Slashdot Mirror
Court Allows Arkansas To Hide Wikipedia Edits
rheotaxis writes "A circuit judge in Arkansas will not order the state to reveal where its computers were used to edit Wikipedia articles about former governor Mike Huckabee while he was running for President. Two Associated Press journalists used WikiScanner to track the edits to IP addresses used by the state. Writer Jon Gambrell and News Editor Kelly P. Kissel filed a suit in October 2007 asking the state to reveal which state offices used the IP addresses, because state rules don't allow using computer resources for political purposes. The director of the Arkansas Department of Information Systems, Claire Bailey, claimed in court that releasing this information would allow hackers to target these state offices."
What, you need more then a IP to hack a computer?
It is certainly a fine concept to want a fully transparent government. We (at least those of us here at Slashdot) demand the same of our operating system. And likewise, we try to argue that "security through obscurity" is a useless endeavor.
However, the security of systems relies at some point on the obscurity of certain pieces of data. Whether it be a user password or a map of a network topology, the information itself has no real reason to be made public just for the sake of openness, one could argue.
Even considering that the system may have been used inappropriately, is the crime worth the possible destruction of the entire network at the hands of hackers? Shouldn't there be a great deal of discretion when risking opening up of confidential information that could have a severe detrimental impact on society as a whole?
Not being able to track down someone who dares to edit a Wikipedia article... Wikipedia, where the truth is made by people with enough time and zeal to monitor pages 24/7 for violations of their own little world view.
Judge, next time the RIAA comes about some IPs, just think about how the evil hax0rs would be able to target those persons if their information were released. It just makes sense!
Should that circuit judge be able to keep their job?
After all, he's blatantly participating in a cover-up of illegal activities in the Arkansas state government.
Tired of Political Trolls? Opt Out!
This isn't about transparent government v security. Security through Obscurity is the well known worst approach to security that you can have, because if anyone ever does get that information (hell bribing a sys admin can't be that hard if you really want the info) then your have no security.
Its a bogus claim and a bogus judgement. If they were claiming that it shouldn't be released because editing Wikipedia isn't actually a political thing anyway then I could see a reason to toss it out. But the risk of hackers "targetting" bits of the network is just plain bogus, the implication is that these IP addresses are therefore in some secure part of the (ARKANSAS!) government and those IP addresses have already been released. What is being asked is a map back from a known IP address to its source. Claiming that knowing the physical source would some how make security worse is like saying that "Sure you have the keys, you know where the front door is and you can get in.... but I'm not telling you the NAME of the house".
Having the IP address is like having 1600 Pennsylvania Avenue and the keys to the door but the government not telling you that it is called the "Whitehouse" for security reasons.
An Eye for an Eye will make the whole world blind - Gandhi
501 REPRESENT
The real problem for Gov Huckabee is that if he plans to run again for President this will become an issue - an IPGate that he wants to avoid so it can't be used against him. Of course, the press will start to look for other ways to get the information. Of course, the real problem is the coverup - did the Gov order the information not to be released? Did he know someone in government was using official computers for political purposes?
I'm a consultant - I convert gibberish into cash-flow.
It's true ! Releasing this information would allow hackers to target these state offices in person.
As opposed to the hacking they will likely get as a response to trying to hide the information? Throw down the glove, why don'tcha?
Reality is prettier inside my head...
When I read that the "state rules don't allow using computer resources for political purposes" it seems clear to me that someone broke the law by using one or more State of Arkansas computers to perform the edits. The decision by the State court tells me that they are either clueless about technology or there's collusion between State agency's. Now, that couldn't be?
To say that I don't have to provide information in a criminal case because my computer could be hacked is laugh. Come on! ANY public IP address can attacked. The IT director is not telling the truth because she's either ignorant (and misinformed by her staff) or outright lying. She should be fired either way. Then again, lying seems to be a job requirement for most leadership positions within government nowadays. Maybe she gets a raise?
It's simple, a public IP address was used to break the law. The organization should be required to identify the internal machine that used that use that public IP address. Unless of course they no longer have the logs to provide that information. Oops, your honor, the logs weren't working during that time.
