Slashdot Log In
Fresh Security Breaches At Los Alamos
Posted by
kdawson
on Tue Jun 26, 2007 06:56 AM
from the when-will-they-ever-learn dept.
from the when-will-they-ever-learn dept.
WrongSizeGlass writes "MSNBC is carrying Newsweek reporting on two new security breaches at Los Alamos. Both of these latest incidents were 'human error' on the part of employees. In one, an e-mail containing classified material was sent over the open Internet rather than through the secure defense network. In the other incident, an employee took his lab laptop on vacation to Ireland, where it was stolen out of his hotel room. The machine reportedly contained government documents of a sensitive nature."
Related Stories
[+]
US Military 'Hacked' by Emails 141 comments
An anonymous reader writes "Two of the US Military's most important science labs were apparently 'hacked'. Phishing mail was sent to a pair of research labs, where trojan programs allowed interlopers access to the otherwise secure networks. One of the sites was the infamous Los Alamos, which has been discussed many times here at Slashdot for its string of security breaches. 'Los Alamos has a checkered security history, having suffered a sequence of embarrassing breaches in recent years. In August of this year, it was revealed that the lab had released sensitive nuclear research data by email, while in 2006 a drug dealer was allegedly found with a USB stick containing data on nuclear weapons tests. "This appears to be a new low, even drug dealers can get classified information out of Los Alamos," Danielle Brian, executive director of the Project On Government Oversight (POGO), said at the time. Two years earlier, the lab was accused of having lost hard disks.'"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Human element is the greatest danger (Score:5, Informative)
In the information security profession, several classes of threats to security, including physical security, are enumerated. However, the most significant threat of all, and one that can subvert even the best-laid plans for security, is the threat from human action. This threat is unavoidable, as humans are necessarily an integral component of any operation an organization may wish to secure.
The human threat can take the form of threats internal to an organization, and each of those threats can be intentional or accidental. Because of the access an internal person may have to sensitive areas or information, the threat from the actions of internal person are often rightfully considered the most severe. An internal person may also unwittingly act in concert with an external person who is a threat to the organization as well.
A recent example of such a failure of physical security occurred when a 31-year-old man attempted to enter the United States from Canada at the border crossing in Champlain, NY, on May 24, 2007. Upon presenting identification, the Customs and Border Protection agent handling the man's entry received a computer alert. The alert warned that agents should immediately don protective clothing and detain the individual, notifying the originating authority.
The next steps seem obvious: the man is detained, and border agents run the message up the notification chain, CDC eventually learns that the man in question has been located, and appropriate action is taken. The system works.
What happens instead is that the man is allowed to enter the United States with no further questions, and is at the border crossing for a total of less than two minutes. The agent later says he thought the warning was discretionary, that the man "seemed fine", and therefore let him proceed. Every part of the system worked: the CDC was able to properly place the man on appropriate watchlists, his passport was properly flagged upon entry, and relevant information was presented to the processing agent.
Every part, that is, except the human part.
The man in question is Andrew Speaker, an Atlanta lawyer who traveled with his fianceé to Europe for his wedding and honeymoon. While in Europe, he subsequently learned that further testing revealed that he was infected with Extensively Drug Resistant Tuberculosis, or XDR TB, a form of tuberculosis resistant to a wide variety of antibiotics and treatments, and which can have a 70% mortality rate. The CDC and health authorities did all they could to attempt to restrict his further travel, and thus protect the public at large. Speaker sidestepped No-Fly and other watchlists by flying to Prague, then to Montreal, and then driving to the United States.
The Department of Homeland Security has placed the agent, whom it has not identified, on leave while it reviews the incident, and related processes and policies. When a human charged with the ultimate protective responsibility errs, no amount of technology can solve that problem. What if this had been a man identified as on the way to the United States to intentionally spread an infectious agent? The frustrating element here is that all of the underlying information and identification systems were working - which is itself encouraging - but the individual
Re:Human element is the greatest danger (Score:5, Interesting)
Sounds to me that his actions were completely intentional, that he was not at all concerned about the health of others, that he wanted to fulfill his desires regardless of how it might affect others.
I wonder if there are charges that could be brought up against him.
In any case, you make a very good point about the human factor in security.
Parent
Re: (Score:2)
Of course they were intentional. You don't accidentally pack a laptop. Well, I guess you could, but it would be difficult. He did not intend for it to be stolen and if you can't have a reasonable expectation that your stuff will NOT be stolen then we have a much larger problem to address.
So many brilliant absent
Re:Human element is the greatest danger (Score:5, Insightful)
Parent
Re:Human element is the greatest danger (Score:5, Insightful)
Warnings on a passport to detain, immediately don protective gear, and notify DHS and CDC?
Not many.
That's why the agent's handling of this is such a big problem. And it represents another aspect of human failure in security.
