Forgot your password?
typodupeerror
Data Storage The Military

Military Bans Removable Media After WikiLeaks Disclosures 346

Posted by timothy
from the no-using-your-photographic-memory dept.
cgriffin21 writes "The Pentagon is taking matters into its own hands to prevent the occurrence of another WikiLeaks breach with removable media ban, preventing soldiers from using USB sticks, CDs or DVDs on any systems or servers. The directive prohibiting removable media followed the recent publication of more than 250,000 diplomatic cables, which were leaked to whistleblower Web site WikiLeaks at the end of last month by a military insider."
This discussion has been archived. No new comments can be posted.

Military Bans Removable Media After WikiLeaks Disclosures

Comments Filter:
  • horse (Score:5, Insightful)

    by florescent_beige (608235) on Friday December 10, 2010 @08:11PM (#34519854) Journal
    barn
    • by multisync (218450)

      No kidding. They're *just now* getting around to this?

      • Re:horse (Score:5, Interesting)

        by cytg.net (912690) on Friday December 10, 2010 @08:22PM (#34519994)
        Indeed.
        I had a conversation with a high ranking officer a few years back who boldy calimed that their systems was 100% secure, nothing i could do.. When i explained my attack vector would be to phone in and pretend to be from support and ask him to stick in the usb-dongle (wich he had in his mail) and plug it into the secure line .. well he (or she) pretty much had a revelation ... omg is it that simple. no it is not. and yes it is. It is that simple to someone as hardcore to the art of data theft as you are to the art of war.
        • Re:horse (Score:5, Informative)

          by blair1q (305137) on Friday December 10, 2010 @08:42PM (#34520166) Journal

          Except that long ago there was a directive from the Pentagon not to allow removable media to be used for secure systems.

          My guess is that they relaxed that for field units because some deployed systems have no networking attached and sneakernet is all they could use. And somehow that idea ended up meaning you could use removable media on network-attached systems, and eventually nobody even noticed when someone slipped a CD-RW into a machine with access to the entire database of classified information relating to the Iraqi and Afghani theaters of operation.

          That someone is currently in jail, because, physical means or no, it was still illegal to take the information from the secure area without authorization, and to give it to uncleared people.

          • by Darinbob (1142669)
            The military understand security in some areas - they don't trust people they don't know when they're in the field of battle. However they are laxer in other areas. Why for example was a mere private allowed to access a secure computer? Why didn't the guard question what he was doing? Why didn't plugging in the USB stick immediately set off some alarms? The military just doesn't like to think of one of their own as a potential bad guy.

            A lot of that comes back to the old rule, that the more secure somet
        • Re:horse (Score:5, Interesting)

          by DeadDecoy (877617) on Friday December 10, 2010 @08:57PM (#34520280)

          The problem is that security tends to be more of a human problem than a technical problem. A person can easily hide a usb stick somewhere on their person, and in the event that fails, take screenshots with a camera or write notes down. The first step is not to take away the usb stick, but to give the individual in question the training and incentive not to leak information in the first place. The training might include don't open any wierd attachments, browse to unauthorized sites, or use io devices from an unverified source. The incentives might include monitoring of sensitive material, legal repercussions, and, God-forbid, not implementing stupid policies that are morally questionable. Assenge noted in an interview that the purpose of Wikileaks wasn't to start a revolution but to make it easier for (morally)good companies to do business and to make it harder for (morally) bad companies to do business. The same could be said for government. Hire a trustworthy+competent staff don't be a jackass and you'll be less of a target, or at least implement fewer inane 'security' measures.

          • Re:horse (Score:5, Insightful)

            by Maxo-Texas (864189) on Friday December 10, 2010 @10:04PM (#34520678)

            And the next step is to not say "We are firmly for position X" in public while saying "We agree, we are against position X" in private.

            The bald faced lies tend to make honest humans want to rat them out periodically.

            • Since when has honestly had any place in government?
              • Since when has honestly had any place in government?