This story stinks of government corruption.
When Reverend Huckabee runs for president again in 2012, just remember then that you can't see how much of his Wikipedia entry was cooked by his staffers still buried in the Arkansas government he controlled up until he ran for 2008.
Consider how Reverend Huckabee destroyed evidence on many state computers to cover probable crimes (hard to prove when he's destroyed the evidence) when he left office in Arkansas to start campaigning for president.
Reverend Huckabee stands for faith based government. Why shouldn't he rely on a "mysterious hand" to improve his image?
And keep in mind just how much power he'd have with a covert government built on the foundation installed by Bush/Cheney.
--
make install -not war
Knowing the name of the agency and the building would make it easier for reporters to pursue the truth about who did the editing and why. You can't question a suspect until you obtain knowledge about their current location and their presence at the place and time of the incident being investigated. It's not about computer security. It's about government agency PR and legal liability.
But the architect's drawing of the bank could reveal it's actually not very secure at all, if it reveals a point of attack that's easier than going after the vault door.
Have you been touched by his noodly appendage?
I'll bet if the Huckabee staffers were accused not of whitewashing Wikipedia articles, but rather downloading copyrighted music on BitTorrent, the tone of this /. discussion would be entirely different. (I'm just sayin'...)
That's OK -- we're all a bit hypocritical about some things. I, myself, have been known to indulge in the fine art of hypocrisy now and then...
"Every great cause begins as a movement, becomes a business, and eventually degenerates into a racket." -- Eric Hoffer
it does not matter if they get the ip addresses how are they going to prove who was sat at the computer unless they ask tha riaa for help
Obviously the notion that they can't provide the IP information for security reasons is bogus. But could we not look at this decision as a win because it may set a vital precedent for similar cases in the future? The government has ruled it cannot be forced to give out IP information on people accused of wrong-doing on the Internet. By this logic, neither should ISPs or people who run a website be forced to surrender their logs at request. Surely the government wouldn't take privileges unto itself that it would not give to its citizens, right?
Ask the state to confirm their claim about their security through obscurity. The network administrators can't alter the network configuration so the revealed IPs will connect to a different place?
Sorry, no one else killed their karma with this one, so I felt compelled to do so:
There was only one IP involved in the edits, apparently it was 127.0.0.1 ..
Internal network topology is a way of organizing a network for administrative purposes, and is in NOT designed, nor CAN be be designed, to provide security
Ever heard of Network Admissions Controls?
802.1x Authentication?
The largest threats to IT security comes from internal users and internal physical access.
Locking down internal access to your network resources is one of the biggest steps you can take towards improving security. The number of organizations who leave lots of unused RJ-45 wall jacks around their office buildings actively patched into hot switch ports is astounding. In that situation, all it takes is someone with a laptop and a few freeware software tools to plug in and do all kinds of "nifty things" on such a network.
Nice straw man. Care to explain how locking down your network has anything to do with telling people about your network?
As Gorshkov said, a network is either secure, or it isn't. Disclosing the topology doesn't change that.
Isn't this sort of court decision nothing more than an invitation to hackers to break into the computers at the known IP addresses to discover which state office they lead to?
Proxys FTW :)
Just ban the entire Arkansas government IP range from Wikipedia edits until they become more reasonable. Small amount of effort - big payoff.
As for the IP address, you already have that. What else is given away by tying it to the computer used?
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
If, for the sake of argument, we assume that tying the IPs in question to a department poses an ongoing risk... then change the IP subnet assignment in the specified range. It can be done in a night.
Of course it's silly to assume that knowing which department uses which IP creates some added risk of attack.
It sounds like doing so is at worst a violation of the state employee handbook.
Using AK state property to edit Wikipedia, while an inappropriate and partisan use of state resources, was almost certainly not a crime.
The password is obscure, sure, but the underlying security mechanism shouldn't be. If you rely on the your password-checking algorithm being secret for security, this is "security through obscurity" (no security at all really because it will likely be easily reverse-engineered or discovered some other way). If, instead, the password-checking algorithm is publicly available and yet still cannot be defeated without knowing the password, you've been doing your job right. That's security.
