Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Security Science

Fresh Security Breaches At Los Alamos 127

Posted by kdawson from the when-will-they-ever-learn dept.
WrongSizeGlass writes "MSNBC is carrying Newsweek reporting on two new security breaches at Los Alamos. Both of these latest incidents were 'human error' on the part of employees. In one, an e-mail containing classified material was sent over the open Internet rather than through the secure defense network. In the other incident, an employee took his lab laptop on vacation to Ireland, where it was stolen out of his hotel room. The machine reportedly contained government documents of a sensitive nature."
This discussion has been archived. No new comments can be posted.

Fresh Security Breaches At Los Alamos More

Fresh Security Breaches At Los Alamos

Comments Filter:

  • Human element is the greatest danger (Score:5, Informative)

    by daveschroeder ( 516195 ) * on Tuesday June 26, 2007 @06:58AM (#19647869)
    It's worth noting in this example that if the laptop had been allowed to travel to Ireland with the employee with the proper approvals, as the article indicates, the material on the laptop was not classified, but rather deemed "sensitive". There are several classes of such sensitive but unclassified information. In the email instance, anyone can at any time send classified information over an unclassified network. It is up to the user to not do this. Granted, there are various technical and other procedures that can help prevent this, but it can never be completely avoided. These incidents seem rather tame, but since Los Alamos is under the microscope, every such incident will be greatly scrutinized - and sometimes blown out of proportion.

    In the information security profession, several classes of threats to security, including physical security, are enumerated. However, the most significant threat of all, and one that can subvert even the best-laid plans for security, is the threat from human action. This threat is unavoidable, as humans are necessarily an integral component of any operation an organization may wish to secure.

    The human threat can take the form of threats internal to an organization, and each of those threats can be intentional or accidental. Because of the access an internal person may have to sensitive areas or information, the threat from the actions of internal person are often rightfully considered the most severe. An internal person may also unwittingly act in concert with an external person who is a threat to the organization as well.

    A recent example of such a failure of physical security occurred when a 31-year-old man attempted to enter the United States from Canada at the border crossing in Champlain, NY, on May 24, 2007. Upon presenting identification, the Customs and Border Protection agent handling the man's entry received a computer alert. The alert warned that agents should immediately don protective clothing and detain the individual, notifying the originating authority.

    The next steps seem obvious: the man is detained, and border agents run the message up the notification chain, CDC eventually learns that the man in question has been located, and appropriate action is taken. The system works.

    What happens instead is that the man is allowed to enter the United States with no further questions, and is at the border crossing for a total of less than two minutes. The agent later says he thought the warning was discretionary, that the man "seemed fine", and therefore let him proceed. Every part of the system worked: the CDC was able to properly place the man on appropriate watchlists, his passport was properly flagged upon entry, and relevant information was presented to the processing agent.

    Every part, that is, except the human part.

    The man in question is Andrew Speaker, an Atlanta lawyer who traveled with his fianceé to Europe for his wedding and honeymoon. While in Europe, he subsequently learned that further testing revealed that he was infected with Extensively Drug Resistant Tuberculosis, or XDR TB, a form of tuberculosis resistant to a wide variety of antibiotics and treatments, and which can have a 70% mortality rate. The CDC and health authorities did all they could to attempt to restrict his further travel, and thus protect the public at large. Speaker sidestepped No-Fly and other watchlists by flying to Prague, then to Montreal, and then driving to the United States.

    The Department of Homeland Security has placed the agent, whom it has not identified, on leave while it reviews the incident, and related processes and policies. When a human charged with the ultimate protective responsibility errs, no amount of technology can solve that problem. What if this had been a man identified as on the way to the United States to intentionally spread an infectious agent? The frustrating element here is that all of the underlying information and identification systems were working - which is itself encouraging - but the individual

    • Re:Human element is the greatest danger (Score:5, Interesting)

      by WgT2 ( 591074 ) on Tuesday June 26, 2007 @07:06AM (#19647945) Journal

      Speaker sidestepped No-Fly and other watchlists by flying to Prague, then to Montreal, and then driving to the United States.

      Sounds to me that his actions were completely intentional, that he was not at all concerned about the health of others, that he wanted to fulfill his desires regardless of how it might affect others.

      I wonder if there are charges that could be brought up against him.

      In any case, you make a very good point about the human factor in security.

      • Sounds to me that his actions were completely intentional, that he was not at all concerned about the health of others, that he wanted to fulfill his desires regardless of how it might affect others.

        I'm sorry, did you miss the part that said he is a lawyer?

        FTGP:

        The man in question is Andrew Speaker, an Atlanta lawyer who traveled with his fianceé to Europe for his wedding and honeymoon.

        I guess they can't all be decent, hot dog loving [imdb.com] citizens, can they?

