Slashdot Mirror
Server with Top-Secret Data Stolen
An anonymous reader writes "Usually missing information stories are fairly low key; the loss of a few thousand student records is cause for concern for those involved, but hardly national security. This one is slightly different. The company Forensic Telecommunications Services has announced that a server containing 'thousands of top-secret mobile phone records and evidence from undercover terrorism and organized crime investigations' has been stolen. From the article: 'The company — whose clients include Scotland Yard and the Crown Prosecution Service — has assured the public that the server is security protected, and the breach will not compromise ongoing police operations. The information is made up of either old cases that have passed through the judicial process, or cases that are already in the judicial system and so subject to full disclosure to both defense and prosecution teams.'"
...Forensic Telecommunications Services is a UK company, not a US company, so please keep that in mind when crafting your comments.
(And yes, this is fairly plainly obvious to anyone who takes a moment to look.)
I blame the intern!
The game.
Comment removed based on user account deletion
Which is it: Top secret phone records or information that has already been released in court cases? It doesn't seem like the two are the same.
Except that their physical security is apparently so poor that I can't imagine their data security is much better.
"All the data is protected, as long as the thieves don't look at the password sticker hidden inside the case."
"It is a miracle that curiosity survives formal education." -Albert Einstein
from the Russian mafia.
"Top Secret" is a term reserved for government classification schemes (in the US) and is clearly outlined by US laws. Using "Top Secret" for a business is just sensationalism. This business lost sensitive data, not "Top Secret" data.
Do this mean that I will finally be able to see a detailed listing of my wife's calls? :)
If at first you don't succeed, call it version 1.0.
Shouldn't someone explain wtf does top secret policial information in the hands of a corporation? Such information should be gathered, kept and custodied by police.
"FTS can confirm that the company was recently the victim of a break-in at one of our premises in Kent. As a result, some IT equipment including a server was stolen."
Very important info for all those who want to start a flame war about what OS it was running and why it was connected to the Internet.
-----BEGIN PGP SIGNATURE-----
12345
-----END PGP SIGNATURE-----
Well since this article is somewhat disappointing, I find a previous article detailing an airport data server which was stolen far more serious. I know it was covered here on slashdot back in 02' or 03' but was unable to find it.
Wasn't this an episode of "Spooks" ("MI:5" in America)
Spooks Brain? "Brain and Brain, what is Brain?"
Politics is the art of looking for trouble, finding it everywhere, diagnosing it incorrectly and applying the wrong fix.
Either this unit has been misplaced or it is actually stolen. The question is how? Was it locked in a Telco closet? If so, then somebody forgot to lock it. That was probably the last technician that last did maintenance on it. Ouch! If it's an actual PC based phone system then it's already been rooted which is extremely easy when you have access to the local machine. Some still run Win2000,Warp OS/2, and Linux. I guess the only value that server has to offer is in selling the phone numbers off to the highest bidder. The server parts will just become some kids PC. Any thoughts?
Comment removed based on user account deletion
Somebody drops the ball when a backup tape goes missing. Laptop gets stolen isn't that much of a stretch, but a server? You would think something like this would blow away any confidence people have in this company... Company I work for wipes all computers / servers that get shipped, and the image is pushed over a secure network, hard drive encryption or not, and we don't even have much in the way of confidential information.
An I.T. motto in the hands of an idiot is a dangerous thing...
1. Cryptonomicon-style, with a big coil embedded in the door frame of the room where the server was stored (question is, would that even work, without using an MRI as the coil)
2. with a brick of thermite on a proximity detonator inserted into the case
3. boring ol' cryptography
Security Protected? Meaning what? You have to login to Windows?
Do you think that something like this cannot happen anywhere else?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
If their physical security is this bad, one wonders how much value should be placed in the statement that the data on the server is "adequately protected".
Moreover, this should spark the debate whether it is okay that private companies work on this sort of data, and whether the government should or should not have its own data specialists.
Ten to one, we hear next week that some large repository of Student papers is vulnerable too.
This sure makes me glad I live in the state of Ohio! Oh, wait...
Never attribute to malice what can be explained by stupidity.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
It seems most journalists are just mouthing the press releases over again. "Security Protected" is a talk-down-to-you phrase, "protected" means "secure" anyway, and it intentionally doesn't tell you anything about how it really is protected. The company with the break-in obviously wasn't using security sufficient to deter people targeting them - for a security analysis company not to use more expensive security commensurate with the value of their clients' info is not even mentioned. Something silly about outsourcing is mentioned in TFA but in not the press release of course because it was stolen from their premises. Impossible perhaps to deter a truly obsessed insider, but for TFA not even to talk about what that incredible "security protected" technology stuff is, is just dumb.
I think it would be in the company's best interest to say everything was encrypted with unbreakable algorithms, but perhaps they have rules about not disclosing anything and maybe they don't want to spread the idea that people should encrypt things, that would certainly put a damper on their business, wouldn't it. I'd understand if they don't want to say they have a cell phone tracker or phone home device in it, but as for trusting them when they say nothing is important on that server they stole sounds very strange. More likely someone knew what they were going for it sounds.