Your point about false alarms is a valid one; this just isn't one of those examples.
And for anyone who is thinking about No-Fly lists or watchlists possibly falling into the "too many false alarms" category, they don't. When a name is on a watchlist, more detailed information about the person (e.g. DOB, addresses, etc.) is passed up the chain to any number of originating entities or authoritative sources. If that is the target, instructions for handling are passed back. If it isn't, the person is cleared. The reason why it's done this way is for a variety of reasons, not the least of which is so that people at airline ticket counters or fronline TSA staff don't have access to classified or private personal information (beyond what is volunteered or required to be given by the passenger) when processing passengers, to say nothing of the enormous technical complexities involved. That's why you hear stories about people not being able to "get off" watchlists. It's not "them" that's on the watchlist; it's someone who shares that - or a similar - name. That's why people who aren't actually wanted for anything whose names are on "watchlists" are always allowed to fly after the check. Persons in such situations who are frequent travelers are also able to get special documentation to solve this problem. But "they" can't "get off" the watchlist, because it's someone else who is on it, and that's what the detailed checking process confirms. Yes, it's a very, very imperfect system, but identification has always been a cornerstone principle in law for recorded history. We're using the best balance of technologies and privacy we have - really - to attempt to identify persons who should not be allowed to enter the US, fly, etc.
Parent
Re: (Score:2)
If the border agent gets lots of false alarms from other watchlists, then he's not going to read any of them carefully, and he's not going to trust them.
Are the alarms he gets rated on a simple severity scale (e.g. 1 to 10)? How many alarms does the agent get that received the same rating or higher as this one did?
Re: (Score:2)
His job is to observe the warnings and follow protocol. The fact that he could not see his way through to doing this implies that he should be terminated, and hopefully, held responsible for his negligence.
If you don't want to do the job, don't take the paycheck.
Perceived status as an issue (Score:5, Interesting)
In the UK, a large number of intelligence protection failures have occurred basically because of the perceived status of the perpetrators. (the best known cases being Philby, Blunt, MacLean and Burgess, all of whom were fairly upper class members of the Intelligence services.) In his fictional books based on composites of the Philby-Burgess case (A Perfect Spy and Tinker,Tailor,Soldier,Spy), John le Carré (who was in a position to know) suggested that the Intelligence services suspected or half knew that they had traitors in their midst all along, but were inhibited from acting against fellow members of the upper classes and their own community.
It would be very interesting indeed to know how far this culture extends into research establishments. It would be expected to be quite pervasive because of the esprit de corps among any professional group.
Of course, perhaps the real answer is that scientists and engineers, by their nature, are the worst people to be allowed to work on secret weapons systems because it contravenes their tendency to want to cooperate, share knowledge and see their own work published. Let's replace them all with Fortune 500 CEOs. That should result in a real peace dividend.
Parent
Re: (Score:2, Interesting)
Re: (Score:2, Funny)
"The good news is that you'll make your flight on time. The bad news is that you have an enlarged prostate gland."
How does the user control email? (Score:5, Insightful)
I'd think, like virtually every other email system in the world, that users would have their MUA configured to send outbound email via a single mail server, where all further routing is under administrative control. Do they allow connections to that server from outside?
I could understand the issue, if it was someone sending to an external, insecure email address. But the summary, article, and now you all say the problem is with which network the email was routed over. The other possibility is they were off-site, and didn't have a secure VPN connection running - buy why would a secure system not force SSL email connections? Or is sending even over VPN/SSL not considered secure?
It's just not clear how the user has the control implied here.
(or is it that they're allowed to have personal email accounts on their machines, and that's where the email was sent from?)
Parent
Re: (Score:3, Informative)
No. They just send classified information from an unclassified workstation and an unclassified email address, almost like any person would send email in any workplace. That's why some public areas have big signs that say DO NOT DISCUSS CLASSIFIED INFORMATION or watch officers answer phones with, "Good evening, Lt So-and-so speaking, this line is not secure. May
That's quite different... (Score:2)
It seems to me that just as serious as how the email is being routed, perhaps more so, is how classified material got on the unclassified workstation in the first place (you mentioned one possibility), and why is that not also being reported as a violation. (i.e. why focus on the email aspect, that's just a result - the
Re: (Score:2)
And that also doesn't stop someone from simply manually typing an email message whose substance contains classified information. Not all classified information comes in the form of a document that will be an attachment...it could be just as simple as discussing a classified project or something similar, and then the recipient reporting the "breach". Without more information about what h
Article is Crap. here's actual press release (Score:3, Interesting)
Re: (Score:2)
Excuse me. Back when I was doing gubmint (DOD) work, connecting a machine with classified data stored on it to an unclassified network with unmonitored connections to the outside world would have gotten you ten years and/or $10000. Appa
Re:Human element is the greatest danger (Score:4, Insightful)
But nothing stops someone from typing up an email that contains classified information and sending it from their unclass account, inadvertently or otherwise. It's not like they magically need to be on JWICS to send top secret information. That's why we segregate the networks, yes - to attempt to prevent this from a technical standpoint as much as possible.