      • You make him sound like he's a bad guy, and I don't think that's fair. Put yourself in his situation. If you know you're gonna die soon from a disease, and that it CAN be cured if you go ONE hospital on the other side of the world, wouldn't you do anything you could to get there? I don't know how many of us would lock ourselves up in a room or sit and rot in an Italian hospital - resigning ourselves to death.

        That would be a very heroic thing to do, and I doubt that most of us would even venture into doin

        • Re: (Score:2)

          by WgT2 ( 591074 )

          Heroic? Since when is doing a right thing, like not putting others in mortal danger, heroic? If that were the case, then not driving my car 50 mph over the speed limit would also be heroic.

          What you describe as normal is also selfish and wrong.

        • If there really is a chance that going to %hospital will cure him then all he would need to do is
          1 check into his local hospital
          2 get secure transport to %hospital IN PROPER HAZMAT
          3 get cured
          4 PROFIT!!

      • Sounds to me that his actions were completely intentional, that he was not at all concerned about the health of others, that he wanted to fulfill his desires regardless of how it might affect others.

        Of course they were intentional. You don't accidentally pack a laptop. Well, I guess you could, but it would be difficult. He did not intend for it to be stolen and if you can't have a reasonable expectation that your stuff will NOT be stolen then we have a much larger problem to address.

        So many brilliant absent

        • Re: (Score:2)

          by WgT2 ( 591074 )

          Sorry about that. Although I thought essentially the same thing about the laptop loser, I meant the TB infected knob mentioned in my parent post.

          And, the parent post actually calmed my thoughts about the laptop in that the goof had permission to take it out of the country. I think we might have a bit of sensational reporting going on here meant to stir you and I up about something that could happen but didn't.

          • And, the parent post actually calmed my thoughts about the laptop in that the goof had permission to take it out of the country. I think we might have a bit of sensational reporting going on here meant to stir you and I up about something that could happen but didn't.

            I'm not much fun at parties. A benefit to seeing things in a very literal sense is blissful oblivity when someone's trying to trip a bug I just don't really suffer from, empathy. I have a sense of empathy, but its not so .. dilluted by the time

      • Sounds to me that his actions were completely intentional
        You don't read any news outside of Slashdot, do you?
        The man's went to check with its GP to know if he could travel, and was cleared to go.
        Next time you go and accuse people of wrongdoing or just want to troll around, check your facts.
        Oh..I forgot, we're on Slashdot. Nevermind then.

        • Re: (Score:2)

          by WgT2 ( 591074 )

          You should read the parent I was responding to. It has the context of my remarks, which were not about the laptop fellow.

          • He was talking about the TB patient as well. GP = General Practitioner. He was told he posed no threat to the health and safety of others.

            • Re: (Score:2)

              by WgT2 ( 591074 )

              Wasn't that his future father(-in-law) who told him that?

              Ultimately, he sent up flags at the border when entering the country and he seems to have entered the country in a roundabout way so as to minimize the scrutiny of the government/CDC. If that is actually the case, why would he do that if he was so confident that he was not a threat to others?

    • Re:Human element is the greatest danger (Score:5, Insightful)

      by djmurdoch ( 306849 ) on Tuesday June 26, 2007 @07:18AM (#19648019)
      You're missing one important piece of information in your description: how many false alarms does the border agent get from this system and all the other watchlist systems he has to work with? If the agent is getting hundreds of warnings that all turn out to be crap, why would he believe one good one?

      • Re:Human element is the greatest danger (Score:5, Insightful)

        by daveschroeder ( 516195 ) * on Tuesday June 26, 2007 @07:32AM (#19648127)
        You're missing one important piece of information in your description: how many false alarms does the border agent get from this system and all the other watchlist systems he has to work with? If the agent is getting hundreds of warnings that all turn out to be crap, why would he believe one good one?

        Warnings on a passport to detain, immediately don protective gear, and notify DHS and CDC?

        Not many.

        That's why the agent's handling of this is such a big problem. And it represents another aspect of human failure in security.

        Your point about false alarms is a valid one; this just isn't one of those examples.

        And for anyone who is thinking about No-Fly lists or watchlists possibly falling into the "too many false alarms" category, they don't. When a name is on a watchlist, more detailed information about the person (e.g. DOB, addresses, etc.) is passed up the chain to any number of originating entities or authoritative sources. If that is the target, instructions for handling are passed back. If it isn't, the person is cleared. The reason why it's done this way is for a variety of reasons, not the least of which is so that people at airline ticket counters or fronline TSA staff don't have access to classified or private personal information (beyond what is volunteered or required to be given by the passenger) when processing passengers, to say nothing of the enormous technical complexities involved. That's why you hear stories about people not being able to "get off" watchlists. It's not "them" that's on the watchlist; it's someone who shares that - or a similar - name. That's why people who aren't actually wanted for anything whose names are on "watchlists" are always allowed to fly after the check. Persons in such situations who are frequent travelers are also able to get special documentation to solve this problem. But "they" can't "get off" the watchlist, because it's someone else who is on it, and that's what the detailed checking process confirms. Yes, it's a very, very imperfect system, but identification has always been a cornerstone principle in law for recorded history. We're using the best balance of technologies and privacy we have - really - to attempt to identify persons who should not be allowed to enter the US, fly, etc.
        • No, not from just this system, from "this system and all the other watchlist systems he has to work with".

