steal a card in the UK, you know where to buy your stuff from (and they sell a fair bit of high value stuff like TVs and Mobile Phones as well).

Re:SSNs

[Weatherman-au]

Fewer people know what shoe size you wear.

Unless you buy your shoes using a customer loyalty card. Then just as many people know!

What's new?

[Scott Swezey]

Forgive my little bit of flaming here... but what's new? Just yesterday we had an article saying that all kinds of information about air force one, from layout's (and secret service agent locations in the plane) to information on the counter measure systems it has. And that was on a government website.

Our government has a long way to go to fix it its own security issues before it can even start worry about outsiders compromising its security (I know there was another article recently about it scoring D's and F's in various departments...)

Re:What's new?

[Bromskloss]

Just yesterday we had an article saying that all kinds of information about air force one, from layout's (and secret service agent locations in the plane) to information on the counter measure systems it has. And that was on a government website.

Do you have a pointer to where it was? (Or where it can be found now.) The closest I have gotten is to the Guardian website.

Re:What's new?

[Scott Swezey]

I am sure if you have enough time you can find it using google / archive.org. Of course, that assumes they didn't do the intellegent thing and delete those caches / search records.

Am I fond of our current presedent? No, but at the same time, even if I knew where that site is/was, I wouldn't get it out, because I've seen this adminiatration do worse to better people.

Re:What's new?

[Scott Swezey]

Anonymous Coward, obviously you missed the point. But, since we can't all be ub3r l337 5up3r hax0r'5, I'll just come right out and say it for you: The US government needs to fix its own security leaks and gaps before it has half a chance of stopping other people from selling its information.

As for the spelling of website and USB, well I think my signature covers that.

Re:What's new?

[Master of Transhuman]

How Stuff Works

This part is amusing:
"Air Force crews at Andrews Air Force Base in Maryland carefully inspect the plane, and the runway, before every flight."

I guess they missed the part where Richard Marcinko and his Red Cell SEAL Team managed to put fake IEDs on Air Force One in the hangar.

Also, here are the anti-missile defenses courtesy of Cryptome, who's really fast on the draw at saving info before it vanishes:
Air Force One Defenses and also here about the Air Force One rescue system (the "oxygen bottles" everyone is afraid some sniper will blow up.)

The hardware was STOLEN

[Anonymous Coward]

The report states the hardware was "stolen" and I'm sure many Afgans don't read English otherwise they would do more with what they've stolen.

Certain government organisations have really bad networks and capacities to move documents from one person's PC/laptop to another which is why people inside use USB keys.

Also when you are at certain level you are allowed to take your work home or work from home, and some of the laptops given out to such employees leave a lot to be desired in performance which is why people email documents to themselves or copy files to USB keys.

A blind eye is turned to all this unless of course something gets lost and leaked to the papers.

Similar issues in the UK

[Firefalcon]

Similarly we've had several reports in the press about MI5/6 agents/staff leaving their laptops in Taxi's - whenever data is portable it is at risk of loss or theft...

Re:Missing Classified Hard Drives

[Anonymous Coward]

You normally don't use USB drives as boot drives.

MOD PARENT UP!

[fmobus]

I wish I had mod points now...

sad thing is...

[whathappenedtomonday]

noone will ever be held responsible, so nothing will change. it will happen again and again and again, with all sorts of data. see here, more "leaked infos": Security lapse reveals secrets of Air Force One

Mod Proust Funny

[magetoo]

I wish I had literature points right now...

Good Points Above

[jbenwell]

Good points above, but there are a couple of things that I would like to know:

1. How big are the drives? I find that my 256MB one fills up all the time. If these are 512MB or more, I may want one.

2. How much? I can get a (new) 1GB drive at Costo for $60 (Canadian), so I'd hope these (used) ones are going for less then that.

Re:Good Points Above

[Martin Foster]

If its anything like the ones they were trying to sell here. You'd have your average thumb drive of small sizes to hardened portable hard drives which can carry well over 20Gb of space. In either case these had built in finger print scanner.

Re:Good Points Above

[jbenwell]

> In either case these had built in finger print scanner.

