Slashdot Mirror
Fresh Security Breaches At Los Alamos
WrongSizeGlass writes "MSNBC is carrying Newsweek reporting on two new security breaches at Los Alamos. Both of these latest incidents were 'human error' on the part of employees. In one, an e-mail containing classified material was sent over the open Internet rather than through the secure defense network. In the other incident, an employee took his lab laptop on vacation to Ireland, where it was stolen out of his hotel room. The machine reportedly contained government documents of a sensitive nature."
You're missing one important piece of information in your description: how many false alarms does the border agent get from this system and all the other watchlist systems he has to work with? If the agent is getting hundreds of warnings that all turn out to be crap, why would he believe one good one?
Get a grip on that tinfoil beanie.
I'm not a fan of conspiracy theories, but if you honestly believe their strategy is competent and it's money wise spent, then I better be a tinfoil beanie.
Just because you don't care doesn't mean our enemies don't either.
Don't forget: they're not "our enemies". They're just the US military/govt current targets.
Why on Earth would Iraq be your enemy as a US citizen. What did Iraqi do to you or your US buddies. The only thing happening in Iraq right now is a bunch of citizen wars, caused by the invasion by USA in there. Saddam is dead, there weren't WMD-s in there, and Iraq had no connection to the 9/11 attacks.
I don't like how short people's memory about those things is.
I'd think, like virtually every other email system in the world, that users would have their MUA configured to send outbound email via a single mail server, where all further routing is under administrative control. Do they allow connections to that server from outside?
I could understand the issue, if it was someone sending to an external, insecure email address. But the summary, article, and now you all say the problem is with which network the email was routed over. The other possibility is they were off-site, and didn't have a secure VPN connection running - buy why would a secure system not force SSL email connections? Or is sending even over VPN/SSL not considered secure?
It's just not clear how the user has the control implied here.
(or is it that they're allowed to have personal email accounts on their machines, and that's where the email was sent from?)
"National Security is the chief cause of national insecurity." - Celine's First Law
You're missing one important piece of information in your description: how many false alarms does the border agent get from this system and all the other watchlist systems he has to work with? If the agent is getting hundreds of warnings that all turn out to be crap, why would he believe one good one?
Warnings on a passport to detain, immediately don protective gear, and notify DHS and CDC?
Not many.
That's why the agent's handling of this is such a big problem. And it represents another aspect of human failure in security.
Your point about false alarms is a valid one; this just isn't one of those examples.
And for anyone who is thinking about No-Fly lists or watchlists possibly falling into the "too many false alarms" category, they don't. When a name is on a watchlist, more detailed information about the person (e.g. DOB, addresses, etc.) is passed up the chain to any number of originating entities or authoritative sources. If that is the target, instructions for handling are passed back. If it isn't, the person is cleared. The reason why it's done this way is for a variety of reasons, not the least of which is so that people at airline ticket counters or fronline TSA staff don't have access to classified or private personal information (beyond what is volunteered or required to be given by the passenger) when processing passengers, to say nothing of the enormous technical complexities involved. That's why you hear stories about people not being able to "get off" watchlists. It's not "them" that's on the watchlist; it's someone who shares that - or a similar - name. That's why people who aren't actually wanted for anything whose names are on "watchlists" are always allowed to fly after the check. Persons in such situations who are frequent travelers are also able to get special documentation to solve this problem. But "they" can't "get off" the watchlist, because it's someone else who is on it, and that's what the detailed checking process confirms. Yes, it's a very, very imperfect system, but identification has always been a cornerstone principle in law for recorded history. We're using the best balance of technologies and privacy we have - really - to attempt to identify persons who should not be allowed to enter the US, fly, etc.