          If the border agent gets lots of false alarms from other watchlists, then he's not going to read any of them carefully, and he's not going to trust them.

          Are the alarms he gets rated on a simple severity scale (e.g. 1 to 10)? How many alarms does the agent get that received the same rating or higher as this one did?

        • It seems reality is flying in the face of your very well laid out facts.

          It sounds great and all that all these protocols and information are available. But I doubt that a security guard who only gets a warning once in a while would ignore "wear protective gear and detain."

          The Watch Lists are probably causing this problem. They need a name and a detailed discription of the suspect. So that "John Doe" doesn't get stopped. Too much detailed information on everyone is wrong, but too little information about a s

        • The problem is that many terrorists don't come from western countries, they don't even have the Latin alphabet at home. Passports are supposed to have names in Latin which are used for comparison but there are multiple possible mappings between say Arabic or Cyrillic and Latin. Dates of birth can also be ambiguous. Believe me, I worked on the problem of identifying people on watch lists for banks. Not only do names and dobs present problems but even the watch lists from say the US and the EU show discrepanc

      • If the agent is getting hundreds of warnings that all turn out to be crap, why would he believe one good one?

        His job is to observe the warnings and follow protocol. The fact that he could not see his way through to doing this implies that he should be terminated, and hopefully, held responsible for his negligence.

        If you don't want to do the job, don't take the paycheck.

        • That's a good solution, if you're the one who designed the broken system: Yes, my system generates hundreds of false alarms, but anyone who learns that it is unreliable will be immediately fired.

          Good at reducing complaints about the system, at least. Maybe not good at keeping intelligent employees.

          • That's a good solution, if you're the one who designed the broken system: Yes, my system generates hundreds of false alarms, but anyone who learns that it is unreliable will be immediately fired.

            You have committed the logical fallacy of "attacking a straw man" - I didn't say that they shouldn't report false positives, but that they should follow protocol. Not following protocol is how you get fired.

            Usually, reporting problems with the equipment falls under "protocol".

            Please do not attempt to make me loo

            • You said that someone who doesn't follow protocol should be fired. I said that someone who learns that the protocol is almost always a waste of time will likely not follow protocol. This may be because they are lazy and think they'll get away with it (in which case they should be fired), or it may be because they are far more likely to make an error when working with a broken system.

              Try this: take a few words you type every day out of your spell checker's dictionary, so that every time you type them they

    • Perceived status as an issue (Score:5, Interesting)

      by Flying pig ( 925874 ) on Tuesday June 26, 2007 @07:21AM (#19648035)
      What makes the Speaker case even more interesting is two factors. First, an educated professional given grave personal information behaved in a way that could possibly be interpreted by some people as irrational and maybe even putting others in danger. Second, subsequent comments reported to be by Speaker suggested that, like many lawyers, he is a very forceful individual who sees his own interests as paramount. It would be very interesting to know if the customs agent felt intimidated by Speaker and this accounted for his being allowed into the country.

      In the UK, a large number of intelligence protection failures have occurred basically because of the perceived status of the perpetrators. (the best known cases being Philby, Blunt, MacLean and Burgess, all of whom were fairly upper class members of the Intelligence services.) In his fictional books based on composites of the Philby-Burgess case (A Perfect Spy and Tinker,Tailor,Soldier,Spy), John le Carré (who was in a position to know) suggested that the Intelligence services suspected or half knew that they had traitors in their midst all along, but were inhibited from acting against fellow members of the upper classes and their own community.

      It would be very interesting indeed to know how far this culture extends into research establishments. It would be expected to be quite pervasive because of the esprit de corps among any professional group.

      Of course, perhaps the real answer is that scientists and engineers, by their nature, are the worst people to be allowed to work on secret weapons systems because it contravenes their tendency to want to cooperate, share knowledge and see their own work published. Let's replace them all with Fortune 500 CEOs. That should result in a real peace dividend.

      • Re: (Score:2, Interesting)

        by morgan_greywolf ( 835522 )
        Well, not all security personnel can be swayed by someone's status. I know people who have worked airport security (prior to the TSA takeover, in fact) and you'd better believe that everyone was required to go through the screening, at least at Detroit's Metro Airport (DTW). And I mean everyone. The pilots, the flight attendants, even high-ranking politicians, celebrities, off-duty police, off-duty FBI, and other high-ranking officials. (The only people allowed through without screening were U.S. militar

        • Re: (Score:2, Funny)

          by pedalman ( 958492 )

          Well, not all security personnel can be swayed by someone's status. I know people who have worked airport security (prior to the TSA takeover, in fact) and you'd better believe that everyone was required to go through the screening,
          Like the comedian said about these security checks:

          "The good news is that you'll make your flight on time. The bad news is that you have an enlarged prostate gland."