Wow, my Centrios thumb drive (from the good folks at The Source by Circuit City, formerly Radio Shack) doesn't have that. I may have to revise the amount I'm willing to spend upwards.

What really tickles me in this scenario...

[Cold-NiTe]

...is that the market where these things are being sold at is right beside the base.

What that tells me is that these things aren't being sold with the thought that they may hold valuable information and that the insurgents will pay a high price for them. It's that they're just another product and the Afghans who happen upon them are selling them as such. I guess small miracles save lives.

Re:What really tickles me in this scenario...

[Boronx]

Who knows how long agents have known about this market and skimmed it for material?

Soviet Russia

[icklepenguin]

In Soviet Russia, military secrets sell you!

A corrupt black market economy?

[Rogerborg]

Mission accomplished!

Great... just what our soldiers need!

[tomcres]

Poor guys... Now their addresses are in the hands of the entrepreneurs in Kabul... they're going to be getting tons of junk mail for "Habib's Roof and Tile" and "Afghan National Platinum MasterCard"... :(

asking for it

[Errtu76]

Hm. Invading a country. Letting the invaded people work for you at your base with your stuff. And now there's stuff missing you say? Really? Who would've thought ....

They aren't just 'stolen'.

[drspliff]

In situations like this you have to remember that things are rarely stolen, they rarely dissapear, and rarely get disposed of properly.

So there's G.I. John out in Iraq on almost basic army salary, and poor Mohammed running his market stall and a thriving economy for small items (I've even heard of trucks just 'going missing', then ending up miles away carting opium/hashish/people around the country).

G.I. John can't sell this stuff directly because he'd get his ass kicked by sarge, but once it gets passed onto the iraqi retailers there's almost no tracing it.

At the end of the day, there are always going to be a few corrupt people selling army goods, but for fucks sakes atleast wipe the drives before selling them (so you atleast try and avoid jail time).

Re:They aren't just 'stolen'.

[Master of Transhuman]

In Vietnam, the US military black market was HUGE.

I knew one guy who came back who was a barracks mate of mine at Fort Rucker in 1969 who claimed he made over $10,000 selling stuff - and he was just one guy. Supposedly there was a HUGE black market run by senior NCOs and officers that got busted up at one point - millions of dollars involved.

Most of the US troops into this would refuse to sell weapons, but they'd sell anything else that wasn't nailed down.

I bought one of these

[sl4shd0rk]

This is all I could get off it though.

---
Date: Tue, 12 2003 21:54:35
From: DiamondDonny
To: George
Subject: too easy?

dude - go to google. Type in : weapons of mass destruction.
Dont hit search tho press the I'm feeling lucky button.

Date: Tue, 12 2003 22:03:15
From: George
To: DiamondDonny
Subject: RE: too easy?

> dude - go to google. Type in : weapons of mass destruction.
> Dont hit search tho press the I'm feeling lucky button.

wtf? Why didn't we think of using google for this before?

Re:Missing Classified Hard Drives

[Fizzl]

This story if true is just plain stupid - someone should hang!

I've heard that the language is evolving, but this is is just tricidilious! ;)

Re:Missing Classified Hard Drives

[CockMonster]

Linux! It's that great you don't have to be able to spell correctly. It just knows.

Good.

[electrosoccertux]

Good. Then the people wishing to have a life and a family can still be competetive. Requiring them to match the level of work of the more "productive" workers (the ones spending more of their life on work) isn't fair to the ones who can't. I simply don't care if the guys want to spend more life working; they're not only endangering other people by toting their information everywhere, they're making it harder for people unable to work so much to stay attractive to their employer.

Tell you what, I'm your banker. How about I take your debit information with me everywhere I go? Don't worry, I'm doing it so that I can make sure your account is balanced and accurate. I won't lose it, and my friend won't get to see it, even though its on my unencrypted USB key that might fall off my keychain like my last one did.

The issue here isn't productivity; that's work done per amount time. What you were speaking of was simply an increase in time spent working. I don't care if Joe Government gets payed more money because he's working long hours, he's endangering my information. Am I get compensated any for this? He's not cutting me an some of the surplus on his paycheck. Were he doing so, I wouldn't be so inclined to say "tough."