Also, there are ways to migrate information between networks, and those can be abused or used inappropriately. There are a lot of ways this accident might occur, and it probably happens more than we'd like.
Parent
Re: (Score:2)
There is a fairly good argument that that work should not be done at LANL, but as long as it is, they need realtively accessable public communication. Another consideration is that for some non-classified research, the govt. also wants the ability to classify parts
Re: (Score:2)
Re: (Score:2)
interesting but a bit technically inaccurate... (Score:2)
...In the email instance, anyone can at any time send classified information over an unclassified network. It is up to the user to not do this. Granted, there are various technical and other procedures that can help prevent this, but it can never be completely avoided. These incidents seem rather tame, but since Los Alamos is under the microscope, every such incident will be greatly scrutinized - and sometimes blown out of proportion.
It's not possible to inadvertently email classified information off the DoD classified network - the classified network isn't connected to the internet for this reason ;-)
The user would had to have moved the data off the secure network to send it over the internet.
Re: (Score:2)
The user would had to have moved the data off the secure network to send it over the internet.
Or, you know, simply manually typed in information that was classified.
All classified information isn't in the form of preexisting documents that would be attachments. It's actually possible to discuss it verbally or via email, you know, and still
Re: (Score:2)
Yes, the data would have had to have been either transferred to the unclassified network or duplicated on it, but 'inadvertent' implies error when in reality the user would have had to bypass several safeguards to send a classified email on an unclassified network.
nah (Score:2)
Somebody confuses the government's classified project code word with the company's unclassified project name... oops.
Re: (Score:3, Insightful)
Any human system works best with "targeted" warnings. Yet the HS system seems designed to scan everything. It's like finding a needle in a haystack by ordering more hay.
So the man with Tuberculosis got through, because a lot of people who shouldn't be on a watch list break the system. We probably have worse security response now than before 9/11. I certainly
One mail? (Score:3, Interesting)
So he sent one mail and it was intercepted? Damn, this puts the "insecurity" of email communication in an entire new light.
Re: (Score:2)
No, there are probably plenty of other instances of classified information being sent over unclassified/insecure networks.
This is just one that was identified.
And what probably occurred is that the recipient realized what happened, and reported it.
(But, by your last statement, do you really think the national laboratories shouldn't try to prevent classified information from being sent o
Re: (Score:2)
Or the recipient was expecting it and had been instructed to report it when recieved. How better to make the Iranians think it's genuine information regarding ancillary nuclear weapons components? The CIA slipped bugs to Soviets [msn.com] before, and there have been reports that the US and European countries have been doing the same kind of thing to Iran to slow their nuclear program.
An employee took his lab laptop on vacation (Score:3, Funny)
Re: (Score:2)
Re: (Score:2)
yeah, but that was before modern miniaturization of devices.
It's alright for a large tape machine to slowly self destruct in a phone booth, but don't nobody want their Palm Pilot exploding just after putting in their pants' pocket!
Re: (Score:2)
It's not really an indictment (which is what I think you meant to say) of anything. I'm not sure why this is modded up; there's no reason for a laptop that doesn't even have classified information to be set to self-destruct if its departure isn't approved, and unless every single email is manually checked, classified information will always be able to be sent over unclassified networks. In fact, someone with knowledge of c
Re: (Score:2)
Re: (Score:3, Insightful)
Right. We should make the laptops constantly read some sort of signal that fades away out of the pentagon, for example.
If the signal fades away, the laptop explodes.
Now combine this with the recent news about NSA brownouts, and we're effectively decimating our military in few minutes.
Or how about a laptop battery fire causing the explosive to go off.
Who would walk with a ticki
Little mention of countermeasures (Score:3, Insightful)
Fact is that Los Alamos is a juicy media target and they will conveniently omit details like that to sell headlines.
Or the violators were pointy-haired managers that thought that high tech encryption stuff was only for the gearheads in the white coats.
Mod Parent Thoughtful (Score:2)
Of all the people employed by the government in this line of work, there's got to be many, many more cases just like this out there. How is it possible that this *one* government funded R&D facility has security problems that boil down to human error rather than process?
I have a feeling the others have the same issues, except this one is someone's punching bag. That someone is powerful enough to get the gears of government working against Los
Work laptop & vacation (Score:2, Insightful)
Even though I work in Corporate America, when I go on vacation, I want nothing to do with work during that time even though executive management gets upset that I don't want to be available for work related items such as calls in my absence.