        • Re: (Score:2)

          by afidel ( 530433 )
          My favorite story about well trained guards involves Marines on a Naval base. The Marines are the guards for any area where nuclear weapons or fuel are stored. My dad's friend's brother is a Read Admiral on a carrier, when taking my dad on a tour of the base the quickest way from one area to another involved a brief trip through a controlled area (though nowhere near the munitions facility). The two Marines stopped my dad and his escort at gunpoint, had them place their ID on the ground and step back some n

      • Of course, perhaps the real answer is that scientists and engineers, by their nature, are the worst people to be allowed to work on secret weapons systems because it contravenes their tendency to want to cooperate, share knowledge and see their own work published. Let's replace them all with Fortune 500 CEOs. That should result in a real peace dividend.

        We could make a 'great' start by putting Haliburton on the list.

        I would be worried that they might outsource the research to China though. That might caus

    • Re: (Score:1)

      by LuNa7ic ( 991615 )
      For those who don't know, Los Alamos is a nuclear weapons laboratory in New Mexico.

    • How does the user control email? (Score:5, Insightful)

      by msauve ( 701917 ) on Tuesday June 26, 2007 @07:29AM (#19648107)

      In the email instance, anyone can at any time send classified information over an unclassified network.
      How does the user control that? Are they all running sendmail (or some other MTA) locally on their machine, and given full control of email routing?

      I'd think, like virtually every other email system in the world, that users would have their MUA configured to send outbound email via a single mail server, where all further routing is under administrative control. Do they allow connections to that server from outside?

      I could understand the issue, if it was someone sending to an external, insecure email address. But the summary, article, and now you all say the problem is with which network the email was routed over. The other possibility is they were off-site, and didn't have a secure VPN connection running - buy why would a secure system not force SSL email connections? Or is sending even over VPN/SSL not considered secure?

      It's just not clear how the user has the control implied here.

      (or is it that they're allowed to have personal email accounts on their machines, and that's where the email was sent from?)

      • Re: (Score:3, Informative)

        by daveschroeder ( 516195 ) *
        How does the user control that? Are they all running sendmail (or some other MTA) locally on their machine, and given full control of email routing?

        No. They just send classified information from an unclassified workstation and an unclassified email address, almost like any person would send email in any workplace. That's why some public areas have big signs that say DO NOT DISCUSS CLASSIFIED INFORMATION or watch officers answer phones with, "Good evening, Lt So-and-so speaking, this line is not secure. May
        • than just sending email.

          They just send classified information from an unclassified workstation and an unclassified email address, almost like any person would send email in any workplace.

          It seems to me that just as serious as how the email is being routed, perhaps more so, is how classified material got on the unclassified workstation in the first place (you mentioned one possibility), and why is that not also being reported as a violation. (i.e. why focus on the email aspect, that's just a result - the

          • Yes, if classified information is put on an unclassified terminal, that's a bad thing, but it still needs to be discovered.

            And that also doesn't stop someone from simply manually typing an email message whose substance contains classified information. Not all classified information comes in the form of a document that will be an attachment...it could be just as simple as discussing a classified project or something similar, and then the recipient reporting the "breach". Without more information about what h

      • Re: (Score:1, Informative)

        by Anonymous Coward

        I'd think, like virtually every other email system in the world, that users would have their MUA configured to send outbound email via a single mail server, where all further routing is under administrative control. Do they allow connections to that server from outside?

        None of these technical considerations have anything to do with it. Classified and unclassified computing are totally disconnected. The only way classified info unintentionally gets sent on an unclassified network is if the user manually

        • Re: (Score:1)

          by n6kuy ( 172098 )
          Or if the user takes his classified laptop home and plugs it into his DSL router.

          The incident is reported to be perpetrated by high level management at LANL.
          High level managers get to take classified laptops with them wherever they go, probably.

          For your daily dose of Lab cynicism, be sure to read The LANL Blog [blogspot.com].
      • los alamos has a press release [lanl.gov] response to this. The laptop did not contain sensitive info. Indeed it would be highly unusual for a laptop with sensitive info to leave the Los Alamos site on travel. Moreover, what Los Alaoms considers "sensitive" info is a much higher standard than you would think. For example, if an employee has someones resume on their computer and that resume, despite being a public document, perhaps taken off Monster.com or Nature.jobs, has a birthdate in it, then it's treated as se
    • ***In the email instance, anyone can at any time send classified information over an unclassified network. It is up to the user to not do this. Granted, there are various technical and other procedures that can help prevent this, but it can never be completely avoided.***

      Excuse me. Back when I was doing gubmint (DOD) work, connecting a machine with classified data stored on it to an unclassified network with unmonitored connections to the outside world would have gotten you ten years and/or $10000. Appa

      • Re:Human element is the greatest danger (Score:4, Insightful)

        by daveschroeder ( 516195 ) * on Tuesday June 26, 2007 @07:50AM (#19648285)
        Yes, there are a lot of ways to help prevent this.