Or could this be deliberate misinformation

[tjstork]

For example, if you kept leaking keys and established their credibility, you could start making up keys about high value targets coming to Afghanistan in order to draw out insurgents. For example, you could leak a key saying Rumsfeld will be at Bagram in July, will do a one day road tour, along this road, and let the insurgents come out in numbers and pay them back with cluster munitions.

Re:First Proust

[Durzel]

Modding the OP Troll is a bit harsh, Proust is a nice variation on a theme. :)

Quickly Wiped

[x2A]

Data could have been wiped first, to help them in their denial as to where they were stolen from (or that they were even stolen).

Re:Quickly Wiped

[charlesnw]

Dude. Wake up. You are so off base its not even funny. Why would someone get into a base, steal USB hard drives and then wipe them? Why not just steal empty drives and sell them?

We just assume they are secrects

[Thecarpe]

We just assume the information is some military secret. There is a distict possibility that the information on those drives is nothing more than family pictures or some other relatively mundane piece of information. I have friends in the FBI who have thumb drives and I just assume that the information on them is classified, but in truth, I know that it is probably a collection of pictures of them at the local bar or on vacation that they are toting to the local photo lab for processing. Nothing like a good reason to freak out though, right?!

We'll find out on CNN sometime that the drives contained Osama's location, Sadam's smoking gun, Slobadan Milosevich's memoirs, and Jimmy Hoffa's remains...oh, and the location of Salmon Rushdie's appartment that he shares with Elvis, the Loch Ness Monster and Bigfoot.

Re:We just assume they are secrects

[Quixote]

We just assume the information is some military secret. There is a distict possibility that the information on those drives is nothing more than family pictures or some other relatively mundane piece of information.

You know what they say about "ASS U ME", right?

Try reading the LA Times article. It goes into specific details about what was on the drives. Also read the Slate article (linked above).

Re:We just assume they are secrects

[Thecarpe]

If the "secrets" were as big as the press intended them to be, we wouldn't have known anything about the contents, good or bad. 1) The LA Times is not an authority on much of anything except the spin that they put on the 2nd hand information that they gather. 2) Sensationalizing the contents of the disks (corrupt Afghani officials) doesn't make the information terribly sensitive.

It a war torn region like Afghanistan, it is no secret who is corrupt in the government, and it's no secret where military strikes are going to happen. The bottom line is that the media is turning routine military information into something more than it is and creating scandal where there should just be a little tightening of the reigns. I'm not saying that it's not a bad situation to have people thieving those thumb drives. I am saying that we are believing exactly what we are reading from a second / third hand source and that's a no-no. The LA Times, BBC, and AP for that matter are reporting on something that they know will appear terrible on first glance (that sells newspapers and tv time). If it is as bad as they reported, I will eat my own shoe when the congressional hearings commence.

On the flip side

[goldcd]

with every leak of photos I now realise that not only are they abusing prisoners (in my name), but I've seemingly armed a complete bunch of retards.
At least if they kept the abuse quiet, whilst it would be equally bad, I'd know we only had abusive non-redneck-retards.

Now all they need...

[s31523]

is one of those nifty $100 computers to read the stolen media drives...

Scrapping the Military..

[Savage-Rabbit]

Windows - it's that insecure, you don't even need physical access to a machine to steal it's componants! ;-)

Somewhere in California (IIRC) there is a company that specializes in providing military aircraft for the movie industry. At the time he appeared in a documentary which I watched, the owner of this business had apparently assembled more than one Cobra Gunship from parts sold off by the Armed Forces as scrap and was well on his way toward assembling (what was at the time at least) a state-of-the-art Apache assault helecopter using parts draw from similar sources (they showed footage of it being assembled). According to this guy some of the things the US armed forces sell off to civillans as 'scrap' are downright scary both because they are sometimes dangerous (contain live munitions, toxic materials, rocket engines, etc..) and because this 'scrap' includes some pretty sensetive electronic equipment. So stolen PC's are not the only problem, the US armed forces quite freely sells off some pretty amazing stuff as junk. True enough, the information on a stolen PC can cause a significant security breach but an enemy nation getting it's hands on sensetive military electronics at a scrap auction is even worse. I suppose the way the military filters equipment for disposal may have improved over the last few years but somehow I doubt it.

