Slashdot Mirror
Aussie PM Office Calls For Government Ban On Gmail, Hotmail
aesoteric writes "The Australian National Audit Office has called on all Australian government agencies to block free web-based email services like Gmail and Hotmail to mitigate security and information integrity risks. The auditor noted that such public email services 'should be blocked on agency IT systems, as these can provide an easily accessible point of entry for an external attack and subject the agency to the potential for intended or unintended information disclosure.' Not surprisingly, the move is seen by some as an attempt to prevent a WikiLeaks-style disclosure from occurring."
Why not just block uploading/download attachments from those services. That seems like it would solve the problem for the most part, even if you could hand type or copy/paste sensitive informtiation the time to do so would be prohibative.
Now seriously guys, there are bad titles, and there are pathetic ones. This takes the cake as the prime of the prime on the latter camp. You make it sound like they want to ban it on Australia as a whole, while the truth is much more simple and in fact, valid. They simply urged the agencies to not use those services. The puzzlement should come from why are they using it anyway?
This was an audit performed on the security of Government data and not an exercise on quashing free speech. FFS aesoteric and samzepous, this was so pathetic that it wasn't even funny.
--- "When you gotta do something wrong. You gotta do it right. (Fighter)"
The number of ways in which the Australian government can show its total lack of understanding of the Internet continues to boggle the mind.
In the private sector I have been doing this for years, because of security. If a user want to access his Gmail/private mail he can use his mobile not via my network and if management agrees I would place a shared system in areas that is on a separate network for such uses.
These types of blocks are easy to work around for the determined and extremely annoying for people just trying to do their jobs.
"I assumed blithely that there were no elves out there in the darkness"
If I want to get a file off a computer with Internet access, it WILL happen.
I have to block webmail services and all it means is that when I want to investigate data leakage, I have no idea where to start.
We permitted personal mail access in the past, and that made it much easier to hold people to account, as the poor sweet dears always imagined they were being dead subtle uploading the stolen files to a draft on gmail or wherever. Now, there are a million places in their browsing histories I have to check to see if they have an upload or post capability.
The Aussies are deluding themselves if they imagine this'll stop civil servants making off with secrets...
Obviously they can't come out and say directly that Google doesn't protect your from CIA BS, nor from the CIA's Wikileaks media outlet. They would be considered conspiracy nuts (as you consider me after reading this).
Australian Government employee here. (Posting as AC, of course.)
Our agency allows Hotmail, Gmail, etc. Just not from your desktop; you have to go through a special DMZ machine, and if you've received messages that you need for business, forward it to your official account.. The given reason is a lot more mundane than Wikileaks: to keep malware, viruses, etc. out. (Although the use of these DMZ machines are, no doubt, monitored for leaks of unauthorised stuff too.)
The "official" agency e-mail servers are highly filtered for malware. Presumably Hotmail, Gmail, etc. are just as good at filtering... but by policy, we can't (and shouldn't) rely on something out of our control like that.
There are literally more than 290.000.000 of ways to upload data to the internet. Blocking 2 gets you a list of 289.999.999 ways. On top of that, people can use his phones, usb drives, etc.
Proper safety stuff is *nothing* like that.
Anyway could be a first step in a "defense in deep" protection, to achieve a 2% or 5% more protection.
-Woof woof woof!
it is not unusual for companies to block webmail. I don't see why government departments shouldn't do it either. As others have pointed out anyone who is determined will get information out anyway, but it does prevent the "casual" release, either accidental "There's a lot of hassle in the office, I haver heard people say the merger might be off" deliberate but non-malicious "I'll email this document home and I can finish it this evening" or malicious "I'll email this home then if I don't get my pay rise.....".
The biggest problem this world has: It is lead by so called intelligent people. I start to RAGE when i see stupidity! Why not EDUCATE instead of blocking, punishing, etc.? EDUCATION is something that you dont see anywhere. They are not teaching you in school how to use a mail, they are teaching useless stuff that most of it you will forget or you dont use it! OH, Why not cut the electricity and you go back to stone age so you can rule your kingdom? (it will be easier if you shoot yourselves.)
I don't have to mention how much of nothing this solves.
The real issue is non-IT people making IT decisions.