        But nothing stops someone from typing up an email that contains classified information and sending it from their unclass account, inadvertently or otherwise. It's not like they magically need to be on JWICS to send top secret information. That's why we segregate the networks, yes - to attempt to prevent this from a technical standpoint as much as possible.

        Also, there are ways to migrate information between networks, and those can be abused or used inappropriately. There are a lot of ways this accident might occur, and it probably happens more than we'd like.

      • Re: (Score:2)

        by norton_I ( 64015 )
        Well, it is certainly now relatively easy for LANL employees to communicate via the unclassified network. Lots of non-classified research there is done in collaboration with people at universities and other labs, and that requires communication.

        There is a fairly good argument that that work should not be done at LANL, but as long as it is, they need realtively accessable public communication. Another consideration is that for some non-classified research, the govt. also wants the ability to classify parts

    • What happens instead is that the man is allowed to enter the United States with no further questions, and is at the border crossing for a total of less than two minutes. The agent later says he thought the warning was discretionary, that the man "seemed fine", and therefore let him proceed. Every part of the system worked: the CDC was able to properly place the man on appropriate watchlists, his passport was properly flagged upon entry, and relevant information was presented to the processing agent. Every

    • One of the best first posts to an article ever. I 100% agree that this is really not all that interesting other than the media can sensationalize it because Los Alamos has been in the news previously... All it comes down to is an unclass laptop (and btw they will say that the laptop contained "sensitive" info in almost any case where a govt. system is stolen) and someone who typed up an email and didn't realize that something he type was classified... Or it could have even been he marked the email as class

      • Re: (Score:2)

        by Gilmoure ( 18428 )
        Man, you do not want to have any TS/S items on a restricted or open system. Security does a scrub of systems and related items to the point that the issue isn't even put in work logs but tracked on paper.

        What happened here was plain human error (stupidity). I've had users ask if it's OK to take work laptops to Canada. Hello, they're still a 'foreign country'. Just because they speak English and have decent beer doesn't change that. There is a security mind set that some people just don't get. They try to re

    • ...In the email instance, anyone can at any time send classified information over an unclassified network. It is up to the user to not do this. Granted, there are various technical and other procedures that can help prevent this, but it can never be completely avoided. These incidents seem rather tame, but since Los Alamos is under the microscope, every such incident will be greatly scrutinized - and sometimes blown out of proportion.

      It's not possible to inadvertently email classified information off the DoD classified network - the classified network isn't connected to the internet for this reason ;-)

      The user would had to have moved the data off the secure network to send it over the internet.

      • It's not possible to inadvertently email classified information off the DoD classified network - the classified network isn't connected to the internet for this reason ;-)

        The user would had to have moved the data off the secure network to send it over the internet.

        Or, you know, simply manually typed in information that was classified.

        All classified information isn't in the form of preexisting documents that would be attachments. It's actually possible to discuss it verbally or via email, you know, and still
        • The operative word in my post was "inadvertently" and I'll maintain my position that it's not possible to inadvertently email something from the classified network to an unclassified one.

          Yes, the data would have had to have been either transferred to the unclassified network or duplicated on it, but 'inadvertent' implies error when in reality the user would have had to bypass several safeguards to send a classified email on an unclassified network.

          • nah (Score:2)

            by r00t ( 33219 )
            Somebody grabs the wrong keyboard, types their email, sends it... oops.

            Somebody confuses the government's classified project code word with the company's unclassified project name... oops.

    • Re: (Score:3, Insightful)

      by Vitriol+Angst ( 458300 )
      With Homeland Security putting up warning flags for Hippy Muscicians, and a million other people. I can understand someone ignoring a flag from the CDC.

      Any human system works best with "targeted" warnings. Yet the HS system seems designed to scan everything. It's like finding a needle in a haystack by ordering more hay.

      So the man with Tuberculosis got through, because a lot of people who shouldn't be on a watch list break the system. We probably have worse security response now than before 9/11. I certainly
      • what somebody should do is have a set of icons at the top of the alert for example

        1 Small Shield = "person of interest"
        2 Large Shield = "felon/ federal POI"
        3 Rad Hazmat = nuclear type person (should have a number for level 5 = guy glows in the dark)
        4 Bio Hazmat = guys with known infections ( same deal 5 = quarantine the guy )
        5 Chem Hazmat= folks that play with funny chemicals ( 5 = quarantine the guy)
        6 $ symbol = rich persona non grata
        then have the gibbering/details
    • The real question that should be asked is why was the employee allowed to take the laptop with him on vacation. After all, the laptop is government property and belonged to Sandia National Labs. If the employee was going on vacation, he should have taken his personal laptop, not his work computer.

