Military Investigates Sale of Sensitive Data

smokeslikeapoet wrote to mention an article being run in the New York Times detailing the sale of sensitive data in Afghan markets. From the article: "The military acted after The Los Angeles Times and The Associated Press reported that computer memory drives smuggled out of the base were being sold in shops. Some drives bought by the reporters contained material marked secret as well as information about insurgency activities and names and personal details about American service members and Afghan agents working for the United States military." Fox News is reporting the sold storage units are being repurchased by the military as they can find them.

Comments

Windows WinPC

[iggymanz]

I'm a little tired of Windows/WinPC's being used for sensitive government purposes, and in general treating all computers the same way a home PC is treated.

Re:Windows WinPC

[Doc Ruby]

I'm tired of the dumbing down of government security, and dumbed down home PC security that is the benchmark.

I'm also tired of TrollMods saying legitimate criticism is "Flamebait" whenever it criticizes the government, Microsoft, or some other monopoly.

Re:Windows WinPC

[yogikoudou]

I was going to say the same. How is it possible that Fox News reporters could even open the data files ?
One could expect that everything is encrypted, every single file being a part of a globla security policy, etc.
This is the army ! Big companies protect their sensible data by ensuring each sensible file is properly encrypted, defining trust circles, and strict key management policies. How were the files stored ? .DOC or .PDF files on USB keys ? I wonder how this is even possible.

Re:Windows WinPC

[tsm_sf]

Of course, when we discarded a computer, we removed the harddrives, open them up, used a belt-sander on the platters, then put the platters in an incinerator that was hot enough to melt them.

I was going to ask why you'd bother using a belt sander on something you were just going to melt anyway, but then I realized how much fun that would be.

Scary.

[lisany]

How long have we heard about companies selling old computers with customer data? Or people selling computers on ebay chock full of porn? The inability to learn from others' mistakes is a worry. Then again, the US military is in Asia

Clearly whoever is in charge never saw the Princess Bride and learned from Vizzini's wisdom

You only think I guessed wrong! That's what's so funny! I switched glasses when your back was turned! Ha ha! You fool! You fell victim to one of the classic blunders! The most famous is never get involved in a land war in Asia, but only slightly less well-known is this: never go in against a Sicilian when death is on the line! Ha ha ha ha ha ha ha! Ha ha ha ha ha ha ha! Ha ha ha

Course...he died, soo...

Does the military know about encryption?

[dmonahan]

Or couldn't they get an export license?

mis-information?

[JeanBaptiste]

While our military may sometimes seem incompetent, don't forget they are involved in informational warfare in many different ways you might never think of.

I wouldn't be surprised in the least if some or all of this 'leaked' information has been crafted to make our enemies think we are doing things we are not.

This is nothing new, look up operation mincemeat for a very interesting story of a successful mis-information mission performed in WW2.

Re:mis-information?

[s20451]

I agree that the military is capable of great things *sometimes*. But I have been in the military, and the military basically attracts the same caliber of employee as any other government department.

What is more likely, that the military let classified data walk out the door due to incompetence, or due to some clever X-files style conspiracy? After you answer that question, replace "the military" with "the department of motor vehicles" and ask yourself again. The answer would usually be the same in both cases.

Re:mis-information?

[rchatterjee]

According to the original LA Times article the reporters were able to find actual soldier's SSNs which they were able to verify by tracking down the home addresses and personal vehicles of the soldiers.

Granted the rest of the info could be false, but that would mean they're deliberately leaking troops' personal info which could be putting their families at home in some real danger.

Re:mis-information?

[smittyoneeach]

s/government department/any other large organization/

Because people just don't scale.

Win-win solution.

[xxxJonBoyxxx]

Here's a win-win solution: Send the old hard drives and other media to our units in Iraq. They can duct-tape them to their Humvees and use them as armor.

The bene's:
1) If the Iraqis steal the media, it'll be useless: the electricity in Iraq is never on long enough to scan a drive.
2) If you leave the media taped to a Humvee long enough you'll be guaranteed to achieve true data destruction.

Re:Win-win solution.

[fobbman]

Given that the hard drives would likely have Windows on them, due to the numerous security holes I'd say it'd be at best no different than them not being there at all.

See also the BBC report

[smithberry]

The BBC news site reported this a couple of days ago:

http://news.bbc.co.uk/1/hi/world/south_asia/490505 2.stm

I'm sure I read somewhere that the military are supposed to just melt old storage devices to be sure of getting rid of the data, but now I can't find that report anywhere. Theory and practice often differ I guess.