Hi, I'm an Australian IT Security Administrator (thankfully not responsible for any of the agencies which recently got audited) but having these websites added to a blacklist doesn't just mean a technical block (which we all know can be bypassed) but it also means a clear IT Security policy decision saying "Accessing this website is against IT Policy". With this policy decision, actions can be taken against workers who attempt to bypass the block as we can say "It was clear in our policy and in it's enforcement that the website was blocked, you have no excuse for accessing said banned services". This is important seeing as at the moment it is not as clear and punitive measures are somewhat limited. Although users tend to be a bit thick, I've found that a large majority of them in cases such as using unofficial web mail services for official purposes can be resolved through user education of the dangers of using said services. Not only that but if IT departments in these agencies actually listen to their users, they'll probably find the reasons on why users favour them over the existing solution (ease of use is usually the answer) which can also be addressed.
It's the Australian Prime Minister.
I assume this was article was submitted by an Australian, and to that person I would say you need to get a little self-respect. FFS even if you don't respect the person, at least respect the office. Would you seriously submit an article about the yanky prezo and expect it to be published? No, you would refer to him as the US President or more likely just the President, or Obama, even if you hated his guts. To do otherwise is to insult the American people. Refering to some random Australian as an aussie, that's acceptable, although for a news site I personally consider it unprofessional. But, refering to the highest office in the land or any other official goverment entity for that matter as being 'aussie' is just insulting.
Remember Sarah Palin and her webmail that somebody got into by just answering some incredibly easy "security" questions? If I was in government IT security I'd be recommending that nothing remotely important was sent to or from hotmail etc.
There's also the archiving problem. An important email sent to or from hotmail may disappear into a black hole never to be seen again within a year so you are out of luck if you want the information in it after that date.
Then there's the "paper trail". We wouldn't have had so much on Poindexter and North selling weapons to terrorists (Hezbolla via Iran after Hezbolla killed all those US Marines) if their emails hadn't been on the backup tapes. That's one reason why places have rules about not using hotmail etc.
Finally, gmail may be stable but if you are a University that has outsourced your students mail to hotmail and a stupid internal Microsoft DNS error prevents them getting email your trouble ticket gets put in a queue for a week before it gets fixed. That's for paying customers. Lost mail and no access for over a week. Now consider how those on free accounts are going to get treated when things go wrong.
It really is quite stupid to rely on it for anything work related if you want to pretend to be any sort of professional organisation.
They should block Tor, SSL websites, applications with encryption too (almost all modern archivers support AES, not to mention TrueCrypt and similar products). And special Aussie Windows version without built-in encryption won't hurt.
Good luck with this mission impossible.
My company (Worldwide) has switched to Google Apps and Gmail and we find it to be a very secure system so far, and the Gmail spam filter is top shelf.
As a proud Aussie myself, I have never met another Australian who feels the term "Aussie" is in any way degrading or rude. Some Americans may feel that way about the term "Yank" but I can say with complete confidence that "Aussie PM" gets used ALL THE TIME in Australia, by people and on TV.
The comma is not suitable for a list of two items. Instead, use an ampersand.
"Calls for Government ban on Gmail & Hotmail"
It does sound a bit odd to those used to accessing whatever they want at will, but I work in an investment bank in London and it's the same story here. You don't need Gmail to do your job. Learn to split your work and home life up a little so you can actually be a bit more productive rather than breaking your attention span every 10 minutes.
send out confidential data using the in-house email client. Sure, it will be in the logs and maybe your folders/sent but they can't block you from sending it. Even if you leak it, the most they could do is fire/prosecute you but it would still be leak-able.
They can't block email to non-govt-domain IDs since it's obvious that they may be legitimately emailing someone outside of their department or even the government.
If they are gonna be retards about it, why not block out internet access completely? They could still use 'dropbox' type services (2 GB) or sugarsync (5 GB worth of confidential data leaked per account/per day). How hard would it be to leak info even if they block gmail? Heck, if you can access govt/work email from home, just save yourself a massive draft file or email urself and download the attachment at home. There's also sending attachments in chat services, ftp, etc.
Frankly, the only ppl this policy would inconvenience are those not planning to do any leaking.
All webmail is blocked by the filtering software.