I do take a laptop with me on vacation but it is for personal use such as personal e-mail, process digital pics, surf t
Text of the email (Score:4, Funny)
I'm going to be late home from the lab tonite so have dinner without me, we are just putting the finishing touches to the doomsday device so we can test it tomorrow.
Love you
xxxxxx
Something's still fishy here... (Score:2)
SIPRNET computers don't have internet access - or access to any other network. It appears to me someone would have to have taken the data out of the vault and composed it on an unclassified PC to send it anywhere off the secured network.
It's Also Worth Noting... (Score:3, Interesting)
But by yanking funding and threatening to "close the place down", those senators and representatives are risking a valuable National resource. It's their choice I suppose. But I don't think this continued beating down is very productive.
Los Alamos has name recognition. It makes great headlines every time anyone even takes a dump out there.
FFS (Score:2)
People should be fired/prosecuted for negligence these days.
you call this security .. (Score:2)
"The SIPRNET workstation may be used to download files from the SIPRNET. Anti-virus software has been installed and runs as a TSR program
Crypto? (Score:3, Interesting)
Is it a gross simplification to state that using encryption would have rendered both mistakes harmless?
Is this really so hard for IT departments to set up PGP or one of its clones? Same goes for disk encryption? I have argued with people up and down who claim this is too hard to deploy, but I say that something is better than nothing, even if it nothing more than checking “encrypted folder” on your NT system.
These tools have gotten so easy to use these days and while I understand this is largely a social and policy problem, there is plenty of low-hanging fruit that can help mitigate the damage.
Re: (Score:2)
Is it a gross simplification to state that using encryption would have rendered both mistakes harmless?
[/blockquote]
No where in the story does it say the data on the laptop was *not* encrypted. In fact, the statement by one director that the user would've been granted permission to take the laptop to Ireland if he'd asked makes me believe is *was* encrypted.
Chris Mattern
Laptops are not and will never be secure! (Score:4, Insightful)
Given the ease of use and portability of a modern laptop you may as well just post a copy of the data to anyone who might be interested.
Stolen laptops are actually the lowest risk area, given that most laptop theives are after the shiny hardware and its so rare to come accross data with any resale value that they probably dont even look. A far greater risk for a high security installation like Los Alamos is someone borrowing a laptop for long enough to install some worm/trojans/keyloging software which the dedicated sceintist can then physically carry through all those firewalls back into the lab.
Any sane security profesional would just plain ban them from a set up with the security requirements of Los Alamos.
The best solution would be to have all hardware in a locked server room and only access them via "dumb" terminal servers. Plus a private network with no physical connection to the outside world.
Re:Sensitive nature (Score:5, Insightful)
I'm not a fan of conspiracy theories, but if you honestly believe their strategy is competent and it's money wise spent, then I better be a tinfoil beanie.
Just because you don't care doesn't mean our enemies don't either.
Don't forget: they're not "our enemies". They're just the US military/govt current targets.
Why on Earth would Iraq be your enemy as a US citizen. What did Iraqi do to you or your US buddies. The only thing happening in Iraq right now is a bunch of citizen wars, caused by the invasion by USA in there. Saddam is dead, there weren't WMD-s in there, and Iraq had no connection to the 9/11 attacks.
I don't like how short people's memory about those things is.
Parent
Re: (Score:2)
Re:Sensitive nature (Score:5, Interesting)
So the "Los Alamos security breach" stories got big headlines and the "FBI screws up" got little headlines. Maybe there is a pattern there. As the newly privatized single-source nuclear weapons manufacturing company for the USA had a walk-out of 500 security guards over 36-hour work shifts and poor security protocols that didn't make headlines.
I think there is a dangerous move to privatize a lot of key military functions. And the FBI seems to bring up a lot of accusations before verifying the actual security risk.
Couple this with their seeming lack of interest in securing laptops and databases of American citizens. The rates is about a few million records a month. No biggie if some third party has your SSN right? The government can't have a Total Information Awareness database, but it appears that a private company can. Check out what John Poindexter (Iran/Contra felon) is still up to these days. Who knew he was such a great database expert?
Los Alamos is now privatized, and the good old "employee takes laptop with sensitive files and gets it stolen" oops is happening at rapid pace. Anyone want to be whether THAT particular employee gets reprimanded? My bet they will get a promotion. As does everyone who seems to fail upwards in this current administration.
http://www.fas.org/blog/secrecy/2007/05/los_alamo
Parent
Re: (Score:3, Insightful)
The middle east is not one amorphous entity. Some parts of it, say Palestine, really do have a long tradition of violence. The Ba'athist government was a stable, secular dictatorship which did commit atrocities, but it was nothing like the full on neighbor vs neighbor civil wa
Re: (Score:2)