Slashdot Mirror
Punishing Security Breaches
Schneier has a story on his blog this morning about
punishing security breaches. This one is in response to the tale of Gray Powell, the Apple engineer who left an important bit of technology in a bar recently. You might have heard of it. You also might have been on either the breacher or the corporate side. I'd hate to be in either position myself.
California law prohibits the sale of stolen goods and states that a person who uses someone else’s lost property without permission may be guilty of theft.
And since it's over $950, it's a felony. Even if they didn't know it was stolen, they could face a lesser charge of "misappropriation of lost property" which is a crime but not theft. Charges haven't been pressed yet but the police say they're investigating the options.
My work here is dung.
No I have not! What is this "Apple" you speak of?
If someone wants to take something classified out of a top secret military compound, he might have to secrete it on his person and deliberately sneak it past a guard who searches briefcases and purses. He might be committing a crime by doing so ...
Are you joking? Try losing their security clearance, being court marshaled and a probable investigation into 1) what motive you had removing classified material 2) where it was going and 3) how many other violations you knowingly committed.
I've gotten a corporate laptop with semi-sensitive material on it about the company I work for. I was given it when I traveled to various states. The guidelines were very clear. From locking it in the safe when I left the hotel room to not leaving it in my car. While it's less likely that someone would show up at a bar with a laptop, this is outright out of the question. Regardless of how lax their security measures are you might misplace a phone while drinking so don't bring it drinking! If you want to or accidentally take it drinking, you're accepting the risks.
It'd be hard for me to imagine that Apple -- the pseudosecretive company that it is -- wouldn't have stringent policies in place. Still, firing Powell would look less than heartless. I'd be shocked if any company as big as Apple didn't have such policies explicitly spelled out.
My work here is dung.
A PR agent finally does what he is supposed to (for once in his life with great succes) and they punish him for it. Apple's 1997 slogan goes to waste here Think different? Yeah right!
Be yourself and aim high!
There's only one way to take care of someone who leaks mission critical information.
First you fire them. No sense in keeping them around if they are going to fuck up like that.
Next you sue them for major damages. Make an example out of them.
Since a corporation has no way to punish someone with actual jail time, the next best thing is to make sure people think twice before making big mistakes again.
I wonder if this was a way to let people know another one is on the way. The way the "Blogosphere" is intentionaly manipulated by corporation is obvious to me. This whole scenario seems unlikely to me.
After very visibly refusing to name the guy who lost the prototype, why is Slashdot now doing so?
Are you adequate?
Please stop these stupid articles about someone fucking up or planting a phone.
Stop it.
Stop advertising for them.
There's only one way to take care of someone who leaks mission critical information.
First you fire them. No sense in keeping them around if they are going to fuck up like that.
Next you sue them for major damages. Make an example out of them.
Since a corporation has no way to punish someone with actual jail time, the next best thing is to make sure people think twice before making big mistakes again.
There's only one way to take care of a company that is so antithetical to mankind's interests.
First, the rest of us, who have a sense of real (human) justice, get together and burn down the headquarters of your vicious little company. No sense keeping a company around that is going to fuck real people for simply being human. Make an example out of it (and its shareholders).
Since humans have no way to prevent a company running amok in our rampent corpratist state and trampling every vestige of fairness or equity, the next best thing is to make sure companies thing twice before making big mistakes again.
As much as everyone had been beating up on gizmodo for leaking this guy's name, I would not be surprised if the only reason he kept his job was because of the publicity.
Firing, I can understand, but suing? No one was publicly humiliated or libeled. No one was physically harmed or killed. No one else suddenly lost their job. No one was discriminated against or denied rights or equal protection under the law. No one cheated or stole anything. No one was placed in potential harms way.
IANAL so I won't comment on if someone could be legally sued for this right now in the US. But I will say that I don't think anyone should be sued for this nor do I think the law should allow it. The guy goofed by leaving a phone in a bar, this isn't like falling asleep while monitoring a nuclear power plant. Being fired is enough punishment.
"All great wisdom is contained in .signature files"
This to advise one not to discuss trade secrets over lunch.
Request your free CD of my piano music.