      If SNL (and any other government agency for that matter) had stricter rules regarding personal use outside of work, them things like this might not happen as often.

      a quick search yields:

      http://www.washingt [washingtonpost.com]

  • One mail? (Score:3, Interesting)

    by suv4x4 ( 956391 ) on Tuesday June 26, 2007 @07:03AM (#19647923)
    In one, an e-mail containing classified material was sent over the open Internet rather than through the secure defense network.

    So he sent one mail and it was intercepted? Damn, this puts the "insecurity" of email communication in an entire new light.
    • So he sent one mail and it was intercepted? Damn, this puts the "insecurity" of email communication in an entire new light.

      No, there are probably plenty of other instances of classified information being sent over unclassified/insecure networks.

      This is just one that was identified.

      And what probably occurred is that the recipient realized what happened, and reported it.

      (But, by your last statement, do you really think the national laboratories shouldn't try to prevent classified information from being sent o

      • And what probably occurred is that the recipient realized what happened, and reported it.

        Or the recipient was expecting it and had been instructed to report it when recieved. How better to make the Iranians think it's genuine information regarding ancillary nuclear weapons components? The CIA slipped bugs to Soviets [msn.com] before, and there have been reports that the US and European countries have been doing the same kind of thing to Iran to slow their nuclear program.

    • So he sent one mail and it was intercepted? Damn, this puts the "insecurity" of email communication in an entire new light.

      There is no indication in TFA that the email was "intercepted" by anyone. The sender distributed an email containing classified info to multiple recipients over the public Internet and someone (probably one of the recipients) reported the violation. Of course, a copy of the message might very well be sitting on a non-gov't server somewhere. Maybe the sender actually encrypted the

  • An employee took his lab laptop on vacation (Score:3, Funny)

    by niceone ( 992278 ) * on Tuesday June 26, 2007 @07:04AM (#19647925) Journal
    It is a real incitement of the current system that this can still happen in this day and age. After all, Mission Impossible had the whole problem of off-site IT equipment solved decades ago with simple self-destruct technology.
    • The same should apply to humans. If you are in possession of sensitive knowledge your head should explode if you are asked inappropriate questions by strangers, or at the very least nanobots in your skull should lobotomize you to the level of drooling idiot.

    • yeah, but that was before modern miniaturization of devices.

      It's alright for a large tape machine to slowly self destruct in a phone booth, but don't nobody want their Palm Pilot exploding just after putting in their pants' pocket!
    • A human, especially one with inside access, can always subvert most any security plan. [slashdot.org]

      It's not really an indictment (which is what I think you meant to say) of anything. I'm not sure why this is modded up; there's no reason for a laptop that doesn't even have classified information to be set to self-destruct if its departure isn't approved, and unless every single email is manually checked, classified information will always be able to be sent over unclassified networks. In fact, someone with knowledge of c

      • Re: (Score:2)

        by niceone ( 992278 ) *
        Heh, I'm not sure how it got modded interesting... it was a joke!
      • Since June of last year, it has been OMB (Office of Management and Budget) policy (OMB M-06-16) for all federal agencies to encrypt laptops if they carry sensitive data. Most federal agencies have extended the definition of sensitive data to any type of personal data. Smart federal agencies are simply requiring all/all mobile devices be fully encrypted. Department of Energy has smart people working for it, but smart guys often consider IT restrictions to be impediments to their work, which of course, is

    • Re: (Score:3, Insightful)

      by suv4x4 ( 956391 )
      After all, Mission Impossible had the whole problem of off-site IT equipment solved decades ago with simple self-destruct technology.

      Right. We should make the laptops constantly read some sort of signal that fades away out of the pentagon, for example.
      If the signal fades away, the laptop explodes.

      Now combine this with the recent news about NSA brownouts, and we're effectively decimating our military in few minutes.
      Or how about a laptop battery fire causing the explosive to go off.

      Who would walk with a ticki
    • i thought dell recalled all those 'fire-laptops'

  • Sensitive nature (Score:1, Interesting)

    by suv4x4 ( 956391 )
    The machine reportedly contained government documents of a sensitive nature.

    I for one am sick of hearing about the military's sensitive nature. What was the document containing, poems about the war in Iraq or something?

    We all know 90% of those documents have no reason to be hidden from anyone, except to hide the abuse and money laundering that's going on at furious speeds over there.

