Slashdot Mirror
Sheriff's Online Database Leaks Info On Informants
Tootech writes with this snippet from NPR:
"A Colorado sheriff's online database mistakenly revealed the identities of confidential drug informants and listed phone numbers, addresses and Social Security numbers of suspects, victims and others interviewed during criminal investigations, authorities said. The breach potentially affects some 200,000 people, and Mesa County sheriff's deputies have been sifting through the database to determine who, if anyone, is in jeopardy. ... The FBI and Google Inc. are trying to determine who accessed the database, the sheriff said. Their concern: That someone may have copied it and could post it, WikiLeaks-style, on the Internet. 'The truth is, once it's been out there and on the Internet and copied, you're never going to regain total control,' Hilkey said. Thousands of pages of confidential information were vulnerable from April until Nov. 24, when someone notified authorities after finding their name on the Internet. Officials said the database was accessed from within the United States, as well as outside the country, before it was removed from the server."
Donutleaks is committed to releasing classified documents !
What if they didn't put that database on a server facing the internet? Could that be a good idea? Or maybe they should just return all their computers since they can't be trusted to use them securely... Let the flames begin.
/M
The article makes this situation comparable to the current wikileaks situation, which it isn't.
Some IT person left the data freely accessible on the internet and eventually a crawler found it. They're guessing it was a malicious person but in all odds it is not.
This is just another IT mistake not an act of whistleblowing or terrorism or something else the government wants to make illegal.
"'The truth is, once it's been out there and on the Internet and copied, you're never going to regain total control"
That's a remarkably pragmatic approach, and portrays the Sherrif's office as focussed and efficient. Public perception matters a lot in these instances, and while they could've threatened to rip off the ears of anyone who shares the files, it would have had no effect on actual information sharing, at a great cost to their public image in at least some quarters.
It's also nice to see that someone understands what "information wants to be free" means: that information tends to be free, and you have to plan for this.
No kidding!!! What do you say at this point?
I hope someone at the Sheriff's office will be charged with felony negligence for this. I know that leaving a weapon where it can be accessed by a child or a felon is against the law so it should be logical that leaving a database of information open to the world that could easily destroy many lives is worth a felony too.
"To Serve And Protect"...
Deputies have used the database since 1989 to collect and share intelligence gathered during the course of police work. It contains 200,000 names — Mesa County's population is about 150,000 — and includes investigative files from a local drug task force.
Is it just me or does it seem odd to you that they have 200,000 confidential informants in a county with a population of 150,000? What the frack is going on in Mesa County?
Everyone on Slashdot should download as many copies as they can and then delete them (Shift + Delete only!). That way the world will run out of copies and everyone will be safe.
What if annual security training was mandatory for all the IT staff connected with law enforcement IT equipment...
I don't see why that last phrase is on there, i.e., why the statement should be restricted to law enforcement. IT staff in every internet-connected company which stores data on other people (which is most companies larger than a mom&pop gas station these days) have a responsibility to the people that data pertains to.
Every time I hear about another database getting hacked, I blame the idiots who let it happen. It makes me really leery of doing simple things like buying *anything* from *anywhere* with a credit card, because I am entrusting the seller to keep my data secure. And so many of them demonstrate that they have not earned that trust.
Do you think doctors' offices maintain good data security? Or the local pizza place that has an account for you? It's pretty amazing how open our data is to those who wish to harvest it.
But the sad truth is that in the end IT is seen as a cost center that needs to be minimzed. And security... well, that's like insurance. You don't need it until you need it (at which point of course it is far too late).
Their concern: That someone may have copied it and could post it, WikiLeaks-style, on the Internet.
Let's hope they post it WikiLeaks-style. That would mean they spend months coordinating with journalists to redact names and other information that might put individuals' lives at risk. Then, they would only release a few select important parts of the material in a completely responsible manner.
Of course, that is not what the editors and poster were trying to convey by 'WikiLeaks' style. Why insert this useless anti-free-speech FUD into the story?
More likely, if any informants are harmed, it will be used to justify an escalation.
Palm trees and 8
What wikileaks stands for is total transparency of how governments (and other large entities) go about their business, not total transparency in the form of all information about everybody anytime. Else wikileaks wouldn't take their time redacting information for safe public consumption (gasp! they do that?) and would just release the information as fast as they can verify it. ./ article is about how names of informants and the like has been leaked and can therefore be a danger to said informants. The focus is not on, say, what methods were used to make said informants talk or how evidence was collected to nail a criminal. The former has nothing to do with how wikileaks operates, the latter does.
The difference? The focus of this
This "leak" is a world apart from what wikileaks does and makes an unfair comparison that deviles what wikileak does.
That said, it is understandable that any unwilling exposure of a large amount of information is mislabeled "wikileaks-style" simply due to the sheer association between wikileaks and leaks in general these days... But visibility doesn't make it a correct association.