Really it's up to Apple what they want to do - assuming it isn't all a ruse in the first place. Although the same thing could happen to anyone with a prototype, it's still a Bad Thing (TM) and it's still up to Apple what they want to do. There's really no news here at all...
Apple's got no trouble attracting applicants.
They might do, if they continue to grow a reputation for Stasi style tactics and policies that make Orwell look like an optimist. Which firing and suing this guy would certainly do.
How far Apple is from the tipping point of going from "a cool place to work" to "last chance saloon for those desperate enough and unable to get work elsewhere" is an open question, particularly in today's economy. But one thing is certain...they are closer to that point now than they were two years ago, and will be a whole lot closer still if they act in a vindictive manner toward a guy who simply made a mistake any of us could have made.
After all, who hasn't lost a cell phone at least once in their life? (A good reason to never volunteer to test prototypes, especially if your lifestyle includes the occasional pub visit)
The Future of Human Evolution: Autonomy
Come to think of it, as the lost iPhone was really already a 4th generation device, Apple probably wasn't seeking any sort of punitive measures against the guy, and the restrictions on personal use of prototype hardware was probably heavily reduced.
After all, it's an iPhone. We've seen the 3 previous models already. And there isn't much new or innovative Apple could've put in.
Hell, Apple doesn't make big announcements when they introduce new Macs (like they did a couple of weeks ago) - just a quiet little refresh, and every other site picks up and makes it news, even though it's just spec bumps here and there and minor new features. Maybe if there was a super-big-fantastic announcement (e.g., Blu-Ray support), but for the msot part, most announcements are low-key. It's hard to generate buzz. Or hell, when the iMacs came out and the 27" came with a video input.
Ditto the iPods - sure a nice keynote on the new features, but then again, the old iPod Touch and the Classics got barely a mention despite getting upgrades.
The iPhone's getting to that point - it's a phone, there's not much one can improve on it hardware-wise. Hell, the 3GS was pretty much "meh" on the hardware, other than making the software fly. The software that drives the iPhone though is probably quite intriguing, but we already learned about 4.0.
Now, the secrecy behind the iPad was probably quite high, as were restrictions placed on it because it's a new Apple product. There were rumors, but until the big announcement, no concrete details.
Apple's learned several things over the past decade - first, takedown notices are a surefire way to confirm rumors. Second, it doesn't have to be super-secretive on everything - things that are likely to underwhelm on presentation (like mere spec upgrades), well, let it leak (there were so many SKUs posted on the new MacBooks that we knew they were coming). Thus, Apple concentrates the secrecy on its second gen iPad and whatever new device it's concocting. New screen? Front facing camera? Meh features - the only thing Apple can do is either drop one or the other (due to availability and/or software issues) and leave it for the next model. After all, they appeared to do that with the camera feature on the iPod Touch 3rd gen.
of a security breach ever. A viral marketing campaign where someone "loses" a prototype phone at a bar does not count as a "security breach".
Don't take life so seriously. No one makes it out alive.
Schneier makes no mention of this being an Apple publicity stunt. Gee, I guess that makes him an Apple-Fanboi, that's what those are who don't believe this.
Lars T.
To the guy who modded me down from perfect to terrible Karma - Apple haters still suck
You also might have been on either the breacher or the corporate side. I'd hate to be in either position myself.
It's not a problem if you handle it correctly. After we disemboweled the first guy, you'd have been surprised at how strong everyone's passwords became.
Proud member of the Weirdo-American community.
I know Apple is famous for "accidentally" leaking hints of upcoming technologies out to generate buzz, but this is strange. If I were in a highly-competitive market and wanted to not give the Chinese knockoff makers a head start on my design, the last thing I'd do is let it out of the building.
I could see Apple anonmyously leaving photos or spec sheets around. Maybe they might even take a -mock-up- out in the wild like car companies do when they are track-testing a new model. (iPhone in a Samsung case? :-) ) But there's no real reason for them to "field-test" a device like that. Apple has a large corporate campus, and I guarantee they have the strongest ATT signal in the entire country. Plus, if you're testing stuff like GPS, you don't have to go across town, you just have to go across the building. Nah, this guy just had to show his buddies, and he lost it. That really sucks for him, because no matter what actually happened, he's never going to be trusted to work on secret products again. Even if Steve Jobs himself said, "Go take this phone for a spin." and he can prove it, there's always going to be the doubt that he has the self-control to keep quiet about what he's doing.