Re:Scrapping the Military..

[cbelt3]

Fribble. Sure, the US sells "demilitarized scrap". In the US. To US citizens. Now ask who can buy Russian, Chinese, etc. weapons in the open global weapons market.

Yep- damn near anyone with the bucks and baksheesh to bribe the local governments who are responsible for 'controlling the sales of weapons'.

And I'm not talking about 'demilitarized scrap', but full-up functional weapons.

Re:Scrapping the Military..

[Master of Transhuman]

"Sure, the US sells "demilitarized scrap". In the US. To US citizens."

Ahem - to spies POSING as US citizens - or US citizens bribed to buy the stuff, then turn it over to spies. You think US citizens can't be bribed?

Re:Scrapping the Military..

[Savage-Rabbit]

Fribble. Sure, the US sells "demilitarized scrap". In the US. To US citizens. Now ask who can buy Russian, Chinese, etc. weapons in the open global weapons market.

The point this guy was making is that anybody can go to a USAF scrap auction and buy several railway flat-car loads of scrap. Unfortunately his experience was that if you rifle through a few carefully selected loads of such 'junk' you are more or less bound to come up with some components of sensetive systems whose intelligence value can be very high to countries like China, Russia and worse still Iran and N-Korea for reasons that are perhaps not immediately obvious. You don't need access to an entire F-16/F-15/F-18 to cause major trouble for the USAF in a future conflict. All you need is access to a few key components from the radar to calibrate your ECM-pods and it seems that such components can occasionally be found in the stuff the USAF sells of as scrap despite the fact that such material should without exception be shipped off for secure disposal. Why do you think the USA sent several helicopter loads of boffins into a minefield in the Kosovo to salvage the radar unit of a shot-down Mig-29? It's not as if a radar that crashed to the ground from several thousand meters altitude can be made to run again but it is still valuabe for research into radar warning recievers and for creating jamming profiles for your ECM-pods and the same goes for any missiles it might have been carrying. Only fools fail to realize the signifigance of this kind of intelligence gathering and it also is the reason why the loss of that F-117 over Serbia probably hurt the US more than the Pentagon is willing to admit. I'd be willing to bet good money that parts of that wreck found it's way into laboratories in Russia and possibly China.

Re:/. EXCLUSIVE: Classified Military Conversation

[menace3society]

...

G.I. 1: If I ever find the guy, I will @#$%ing bury him. I've done it before and I've done it again.

(Throws chair)

Yes ....an no.

[khasim]

This is what levels of security above C and OSes like Trusted Solaris were all about. Not about being unhackable, but about it being impossible to copy data from a higher security container to a lower.

I consider that a Good Thing (tm).

Granted, someone with high enough security clearance and rights to declare his USB drive "secure" could have gotten past that as well, but the average PHB wannabie corporate ladder climber could not do anything about it.

They wouldn't have to. That's why they have IT departments with people like me in them.

They tell me what they want done, I explain any possible issues to them and they make the decision on what they're willing to accept.

This will stop the non-CxO's from taking work "home" and losing it. But it SHOULD NOT stop me from setting the CEO's machine to copy anything from any device.

The slashdot crowd keeps bitching about Vista DRM being Digital Wrongs Management and being mostly promoted by pigopolists. Once again wrong. Along with AD it will allow any corporation to force a mandatory encryption policy on all the data on all media in the house at the click of a mouse.

While it may be true that it will allow me to more securely lock down the machines at work, that is not why it is being pushed.

It is being pushed because the home users are ripping CD's/DVD's and sharing the content online. If I'm allowed to set the privileges of the devices attached to my home machine, then DRM becomes useless for securing the content of CD's/DVD's.