  • Little mention of countermeasures (Score:3, Insightful)

    by Pointy_Hair ( 133077 ) on Tuesday June 26, 2007 @07:37AM (#19648167)
    TFA mentions the missing laptop was equipped with an encryption card (highlighting the loss of the card versus noting it's function). It doesn't mention whether the "sensitive" data on the device was protected with encryption. Likewise, there's no mention about the stray e-mail either. Someone who routinely works with classified data will usually be a routine user of encryption tools to protect communications.

    Fact is that Los Alamos is a juicy media target and they will conveniently omit details like that to sell headlines.

    Or the violators were pointy-haired managers that thought that high tech encryption stuff was only for the gearheads in the white coats.
    • I'm more interested to know who's got it in for Los Alamos.

      Of all the people employed by the government in this line of work, there's got to be many, many more cases just like this out there. How is it possible that this *one* government funded R&D facility has security problems that boil down to human error rather than process?

      I have a feeling the others have the same issues, except this one is someone's punching bag. That someone is powerful enough to get the gears of government working against Los

      • Re: (Score:1)

        by n6kuy ( 172098 )
        Too many democrats in congress that pander to the lefty tree hugger types.

        LANL has been a punching bag for quite a while. After all, it's where those evil nasty nuclear weapons of mass destruction were invented.
    • The laptop was not equipped with an encryption card. The poor guy's password-generator card for checking his work email was with the laptop and was also stolen. It's the same sort of card used by business everywhere, and is only export controlled because the US government has really really strange rules about encryption.
      This is just another example of sensationalist news reporting by 'journalists' who can't be bothered to do research beyond a bit of googling!!
  • Why would anyone in their right mind take their work laptop on vacation especially overseas ? Then again, this is America, a live to work society.

    Even though I work in Corporate America, when I go on vacation, I want nothing to do with work during that time even though executive management gets upset that I don't want to be available for work related items such as calls in my absence.

    I do take a laptop with me on vacation but it is for personal use such as personal e-mail, process digital pics, surf t

  • Text of the email (Score:4, Funny)

    by Timesprout ( 579035 ) on Tuesday June 26, 2007 @07:43AM (#19648211)
    Hi Hon,

    I'm going to be late home from the lab tonite so have dinner without me, we are just putting the finishing touches to the doomsday device so we can test it tomorrow.

    Love you
    xxxxxx
  • After reading TFA I'm still a bit confused about how the email got off the SIPRNET (secure DoD network for classified material) and onto the NIPRNET (regular unclassified DoD network that is connected to the internet).

    SIPRNET computers don't have internet access - or access to any other network. It appears to me someone would have to have taken the data out of the vault and composed it on an unclassified PC to send it anywhere off the secured network.

    • Re: (Score:1)

      by redtail ( 265571 )
      This should be mod'd up, it is the only post that gets close to the email issue. The fact that the email was sent over the internet is colossaly besides the point. How did the information get onto a computer that has an internet connection? It suggests people are doing classified work on unclassified computers. Not a "mistake". Rather it is a deliberate choice.
    • Looks like he sent an email and wrote "highly classified" on it. I don't think he transfered data from SIPR or NIPR.

      I problem I had while working with SIPR was people would bring in unmarked thumb drives and use their unclass email to transfer the data. We just educated the users and this problem dissolved.

    • Re: (Score:2)

      by bellers ( 254327 )
      DoE doesnt use SIPR/NIPR. They've got their own deal, and their own clearance system.

      they arent DoD.

      The user in question probably had both class. and unclass. systems sitting on his desk, and typed too much information from one screen into the other one.

      It happens.

  • It's Also Worth Noting... (Score:3, Interesting)

    by NeverVotedBush ( 1041088 ) on Tuesday June 26, 2007 @08:12AM (#19648461)
    That quite a few senators and representatives, in this time of tighter money, see the Los Alamos budget as a juicy target. The more they can keep Los Alamos in the news and hold it up as "incompetent" to handle security, the better chance they have of yanking funding and redirecting it to whatever their pet projects are in their own states. Not that it matters what Los Alamos does to enhance the Nation's security - little things like the chem/bio sensors used at the Salt Lake City Olympics, inventing a lot of the new DNA techniques, work on alternative energy, fighting terror in many ways, and yes, even making sure that the USA has reliable nuclear weapons. Check their web page. They do a lot for the country.

    But by yanking funding and threatening to "close the place down", those senators and representatives are risking a valuable National resource. It's their choice I suppose. But I don't think this continued beating down is very productive.

    Los Alamos has name recognition. It makes great headlines every time anyone even takes a dump out there.
  • http://www.truecrypt.org/ [truecrypt.org]

    People should be fired/prosecuted for negligence these days.