So pray tell dear American editors making up headlines - Just when did the Audit Department group join the Prime Minister's department? You know how people on /. say RTFA... well as editors you should!
And scan all email for viruses and malware? I've never so much as had a peep from anything I've gotten in GMail in 5 years.
Everyone knows thats how the big leaks happen. People sitting at their work desks sending email via hotmail and google.
Seriously, they should also ban printing, external peripherals, being a disgruntled employee, ban WiFi, jam cell phone signals, and finally, every day at 5pm wipe their employees memory and store it in a machine until 9am the next morning when it can be reloaded into the employees brain. That way information can be controlled in 50% more effectively.
given the state of disrepair of our university email system, many of us - staff included - are considering switching to something like gmail, to 'fix' things. probably quite a few government email systems are in no better shape.
-
My wife works for the FSA and cannot access gmail/yahoo there.
the Australian PM is hugely unpopular (think Bush near the end of his reign) ..
And besides what email system IS secure?
I can definitely say, as an Australian Federal Public Service employee that web-based email is completely blocked. It is actually cause for immediate dismissal if you try to access them.
Remember the Second Law of Thermodynamics: Let the Lord of Chaos Rule
Blocking webmail services is like whack-a-mole. There's likely to be one somewhere that you'll miss, and when the potential leakers (henceforth known as patriots) find it, you're back to square one.
-- Even if a god did exist, why the fsck should I worship it?
The actions suggested sound more like those of a TinPotDictator attempting to suppress the dissemination of independent thoughts than anything else.
And they critisize Arab countries for the liberty of expression and the right to use telecomm means!
Block the use of Microsoft Windows ..
Have a look at Microsoft Forefront Threat Management Gateway (It's the renamed ISA Server)
It has full support for a man-in-the-middle HTTPS filtering module, with a wildcard certificate creation done for you as part of the wizard (the certificate is usually distributed in Active Directory to the clients)
It does however prompt you that there may be legal issues in your company should you enable the HTTPS filtering without notifing your users, and it also will prompt anyone using the client-side component with a balloon message saying that the HTTPS connection is being inspected.
Have you ever met, in person, an Australian Prime Minister? Back in 1988, I was a guest at the Parliament House Christmas party put on my the Labor Party for Parliament House staff. While I was having a cold beer, up comes an older man, magnificent head of silvery-gray hair, with a glass of orange juice and a big cigar.
"G'day mate, I'm Bob", he said, offering his hand
I shook his hand and replied, "G'day Bob, I'm Ken."
That's how Aussie PM's should interact with other Aussies. I would hope the current Aussie PM would react the same if I said "G'day, Julia, I'm Ken."
Or even more insulted if you were called a seppo.
If we are able to get Labour into power, all this will stop.
Wait. What?
if you don't have anything to hide, australia...
It's not clear to me how this improves security.
The only thing I can see that it stops is a user casually emailing a document off site. Leaks are more deliberate.
Unless your security policy also blocks most outbound ports, and does deep packet inspection on what it does let out, this appears to be just one sand bag in the stream.
Ways to move digital data offsite.
1. Media: DVD, CD, Memory Stick, portable hard drive. camera used as flash drive, phone used as a flash drive.
2. Standard file protocols ftp, ssh, sftp, http, https. The latter two would be hard to detect -- but the ratio of download to upload would be skewed for a particular host.
3. Sync files to/from my phone.
4. Teamviewer and the like. (Remote desktop protocols with file transfer capability.)
5. Tethered phone.
6. USB wireless + cantenna.
7. Running another OS in a virtual machine to evade locked down desktops.
8. In a windows shop, running 'portable apps'.
9. Embedding data in non-standard transports. E.g. Ping packets.
Stopping all of this is possible, even easy. Doing so in a way that people can still get any work done, and won't spit on IT people as they pass will be a bit more challenging.
Third Career: Tree Farmer Second Career: Computer Geek First Career: Teacher, Outdoor Instructor, Photographer.
Not really. The title is just syntactically ambiguous. The OP did not specify whether the "Government Ban" was the ban-by-the-government-upon-the-non-government-sector or the ban-for-use-by-the-government variety. Such ambiguity is the cost of using english instead of, say, lojban.