This also means that if Linux is to compete for the desktop it will have to have the same features regardless of Stallmans desires. This is one thing on which Linus is absolutely right. The usage of DRM by pigopolists is a current fad which is only a minor fraction of its actual use.

Again, if I can set the privileges, then DRM is useful for protecting my corporate secrets ... but useless for protecting CD's/DVD's that I buy.

In order for it to be used to protect the CD's/DVD's, it MUST BE A BROKEN IMPLEMENTATION.

Re:Yes ....an no.

[mOdQuArK!]

But it SHOULD NOT stop me from setting the CEO's machine to copy anything from any device.

Yeah, the only thing that should stop you would be that it's not in the company's best interests for the CEO to be able to copy anything from any device, even if he or she might have been given the legal authority to do so.

Even CEOs function on a "need-to-know" basis for their job, and most of them don't need to know (and couldn't process all) of the scraps of information stored on every device throughout the enterprise.

The only thing that unlimited access by the CEO will get you is the inevitable use of such access to do surveillance & punish enemies.

Just think about how powerful an enterprise-level network admin could be if he/she could properly datamine all of the info they could access & collect enough dirty secrets about enough people in the company to take unofficial control of it (through extortion) - especially since he/she could deliver anonymous instructions to his/her patsies. Fortunately, most competent network admins are content (or because they are naturally lazy :-) to just do their jobs.

Sensitive Data?

[Boxy Brown]

FTA: A shopkeeper interviewed by the Associated Press news agency said he was not interested in the worth of the information on the memory drives.

I guess those copies of Mambo_No_5.mp3 arent so popular at the bazaar?

Actually...

[meringuoid]

You voted for Bush - twice.

Actually, the first time around they voted for the other guy. But, having had Bush as accidental president for four years, they clearly liked what they saw, and approved of his behaviour, because the second time they did vote for him.

Which is, when you think about it, fucking terrifying.

Re:Actually...

[WhiplashII]

Actually, I don't know of anyone that voted for Bush. I only know people that voted against Kerry! I mean come on, the Democrats could have run almost anyone and beaten Bush - but who do they choose? An anti-military pacifist? What is that?

If they had chosen someone that vaguely represented the other half of the country, they would have won in a landslide. Instead, they tried to take advantage of the opportunity to get the person furthest in their camp elected!

To win a national election, you need to be closer to the middle of the road than your opponent. Really, it's not that hard guys! (Oh, and by the way - when running for office, you are trying to get the opposition to vote for you, because your side will vote for you anyway!)

Re:Actually...

[Master of Transhuman]

Kerry was an "anti-military pacifist"?

Uhm, which election was this?

"To win a national election, you need to be closer to the middle of the road than your opponent."

Uhm, as far as I know, the entire consensus of the entire planet - besides you, apparently - was that Kerry was indistinguishable from Bush on most issues and THAT'S why he lost. If your opponent is supporting all your positions - including the war on Iraq - why bother voting him in?

You don't know anyone who voted for Bush? Does the phrase "fifty-five million fundamentalists" mean anything to you? Granted, there was Ohio vote fraud, but the rest of the votes DID count...

This is one of the more uninformed and ignorant posts I've seen here.

Re:Actually...

[WhiplashII]

OK, so you are saying that his stated views on the war were similar to Bush - practically identical. However he is the guy that came back from Vietnam and testified before Congress that he raped and pillaged while there, in order to end a war he didn't agree with. I can see how different sides would believe different things - but I think the majority did not see Kerry as a strong military leader. I know many in the military didn't see it that way.

The "fifty-five million fundamentalists" phrase really is the crux of my point. Kerry lives in a country with "fifty-five million fundamentalists", and yet his platform was far left of those "fifty-five million fundamentalists" that he wanted to represent. I'm not going to argue about whether the fundy view is better or worse, but if you want to be president you better represent them better than your opponent. Given Kerry or Bush in America, (practically by definition) Bush was a lot closer to the mode than Kerry was.

And if you believe in Democracy, that would be a good thing I guess. The best description I've heard is to call this the "special olympics of politics".

Re:Actually...

[Master of Transhuman]

"Given Kerry or Bush in America, (practically by definition) Bush was a lot closer to the mode than Kerry was."