     
  • "Each user will be assigned a login ID and password for the Windows NT [usmc.mil] system"

    "The SIPRNET workstation may be used to download files from the SIPRNET. Anti-virus software has been installed and runs as a TSR program .. Any files downloaded to floppy or printed must be entered into the Automated Security Control Program (ASCP) by Document Control personnel"
    • When I worked for the Inland Revenue (UK), we had vast numbers of NT4 machines, both server and workstation being rolled out to replace the UNIX servers and Win311 workstations.

      Because of the size of the order, and importance for confidentiality, we recieved a "custom" version of NT. It had a different build number, a replacement GINA, and some other security features added in. If microsoft are prepared to do that for the UK Tax man, I would have thought that the US Military would get full sourcecode to aud
      • Remembering back to having to do Secure network accreditation (in the UK), there's actually a very short list of operating systems that have an EAL Evaluation Assurance Level [wikipedia.org] certification. Because it's a bitch to go through the OS exhaustively, and check things, and therefore expensive. A few years back, the choices we had were Solaris 2.6, and NT 4 SP 3 I think it was.

        No where near the most up to date at the time. (We were running Solaris 8 and 9 elsewhere on site, and NT had already been removed and be

  • Crypto? (Score:3, Interesting)

    by Lethyos ( 408045 ) on Tuesday June 26, 2007 @08:36AM (#19648693) Journal

    Is it a gross simplification to state that using encryption would have rendered both mistakes harmless?

    Is this really so hard for IT departments to set up PGP or one of its clones? Same goes for disk encryption? I have argued with people up and down who claim this is too hard to deploy, but I say that something is better than nothing, even if it nothing more than checking “encrypted folder” on your NT system.

    These tools have gotten so easy to use these days and while I understand this is largely a social and policy problem, there is plenty of low-hanging fruit that can help mitigate the damage.

    • [blockquote]
      Is it a gross simplification to state that using encryption would have rendered both mistakes harmless?
      [/blockquote]

      No where in the story does it say the data on the laptop was *not* encrypted. In fact, the statement by one director that the user would've been granted permission to take the laptop to Ireland if he'd asked makes me believe is *was* encrypted.

      Chris Mattern

      • Re: (Score:1)

        by n6kuy ( 172098 )
        NO, it means that there was nothing THAT sensitive in the laptop.

        The fool just didn't fill out the appropriate paperwork.

        Sigh. Another non-event being blown out of proportion for no reason other than it originates from LANL, the left's favorite whipping boy...

  • Laptops are not and will never be secure! (Score:4, Insightful)

    by supersnail ( 106701 ) on Tuesday June 26, 2007 @10:17AM (#19649875)
    Its an axiom in security that if someone physical access to the hardware they can do what they like.

    Given the ease of use and portability of a modern laptop you may as well just post a copy of the data to anyone who might be interested.

    Stolen laptops are actually the lowest risk area, given that most laptop theives are after the shiny hardware and its so rare to come accross data with any resale value that they probably dont even look. A far greater risk for a high security installation like Los Alamos is someone borrowing a laptop for long enough to install some worm/trojans/keyloging software which the dedicated sceintist can then physically carry through all those firewalls back into the lab.

    Any sane security profesional would just plain ban them from a set up with the security requirements of Los Alamos.
    The best solution would be to have all hardware in a locked server room and only access them via "dumb" terminal servers. Plus a private network with no physical connection to the outside world.

       
  • The email thing happens occasionally at my office. Sometimes, there are certain numbers that are classified in a particular context, but the other information is not. For instance, someone who is working on new type of laser may be able to talk about the laser (the knowledge of the technology is unclassified), as long as they don't disclose certain properties of it (for instance, its specific power and waveband may be classified).

    I frequently see situations where a particular classified value could be de
  • ... but it's not just the end user. In my role I look at my IT team just as much as the end user as they're just as human. There's nothing more hilarious to me than "secure" DoD operations with dual workstations (for confidential vs. connected to the public Internet and therefore general use) that are all locked down but then don't prevent something as silly as unplugging a USB printer to then use a thumb drive. There's always technology or room for innovation to prevent such human errors via checks
  • We really need to mandate that any computer used with sensitive material, laptop on the road or desktop at the office, has an encrypted hard drive and a biometric reader with BIOS level support so you can't even boot the thing w/o reading your fingerprint/eyes/etc.

    As for the email, I'm surprised the even have a open link to the internet on a machine with sensitive information.

    • "I'm surprised the even have a open link to the internet on a machine with sensitive information." Well, considering that sensitive information springs, fully formed, from the heads of specialists in these fields, there's not an issue of "linking" to any previously existing files. As has been pointed out, there are no connections between the classified systems and the internet. It's the original thoughts of brilliant people that are, of themselves, potentially problematic. And careful as they are, sometime
  • In the other incident, an employee took his lab laptop on vacation to Ireland, where it was stolen out of his hotel room.

    Does that idiot still have a job? And if so ... why?

Slashdot Top Deals

Technology is dominated by those who manage what they do not understand.

Close