Well, I always use encrypted partitions for equipment that could be stolen - laptops, or my home PC - but I wouldn't consider it for servers.
This makes you think though.
Get your own free personal location tracker
invasion of privacy is a very pervasive thing once you start it up....
Other threads are quite correct to say that UK/US/Can etc have similar classifications, and that contractors routinely handle these (though note the lack of a US "Restricted")
When I started my career at a UK C+C Headquarters, we still had some old documents with the original UK top classification on, which was "MOST SECRET". They changed this during WW2 because the Yanks might read this as 'Almost Secret'.
All these classifications used to refer to Military Intelligence-type data. But come the end of the Cold War, the spooks grabbed any work they could to justify their budgets. Lots of this work was in non-military areas - even terrorism was originally non-military, but now lots of 'civilian' work has fallen to them. So I would not be surprised to find data on gangs, or porn barons classified as 'TOP SECRET'. Heck, I bet that Thames House South holds some papers on the current protest at Heathrow with TOP SECRET all over them.
"top secret data ...subject to full disclosure"
It is probably understandable how laptops and PC's get stolen, as maybe an opportunistic theft, but how the fuck can someone just wander off with a server? This presents two reasons why it was stolen
1. It was stolen for the hardware, so have a look on ebay soon
2. It was stolen for the data that the machine contained, which is probably more concerning.
This post is Treat As Top Secret.
-- I'm not a pessimist, I'm a realist. It's not my fault that life sucks so much. --
The Rand Corporation, in conjunction with the saucer people, under the supervision of the reverse vampires, are forcing George W. Bush to go to bed early in a fiendish plot to eliminate the meal of dinner.
We're through the looking glass, people
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
The information is made up of either old cases that have passed through the judicial process, or cases that are already in the judicial system and so subject to full disclosure to both defense and prosecution teams.
So...not top secret then.
Perhaps it's the commoditization of data? It used to be that anything written down was important. Then only certain paper from certain individuals. Now, with 1 TB hard drives, how easy is it to tell what's sensistive and what isn't?
You have a 60+ GB drive in a laptop, a speadsheet with all the sensitive SSNs and such is maybe a couple of megs. All the rest of it is no big deal.
Perhaps instead of putting stuff on the internal drive, the sensitive information is put on external drives with stickers reading "If this goes missing you will lose your job and be charged with a felony." Maybe that will motivate people to pay attention to what is important (and safely ignore what is not).
I was just looking for porn. I'll give the system back when I am done with it. Bunch of crappy phone numbers. Don't worry, when I give it back there will be something worth keeping safe.
--- "CAN'T YOU SEE, MAN? IT'S THE END OF FREEDOM!"
N IX-PA-RISC-550MHZ_W0QQitemZ280141263427QQihZ018QQc ategoryZ162QQssPageNameZWDVWQQrdZ1QQcmdZViewItem
No problem, everyone calm down. The server has been located. http://cgi.ebay.com/A6144A-HP-9000-Server-L3000-U
> Usually missing information stories are fairly low key; the loss of a few thousand
> student records is cause for concern for those involved, but hardly national security.
Yeah! The problems of tiny organizations are not really worthy of national, much less international, attention.
> This one is slightly different...'The company -- whose clients include Scotland Yard
> and the Crown Prosecution Service '...
Wait, I thought you said this was slightly different. Sounds like the same class of problems as that of a small school, from the point of view of the $2.1 trillion spending, 15 aircraft carrier battlegroup wielding, moon-landing, shuttle-launching, eh, it's only $500 billion for this war, that savings & loan bailout, that geezer drug benefit cha-CHING-ing nation.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Do you RMA unencrypted disks? How do you wipe sensitive data off the dead ones? There are plenty of reasons to encrypt server drives.
Today its server with sensitive data in the UK.
Tomorrow: Profit!
"Now I'm seriously serious!" - Serious Sam
Wow. I don't know which is scarier - the possibility that you missed the joke because it was over your head, or the possibility that such a load of drivel sounded reasonable enough to you for you to debate the issue. Either way, I'm scared.
You have no need to be scared. While the complete post was a joke, it began with a statement that many actually do believe. The point contained in that statement was worthy of being discussed, the fact that it was introduced as part of a joke does not detract from the fact that many believe it. Humor and satire are often used to introduce serious topics. Did I miss some rule that only the original author and not a responder may do so?
No one seems to regard security with enough concern to actually do enough to protect it, just talk about how they are so good at protecting things.
As I have read a lot on administering servers there is one axiom that stands out, "even if you do all the communication and data protection as well as keep out bad guys from getting in through your ports, if they get hold of the box it is just a matter of time, as they have total access."
Encrypted drive with a password to open access during boot would be the best (unless bad guys compromise the box while it is running).
But who knows there probably is a way around that too, as with DRM - someone somewhere seems to eventually figure out a new (usually easy) method of bypassing the most secure systems.
"Enjoy what you're doing! If it becomes drudgery, you're doing it wrong!" - Jim Butterfield
I use Cryptobox. Is that good enough?
I'm serious. I don't know if it's good enough. I chose it because it was easy to use but it could be horribly flawed and I'd never know.