That part is unfortunately true.

However, had Kerry won, we would STILL be in Iraq (the only reason he's flip-flopping now is because it's become fairly obvious - only a religious fanatic like Bush would stay there) and we would STILL be planning to invade Iran.

The Democrats are part of the War Party, too, as Justin Raimondo likes to say.

Track it

[raind]

Wouldn't be nice if they had built in gps?

insiders sell it to the shopkeepers

[r00t]

My brother signed up (his idiot girlfriend made him do it) and got to discover what military life is like.

Basically, the military is full of people who'd be in jail if they didn't have military jobs. Lots of stuff gets stolen. Even in the USA, soldiers have to stand guard duty to reduce theft. Some of the people sign up because they just like to kill.

If there were no military, we'd need bigger prisons and we'd have more crime at home.

Re:insiders sell it to the shopkeepers

[HavokDevNull]

Looking at his writing skills you can deduce that "sticking with what he knows" will be impossible due to the total lack of common sense and ignorance he portrays.

Nothing to see here move along.

Re:insiders sell it to the shopkeepers

[Master of Transhuman]

You're correct to some degree. Certainly that was the case back in the '60's during Vietnam when I was in. And that was with the draft, which got everybody. I wouldn't say there were all actual criminals, but there was certainly a high percentage of assholes. Then again, most human populations have a high percentage of assholes.

People forget that most of their wonderful "boys over there" were assholes when they were over HERE.

It's no surprise to me that US troops are behaving like war criminals in Iraq, given that most of the "new, modern Army" consists of ghetto blacks, ghetto Hispanics, green-card Hispanics, and rural rednecks who can't get a job in the real world. And with the stretching of the US military in pointless adventurism, now the military has to hire the bottom of the barrel that they used to reject.

People claiming all these guys have college degrees must think everyone else is an idiot. If they have a college degree, they got it while they were IN the military.

Anybody enlisting in the military is either an idiot who doesn't realize he is putting his life on the line at someone else's command (the definition of idiocy), or a psycho who wants the power to put someone else's life on the line (either his subordinates or the enemy's.)

Granted, there are probably quite a few people who really think it's "patriotic" to enlist - which makes them idiots by definition. And probably a few smart people join just for the action and adventure - until they realize what bone-deadening stupidity and boredom exists in the military life. There's nothing glamorous about it. There might even be a few classic "warrior" types who go in because they feel it's the only way to live a warrior life - THEY are the ones you really NEED in the military. Sadly, they're few and far between - especially on the officer level, as Colonel David Hackworth used to complain.

Re:insiders sell it to the shopkeepers

[The Snowman]

I happen to be an NCO (aka sergeant) in the military. You, sir, are full of shit.

Re:insiders sell it to the shopkeepers

[r00t]

I think you take me for some wacko peace protester who believes Bush never got elected, Saddam is a decent man, and France has some moral high ground.

Not.

There are some great people in the military. I've met a few. My brother is one. I damn well support making the world a safer place, by military intervention as needed.

That said, the military does seem to collect troublemakers. Weeding them out has always been hard, and the current recruiting situation sure doesn't help. Never mind a USB drive. Soldiers have been selling body armor!

Oh well. It's sucks for the military to have such people, but at least they have jobs that keep them mostly busy. What else are these people going to do? We seriously need a place for the not-so-great segment of the population. I'd rather not have more panhandlers, muggers, con artists, etc.

Re:insiders sell it to the shopkeepers

[r00t]

You're not in the Army. Well, maybe you do recruiting or you're in the band.

Re:First Proust

[Philip K Dickhead]

In American Afghanistan, Military Data Sells You!

You don't need to go to Afghanistan

[megarich]

I have your military secrets right here! It's yours for only 3 easy payments of 19.95?! That's right only 19.95! And if you act now before you finish reading this post, we'll throw in keys to the pentagon, absolutely FREE!!!! *NY residents must pay sales tax. Offer only good in the continent u.s.

May not just be civilians....