The popup would say something like "In order to improve the quality of Wikipedia, please specify your ISP (or company) and general location"
I'm sure someone would eventually give away their location.
echo '[q]sa[ln0=aln80~Psnlbx]16isb572CCB9AE9DB03273snlbxq' |dc
I work in city government. So you are telling me that I'm not allowed to post/edit anything on wikipedia that might be political? Hmm...
I want to tell you the one time that I remember government resources actually being used for political purposes. A "mandatory" meeting was held where everyone in our agency had to show up and listen to the pitch of the state guy over all of us as he was now running for some office. You don't know how that boiled my blood. Wasting my and everyone else in our offices time because the head of our department thought that it was a good idea to lend that little bit of political support to that other guy.
Generally the rule is you can do what ever political stuff you want as long as... you don't wear that government shirt that says you are from this office and makes it look like that office is supporting whatever your platform is. The other general rule is that you aren't generally allowed to wear/spread your political stuff over work e-mail.
Now if you are assigned a car and it's your take home car it gets tricky. The rules on that change depending on the current weather. ;) Generally they don't care if you use it for going to church, getting food, or if you are supporting any of the local candidates. (As long as you are paying for the gas.) It becomes an issue if someone complains. Then what you'll see is memo sent out an everyone is supposed to only use their assigned cars only to travel from home to work or around on work business. You know how log that really lasts. It lasts a year or two, or until the given supervisor that made that rule changes and then it slowly goes back to hey no one cares if you go to walmart or church in your city car. Until that one day a reporter complains that you are using a city car for political purposes.
Now compare that to your assigned laptop or desktop with internet access.
Is this even that big of an issue? I know that that state owned computers shouldn't be used for political purposes, but it's not like there's lasting damage. The vandalism probably disappeared within a few minutes (tip of the hat to counter-vandals). This looks like making a mountain out of a mole hill.
"it's not about aptitude, it's the way you're viewed" - Galinda
The sole purpose of the governments is to promote politicians in their career path.
The IP could be traced, eh? I guess they should have used https://www.torproject.org/ to do those edits... if Tor users are not blocked from creating users at the moment, which is frequently is. "We traced those edits to some IP in China which happens to be a Tor server, now what do we do?"
9/11: Never forget it was a false-flag operation
Maybe we should proxy DOS all the state address until they get off their ass.
Well at least they didn't say, that with only an address wouldn't tell them who it was. They would also need a date and time, which would make people able to hack time and space.
The IP addresses of all government institutions are known. Why not just block them from editing Wikipedia pages?
"If you aren't investigating private persons, then you don't need a PI license."
There needs to be a word for "so incredibly wrong and stupid that the person responsible should be bludgeoned about the head", so I could use it for your post.
You're wrong, and the mods who agreed with your VERY WRONG statement need my as yet uncoined word applied to their idiotic mods as well.
"The government grants you rights, not the other way around."-- beav007. Yes, these people really exist...
"The real problem for Gov Huckabee is that if he plans to run again for President this will become an issue "
BWAHAHAAHAHAHAHAAA.
BWAHAHAHAAHAHAHAAHAHAHAHA.
You HONESTLY think that some anonymous fucking edits will matter one iota if Huckabee decides to run again?
I don't know what's worse, that you choose to voice your naivety of politics so openly and pretend you are saying something that isn't colossally stupid and wrong, or that some other fucking idiot agreed with you and wasted a mod point.
No, this isn't an "issue" it will NEVER be an "issue" and the only people who give a fuck about it are either looking to make their bones any way they can, or are too stupid, oblivious, and partisan to understand NO ONE GIVES A FUCK ABOUT SILLY INSIGNIFICANT SHIT LIKE THIS. If you DO give a fuck about shit like this, your opinion isn't worth listening to.
And stop throwing around the word "cover up" you fuckwit, you using it demonstrates you haven't even bothered to inform yourself about this story.
"The government grants you rights, not the other way around."-- beav007. Yes, these people really exist...
Of course, if you're more interested in getting it done fast than right, making it closed source makes it more likely to get the code released before someone finds a vulnerability.
Have you been touched by his noodly appendage?