Second time

[k-sound]

This is the second time this happens in a few weeks time, the US military should really start to take better care for it's secrets.

Also,
DUPE!

Umm....

[KarateExplosions]

Fox News is reporting the sold storage units are being repurchased by the military as they can find them.

Fuck that repurchasing shit. TAKE IT. You're the goddamned United States military.

Re:Umm....

[Daniel_Staal]

But if they do that, the dealers will start hiding from them, and then they'll have to work harder to find the drives in the first place. They may even end up having to use force, and the dealers might decide to use force back. You could end up in a situation where a US soldier is killed trying to retrieve a thumbdrive.

This way is better and cheaper for everybody.

Encryption?

[rewinn]

Pardon my innocence, but shouldn't our professional military encrypt its storage devices?

wont work.

[JeanBaptiste]

I'd imagine the main cause of death from a roadside bomb is not the 'blast' itself but rather the shrapnel produced.

If a piece of shrapnel traveling at such speeds hit a hard drive, I'd imagine the result would be even more shrapnel from the HD+case shattering.

Armoring a vehicle or a person is a little more complicated than just slapping some extra pieces of metal onto it.

I'm hoping you were shooting for funny and not insightful, the mods don't seem to get it anyways.

Re:In other news...

[tomcres]

Actually, they found Saddam's weapons of mass destruction at the same Afghan market, but it took too long to draw up a military purchase order to "repurchase" them, so they've since been sold to someone else.

Why "repurchase" the drives?

[FellowConspirator]

What point is there to repurchasing the drives? Once the information is out, it's out. Anyone that would be interested isn't interested in the drives, they are interested in the data -- data that's easily copied and transmitted in a couple of minutes. All you are doing is paying people to get back a USB key, the data on which they've already sold someone else.

Heck, let them keep the drive as a keepsake. If the information is misinformation, maybe it will propagate farther. If it's real information, the damage is already done, there's really no point in rewarding for it.

Poor IT Security Governance...

[Anonymous Coward]

Storing unencrypeted sensitive data on a PC is bad enough, on a Laptop it's even worse - but who the hell is allowing the US Military to store classified data on REMOVABLE MEDIA? I work in Information Security for a Fortune 5 company, and we have banned the use of all removable media for just this reason, it has a tendency to travel. Is the US Military so obtuse as to believe that their people will never misplace on of these devices, much less walk off with them?

What? They're repurchasing them?

[Keyslapper]

Fox News is reporting the sold storage units are being repurchased by the military as they can find them

Why the hell are they repurchasing their own porperty?

Isn't that going to turn theft of military equipment and information into a whole economy?

Don't get me wrong, I don't think we should be there in the first place (IMHO, what little real benefit either the US or Iraq could ever hope to gain is nowhere near worth the lives of all those that have died), but if some bastard swipes my laptop, and I find out where it is, the last damn thing I'm going to do is buy it back. I don't care if the guy holding it is the one who stole it or not, he's not getting a nickle for something that's mine.

It's Ok, really.

[TiggertheMad]

From TFA:

..Some drives bought by the reporters contained material marked secret..

Hey, this is ok, as President Jr. decided to declassify the data and sell the drives to make a few bucks for a whitehouse kegger.

Badum-BUM! Hey, I'll be here all week...

it's not the first time.

[jerky42]

Back a few years ago, I was wandering around a flea market in a 3rd world country. This country had a US base in it that was destroyed by a natural disaster some years before. As I wandered past a stall with some ancient electronics in it, I happened to notice a new-looking KY-58 radio sitting there.
For those that don't know, a KY-58 is a secure voice radio that is still in use today in some USAF aircraft. It cost about $50,000 new.
Amazed by this, I asked the guy if it worked. He said "Sure, I just had it hooked up." I said, "how much?" He said, "100 US$". I said "Show me, and I'll buy it." He tried valiantly to hook it up, but the custom power plug, and the fact that it ran on 28v DC and 400 Hz AC defeated him, so I gave him $50 for it, and flew back home, and turned it in to the Air Force Office of Special Investigations. They said "Thanks", and I never got my $50 back.

Read Between the Lines Here

[popo]

What I find amazing about this is that these drives weren't smuggled for intelligence purposes. If they had been, they'd be in some room full of other gathered/stolen data files somewhere in Fallujah. ...But these drives are for sale in stores. This speaks volumes about the motivation of the thieves. ...and its more evidence that what we're really fighting is a symptom of poverty.