Slashdot Mirror
Reporters Find US Gov't Data In Ghana Market
narramissic writes "'Hundreds and hundreds of documents about government contracts,' were found on a hard drive purchased at a market in Ghana for the bargain basement price of $40, said Peter Klein, an associate professor with the University of British Columbia, who led an investigation into the global electronic waste business for the PBS show Frontline. The hard drive had belonged to US government contractor Northrop Grumman and in a made-for-TV ironic twist, 'some of the documents talked about how to recruit airport screeners and several of them even covered data security practices,' Klein said. 'Here were these contracts being awarded based on their ability to keep the data safe.'"
Yet another example of some bonehead "disposing" of old equipment without wiping the data first. Time to start cranking out those Pulitzer prizes. ;)
They should lose their contracts for failing to wipe the data off the hard drives.
Comment removed based on user account deletion
I disassemble it, remove the platters, mount each one in a vise and bend it by striking it with a hammer.
If they can get data off that platter, they're welcome to it.
'Here were these contracts being awarded based on their ability to keep the data safe.'"
Diversion wrapped in a diversion cloaked in a diversion. I bet the spies who read the contracts went out of their ways to break the procedures outlined in them, wasting precious time and resources instead of just getting em on the cheap in Africa. Where is your Isser Dzerzhinsky now?
some of the documents talked about how to recruit airport screeners
It contained a link to monster.com?
Always proofread carefully to see if you any words out.
and not think of real consequences.
It's a long standing complaint that governments keep information about contracts secret for the benefit of the contractors. Now you're complaining that a contractor didn't keep information about their contracts adequately secured? Are you stupid or something? The US taxpayers have a right to know the details of these contracts.. but they are denied that by commercial confidentiality concerns. If you want to cry a river for someone, think about the shareholders, but don't go blathering on about "secret government contracts" because they simply shouldn't exist.
How we know is more important than what we know.
From the article:
The drive had belonged to a Fairfax, Virginia, employee who still works for the company...
But for how much longer?
$40 for a used hard drive of unknown provenance seems pretty high, unless you are talking about a considerably cooler than ordinary drive. Methinks that those journalists were haggling about as effectively as someone with an expense account for the story might be expected to.
Does anyone know if there are any stand alone devices designed to erase the data on a hard drive? I am thinking something you plug in and it then goes about erasing all the data (I am thinking simpler and cheaper than a PC). I doubt a magnet would be a reliable solution. While destroying the HD physically is a solution, it prevents the drive being reused.
Jumpstart the tartan drive.
Those "locks" do nothing to protect the data, and the drive still spins up when power is applied. You can even retrieve the password if you know what you're doing. Full drive encryption is a much better solution.
Perhaps they should start full-disk encrypting their hard drives. Being a government contractor, especially a government contractor that deals with security, encryption as a requirement is not a bad idea. Of course the disk still should be properly wiped before being disposed of.
They make nice targets. Even the NSA would be hard-pressed to get data off of platters with bullet holes in them. I have seen this done with a high-velocity 7mm bolt-action rifle. VERY effective. Auditor asks how we ensure that hard drives are erased when they are taken out of service. Of course we erase them before using our "special process". Showed them a few samples, bullet holes and all. No more questions about hard drive erasure.
Yes, it's called a linux bootable cd. It turns out it's quite cheap as well.
How tough is it DBAN (Darik's Boot And Nuke) a PC before sending it to the disposal company?
This employee should be forced to EABOD (Erase A Bunch Of Disks).
__ Someday, but not this morning, I'll finally learn to use the preview button.
The only secure information is never written down or told to other people.
Those "locks" do nothing to protect the data, and the drive still spins up when power is applied. You can even retrieve the password if you know what you're doing.
This might be possible if you know the drive very well; the vendor might have a tool which can handle it. But you need to know the manufacturer's comment to print the HDD lock code, since there is [obviously] no standard ATA or ATAPI code to do so. If there were, hacking Xboxes would be a hell of a lot easier.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
not that this does'nt happen, i just find the story unlikely , reporters go to a random market in a random country and find this disk. more likely they had the disk beforehand and just made up the market bit.
Here's the $64,000 question - what was the name of the data destruction company that obviously failed to perform to the contract specifications? Everyone here needs to know that.
Northrop-Grumman almost certainly outsources this part of their IT. They may outsource other parts. I worked at a competing company that placed a bid on a NASA IT desktop management contract. N-G won it because they were the low bidding submission. Many of the people that already had the contract just changed badges from X to N-G and took a 15% pay cut. Nice. I was just on the proposal team.
Proprietary documents don't usually get treated like SECRET documents because there isn't jail time if the contract isn't followed.
The sensitivity of the position determines what types of legal paperwork was signed. Upper and first level management set the tone for how seriously any violation of contracts and laws are since it is unlikely any violation will ever be known outside the company. To me, an "Oath" is less important than a contract, but I'm an atheist and think all the people talking to themselves are crazy and stupid even if they call it "god."
I've signed many legal agreements concerning sensitive data for companies and the US government. My employer never new some of the things that were US government secrets since they didn't have a need-to-know. I take these agreements **very** seriously and never treat any company or government data lightly.
Data security rules are there to keep the data secure, not make your job easier.