[quarterbrain]

What's really sad is that this hardware may not be coming from nationals working menial tasks on the base. Some of that lost hardware could just as easily be coming from the troops themselves. I spent some time in the military, and did a tour overseas. I had a short stint in the comm center, which requires a minimum secret clearance just to get into the main room because we recieved and routed classified messages. A foreign civilian would never be allowed to set foot in that room. We got a single new machine which was a big deal for us because we were running nasty green screen things, and playing dos based dopewars to kill downtime. The new machine was broken within a week, and was found to be missing the processor. Turns out one of my friends(go figure) had stolen it and sold it to some foreign civilian out in town. That was a MAJOR security breach considering they even bash the monitors that they get rid of with sledgehammers a few times before they send them out of the room. Hopefully they understand that this is a reality as well, and don't go all willy nilly on the civilians working for a living.

Security thru Obscurity?

[Ohreally_factor]

Seeing as how the market in question is next door to the base, while the terrorist headquarters is over fifteen minutes away by bus, I think the military has a fair head start to rectify the matter. Also, don't you think that when reporters interviewed/questioned the military about this breach, that might have tipped them off that there was a problem?

Anyway, you're basically making the security thru obscurity argument. If that model doesn't work for computer security, why should it work for . . .uh . . .computer security?

What really happened

[slapout]

"Pssst...hey you....yeah you...come here."

"What?"

"Would you like to buy a usb drive?"

"No, leave me along."

"Wait, buddy. See that US base over there?"

"Yeah, so? This usb drive came from that base."

"Really?"

"Yes. Contains important US government data."

"I'll take it!!"

----

Takes drive home to find that it contains:

Three love letters.
One Word Doc. (A memo requestion vacation time.)
And a copy of solitaire.exe.

there is very importatnt info!

[Imazalil]

The CBC had run a story on this a couple nights ago, some of the info were large databases of soldiers personal info - sin numbers etc - from I think they were pay records. The reporter had randomly picked a few and confirmed that they were real and matched.

If this stuff gets to the 'terrorists' and they are able to track down someone's wife/husband and kids, the soldiers are not going to be too happy with the fact that the enemy can all of a sudden go and hold their kids hostage or kill them outright.

This is very scary stuff!

Re:there is very importatnt info!

[Thecarpe]

That may indeed be the case. If it is, bad situation. The threat of having the information is worse than acting out with it. Here is an example:

Remember all the "reports" that were on the news about America's vulnerabilities after 9/11? Remember all the sites of stored chemical weapons and biological weapons that were "possible targets" or weak port security, etc...that were expose' articles / briefs? How is this any different? Americans have always had a trouble with diarhea of information.

Terrorists go for impact on a large scale - that's why they bomb busses rather than stab individuals. Their killing isn't personal vendetta, it is public statement. A single murder to them is not as important as fear and confusion of many.

Re:there is very importatnt info!

[Master of Transhuman]

None of that is likely to happen. How the FUCK is Al Qaeda going to sneak into the United States, kidnap or kill one lousy family, and somehow make an effect? Al Qaeda is not all powerful, and they have much better targets to pick than randomly trying to kill some US soldier's family. In fact, trying that would motivate US troops far more than anything else they might do.

Pay records are completely useless to Al Qaeda and the Taliban - except possibly to indicate the US force strength and composition of forces, which is obviously useful, but easy to obtain just by letting locals who are allowed on and around the base use their eyes.

Unless the USBs contained military supply records, transportation and logistics information, or actual strategic or tactical operational planning, they were probably useless to the Taliban - which is probably why the reporters could get them at all - otherwise they would have been long gone.

In fact, the reporters should be more worried about the ones that were already BOUGHT by someone else - since they obviously WERE valuable.

Actually, I doubt the Taliban need much of that info. What they need to do is stay out of the way of direct confrontation with US and NATO troops, or they get killed. They know that. So as long as they're engaged in an insurgency primarily against the Afghan state forces, they really don't need a lot of complicated intelligence about the US and NATO forces - just enough to stay out of their way. And they probably have PLENTY of spies inside the Afghan state forces that they can get all the intelligence they need to set up ambushes and the like.

You have to be kidding...