I know people who work in high-security environments, where they design products in a race to be the first to the Patent Office. Most are absolutely forbidden from even talking about what they're working on. I highly doubt that Pfizer or Bristol-Myers allows their researchers to take their lab notebooks anywhere outside their labs. People desiging the next netbook or mobile phone are in a similar situation -- 10 seconds after a prototype gets out, it will be glommed up, reverse-engineered, and a cheaper faster version will be out a week before yours.
Given all the draconian stuff I've heard about Apple being a wierd place to work, I'm sure they have an incredibly strict policy about secrecy...that is, they control the message, not the employee working on it.
The value of an item is what people are willing to pay for it, not the retail cost or KBB value. Retail and blue book values are starting places, designed to reflect and perhaps control the market... But they are not the last absolute say on value.
Consider the console market: In December of 2006, a Sony PS3 was worth $1200, despite the fact that the retail cost was $599 for the 60 GB version.
..the "leak" wasnt an accident. This is how apple hypes just about EXERYTHING is that they "leak" somehow.
We could pursue the DRM issue forever, but there's a completely unrelated lesson Apple could learn from this debacle if they cared to. If the offending phone was indeed left on a barstool, a question arises (in my mind at least): If Apple are so damned clever, why can't they make their phones small enough to fit in a pocket of your jeans?
Then nobody would have to leave the device out in plain view for anyone to pinch.
Long ago we decided that if anyone in our company breaches security by losing an access card, or sharing a password, we would not punish the person responsible if they came forward immediately.
This policy encourages a quick resolution to the security breach. A lost security card or password can be disabled or reset thereby limiting the damage the mistake caused.
Persecuting people that make mistakes only delays the notification process, and then delays the fix - putting more people/things at risk.
People make mistakes, they happen, and there is nothing you can do to prevent them.
-ted
Indeed, it looks like Mr. Schneier was in a rush to write something and forgot to add content.
http://dilbert.com/2010-12-13
If anything, the embarrassing thing about the leak is that the product isn't changing much. The corner bevel radius is changing. Big deal. Two cameras, one on front, one on back. That's new. Camera flash - yawn. Noise cancellation mic - finally. Those are all routine, minor product improvements, and they're all already available on competing products.
That's what may scare Jobs - he makes a big announcement, and everybody yawns. Headlines read "Apple plays catch-up with Sony Ericsson". Jobs looks like a loser.
As others in other articles on this topic have noted before me, it's extremely unlikely that some young R&D engineer just happens to leave the lab with a not fully functional prototype of Apple's next gen phone, and then by some weird coincidence loses it at a bar.... Actually, it's quite much more likely that this was an intended leak and Apple was hoping for the kind of coverage they got from Gizmodo, so wouldn't charges of misleading the course of justice against Apple be more appropriate, if they don't come forth with the truth soon?
No thanks...I already have a cleaver.
rj
#1. Don't pay sprocket any mind, he is a bullshit artist. #2. http://slashdot.org/comments.pl?sid=1293667&cid=28621185 where sprocket was totally "perfectly" (the word he refused to define along with his evading all questions put to he) blown away by his own dyslexic mind due to -> #3. Sprocket also likes to put words in others mouths they never even said and tries to state they "implied it" when his dull brain obviously cannot interpret written english properly because when asked by the person replying if sprocket could find where said person supposedly stated what sprocket said he did? Sprocket ran or evaded all questions there. I bookmarked that for everyone's reference so this no mind Sprocket could see it again and regret his stupidity in being a wanna be computer expert (not). He certainly got his ass handed to him there. Read it yourselves, and decide how "expert" sprocket really is. Sprocket, so are you an Apple corporate officer, or do you just like to act like you are? Poor performance here boy. Then again, I don't think you know what "perfect" means, per that url above, so, we don't really expect your performance while you act "smart" to be perfect. In fact, your facade is a rather thin veneer.