Even my immediate boss inside the company didn't have clearance to know most of what I did. Annual evaluations were funny since he wasn't allowed in the building. I'd have to meet him at a different location to have a face to face conversation. "I hear they are happy with your work. Sorry this pay raise isn't as much as we'd like to give you. You're work is definitely worth 2-3x more." I say, "thanks. No problem." Then 2 weeks later, I accept a different position for 2x the salary. 3 years later, I accept another position for 2x the last salary. Now, I'm retired.
pubs and dems speak of. Problem is that we have to go countries like Chana, Russia, China, Venezuela, Iran, and North Korea to get it. Hopefully, Obama realizes that Security MUST change. We need to worry more about other nations and the companies that we employ, and less about spying on our citizens.
I prefer the "u" in honour as it seems to be missing these days.
i'm getting laid off next weds;-)
Couldn't you just replace the circuit board with an identical one? Tada, data.
A friend of mine lived in Ghana for a while and got fed up with being constantly haranged by market traders so he told one of them that there was something he could do with - a monkey head. Sure enough, the trader offered him one for about $90. My friend baulked at the amount, saying he could buy a live monkey for far less and remove the head himself. He was of course then offered a whole monkey at a bargain price.
Weaseling out of things is important to learn. It's what separates us from the animals... except the weasel."
They should implement a stronger punishment and reward scheme for this.Award a major amount of money for drives that are not wiped clean...this will lead you to the person who did the damage. So you pay to find out who, then that person in turn owes you back for the money you spent...so 1 or 2 cases like these will be enough to send a clear picture to the rest of them...its easy enough to use a data wiping software...turning all bits into zeros. Seriously...get educated if you handle getting rid of hardware that belonged to a company with sensitive materials!
"The Capitalists will sell us the rope with which we will hang them." -V.I. Lenin
Let's prove him wrong, eh?
--
Toro
Speaking as someone that works at seagate, doing test process and calibration:
If you replace the board with an 'identical' one, you will lose all the calibration information, this includes things like telling the drive how to keep the heads from crashing into the disk to where the data tracks actually are, things that differ from drive to drive.
Most likely pulling this switch will yeild nothing but a brick.
Trickier than you think. The problem is that a lot of the drive erasing software people are mentioning in this thread isn't NIAP approved, which means that the Common Criteria Testing Laboratory hasn't analyzed the product, run it a bunch of times, and verified by hand that it does what it says it does. You, I, and some subset of Slashdot's readers might be inclined to check out the source code for DBAN, read it, test it, and make sure that our porn stashes are irretreivable, but the US government and military don't. They rely on the NIAP list to 'prove' (for some meaning of the word) that a given product does what it's supposed to and meets their standards, and trying to use unapproved software in those particular areas of employment is difficult in the extreme. The US military does have access to a couple of drive purging apps but the trick is actually getting hold of them.
Sure, disassembling hard drives is time-intensive. But the real reward is that you can salvage a bunch of really powerful magnets for mad-science experiments.
It's a shame that the original Frontline/World video report wasn't linked to -- it's an incredible and horrifying expose on the worldwide problems of e-waste disposal.
It's call a power drill. Just fit it with a metal cutting drill bit and you're ready.
ELOI, ELOI, LAMA SABACHTHANI!?
Instead of using illegal wiretaps, the NSA should just buy every drive that is sold on eBay. Just think of the information they could mine out of them!
The real "Libtards" are the Libertarians!
Nonsense, placing platters into other drive enclosures to aid in data recovery is one of the oldest tricks in the book. It may not be perfect but it'll certainly work well enough.
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
The Hoff was right this time though. He TOLD us that the data is "Looking For Freedom."
My first Journal Entry ever, in 8 years! http://slashdot.org/journal/365947/aphelion-scifi-fantasy-horror-poetry-webzine
a defensive exercise. It doesn't matter what you do possibilities like this are always going to happen. There are always going to be lapses or loopholes and when they happen it's always going to be "OH-MY-GOD-I-CANT-BELIEVE-THIS-IS-POSSIBLE" and then there's some outrage and then either behavior continues or some other "OH-MY-GOD-I-CANT-BELIEVE-THIS-IS-POSSIBLE" thing happens.
....
It does bring up the point that you shouldn't count on contractors like Lockheed, Northrop, etc to keep us safe, they'll only do what's cheapest.
At the federal agency I work with we physically destroy the hard disks we excess.
Although I can see if some contractor just deleted data and then let the drives out that inevitably some news outlet would discover that Disk Doctor actually exists and then
yet again...
another..
"OH-MY-GOD-I-CANT-BELIEVE-THIS-IS-POSSIBLE"
All that is (in fact...) coming from the government that wants to force ACTA onto the world.
http://www.eff.org/press/archiveso/2009/05/06
Yes, the military-industrial complex owns the government.
What the GP appears to be refering to is an ATA password. This does not encrypt any data on the disk, but it does lock the drive, and store a hash of the password on the disk itself. Replacing the circuit board will not fix this, as the new circuit board will detect the password, and keep the drive locked.
If you're working there you want EBAN not DBAN for records sake.
Though i'd think they would be using hd destroying machines.
Comment removed based on user account deletion
i'm not ur typical /.er living in my parents' basement;-)
The best way to dispose of a hard drive is to open it up to get the platters, blast them with a blowtorch until they become brittle, smash them to tiny bits/powder with a hammer then scatter the tiny bits into the ocean.
Check out my sci-fi book "Lacuna" at http://goo.gl/MVxX8
In many cases, just swapping drive controllers works just fine for data recovery.. Haven't tried that with a password-locked drive. But it stands to reason if the hashed password is stored in flash rather than on the platters then swapping the controller would be a potentially viable attack.