[jskline]

This is the LA times... A newspaper that I've long since saw right through their way of doing business. The story itself is so laughable and worse yet to see people "biting for it" on /.

If you guys really think that these things are used in such large numbers much less at all for carrying planning, logistics and other secret data... you really need to get out more.

I'm sorry but this is another obvious "Bush Basher" paper making up a story to try and oust Bush because they're simply a bunch of 1960's hippies that can't handle war and really aren't interested in protecting the USA.

Come on slashdotters... you guys are smarter than this!

Re:We have a military doctor over here in the UK .

[Master of Transhuman]

Excellent point.

Here's another SAS soldier described as first-rate who has refused to return to Iraq:

An SAS soldier has resigned from the army, describing the military intervention in Iraq as a "war of aggression" and "morally wrong". The soldier said he witnessed "dozens of illegal acts" by US forces there.

Ben Griffin, 28, who left after three months in Baghdad, is believed to be the first SAS soldier to refuse to go into combat and to leave the army on moral grounds. His decision comes at a time of growing disenchantment among British soldiers about their presence in Iraq.

This week, pre-trial hearings are due to start into the court martial of Flight Lieutenant Malcolm Kendall-Smith, an RAF doctor who is refusing to return to Iraq on the grounds that the war is illegal. Mr Kendall-Smith's lawyer, Justin Hugheston-Roberts, said yesterday: "We will be arguing that he has no case to answer because, without a UN mandate, the invasion of Iraq was manifestly unlawful and any subsequent order was therefore unlawful."

Mr Griffin told the Sunday Telegraph yesterday that he had expected to face a court martial for leaving the SAS. Instead, he was discharged with a glowing testimonial.

When he was on leave in March last year he told his commanding officer he had no intention of returning to Iraq. He said he was very angry "at the way the politicians have lied to the British public about the war. But most importantly, I didn't join the British army to conduct American foreign policy."

He said he had witnessed dozens of illegal acts by US fighters who viewed Iraqis as "sub-human". Mr Griffin said: "I saw a lot of things in Baghdad that were illegal or just wrong. The Americans were doing things like chucking farmers into Abu Ghraib, or handing them over to the Iraqi authorities, knowing full well they were going to be tortured."

This isn't the first time British soldiers have seriously criticized US tactics in Iraq. A number of officers have done so as well. This goes back the last couple of years.

Re:We have a military doctor over here in the UK .

[meringuoid]

Here's another SAS soldier described as first-rate who has refused to return to Iraq:

He's just been on a discussion panel on Newsnight on this subject. He said that it could easily have been him on trial; if his CO hadn't discharged him when he made clear his intention to leave the Army, he would have refused to go and would have been court-martialled in the same way.

Another man on the panel - I forget his background - suggested that it may be a result of overstretch. Perhaps, he suggested, the Air Force doctor's CO simply couldn't replace him? Recruitment has been difficult in recent years, for reasons which should be bloody obvious.

Re:From my experience

[Master of Transhuman]

Yup - once again the US penchant for hiring locals to work in sensitive areas bites us in the ass. We're the ONLY country that does this. The Russians think we're totally insane.

"There weren't enough classified authorized computers to work on, so we frequently needed to take classified files onto unclassified computers."

That's probably caused by somebody classifying EVERYTHING whether it needs to be classified or not. That's common in the government, as numerous GAO studies have shown.

CV

[korgull]

Dear George,

Please next time listen to me and read the resume of the personnel that you employ.

1) Don't hire nerds for foreign jobs
2) Don't hire anyone who knows what a USB stick is for duty outside US
3) Don't hire anyone who knows where "qwerty" is coming from for duty outside US
4) If they know any of they above, they belong to the CIA....

Your ever faithful,
Q

Linux, right?

[bill_mcgonigle]

The only real solution is to physically disable USB ports, which would be difficult with the number of legitimate USB peripherals now.

You can just modify the hotplug scripts to no recognize the mass storage device type number (0 and or 14 IIRC) and everything else USB will continue to work just fine. Only root can modify these scripts and we assume the users aren't running as root.

They are using a decent OS, right?