                The question is not does it, but should it. You talk as if honesty should never be required of governments and we should just accept them being corrupt and secretive.

                If a government habitually lies, honest people will feel a motivation to leak when the gap between private reality and public pretension becomes too large. They may be naive, they may be punished after the fact, and they may find it difficult to work around your measures, but it will never be

          • Re:horse (Score:5, Interesting)

            by The Snowman (116231) on Friday December 10, 2010 @11:41PM (#34521138) Homepage

            A person can easily hide a usb stick somewhere on their person, and in the event that fails, take screenshots with a camera or write notes down.

            Removable media, cameras, or phones with cameras are not and have not been allowed in SCIFs for as long as I remember. Old fashioned paper and pencil is difficult to detect, as are meat memory devices.

            The first step is not to take away the usb stick, but to give the individual in question the training and incentive not to leak information in the first place.

            No, that does not work. You have to choose who you trust, which is why DSA performs investigations for all military personnel before granting clearances. Security managers interview personnel and ask questions, looking for warning signs. Someone could have a pristine history and list of contacts but still want to do harm: asking the right questions can tip off the people in charge of security. Also, as I saw on Dateline the other night with regards to corruption in the Iraqi police force, paying people a livable wage helps them not to betray you when given a carrot in the form of money, or the satisfaction of fucking with you (e.g. giving documents to Wikileaks).

            Security is a tough business. The government needs tens of thousands of people in the intelligence community across all four branches of the military and civilians in various DOD organizations: people from all walks of life, all ages, ethnic groups, geographic locations, etc. No matter how careful they are, there will be leaks. Their goal is to detect internal threats early, and to minimize damage.

            For example, when working in a classified environment, everyone is watching not only what they are doing, but keeping an eye on everyone else. Maybe someone left their SIPRNET terminal unlocked and left for the bathroom: probably just careless, but it is important to have coworkers keep an eye out for innocent errors and help correct them. Maybe someone really is trying to steal data: coworkers need to question that person why they are not following approved and document security procedures. Maybe there is a legitimate reason for putting data on removable media: couriers do exist even in the current era of high speed private networks such as SIPRNET.

            Finally, by limiting the data each person has, a breach can be localized. For example, if an image analyst steals satellite imagery, odds are that person does not have access to lists of informants, even if it is classified at the same level. That lessens the impact of a leak.

            The real failure with that kid that leaked to Wikileaks is the human factor: nobody paid attention, asking him why he was not following procedures. Someone gave him access to far more data than he needed to do his job. Forget the USB drive restrictions, the DOD needs to crack down on basic security training and protocol.

          • by DesScorp (410532)

            The problem is that security tends to be more of a human problem than a technical problem.

            In the Pentagon's case, it's a problem of many humans. Too many people have secret clearances or better, and "need to know" isn't enforced vigorously enough in many units. The General Accounting Office says there are over 3 million people with a "secret" level clearance in the US. There's no excuse for that.

          • by Max_W (812974)

            Why have secrets in the first place? Why not to train soldiers not to laugh and joke when they shoot at people from a helicopter? Maybe follow some sort of an engagement procedure?

            Why not train diplomats not to call insulting names and make cynical remarks? But use instead the whole register of great English language to express a thought.

            And USB memory sticks could be used then. Why not? A USB memory stick is a great tool nowadays for information and communication worker. It is like forbidding a carpenter t

        • 1. Your monitor is at 60 hz, so flash your text or encoded bits on the screen at 30fps, and record it with your iphone HD recorder. High quality mode, or use someother small HD camera that uses little compression.

          2. Encode your documents into an audio streamed 6bit/sample with ECC. Hit play and record using your analgoue or no compression digital recorder via the Audio Out jack. This will require some small code in VB you can type in either by memory or from paper/iphone.

          If you have a monitor or audio ou

    • by Tynin (634655)
      All the same, if they are serious about security of their data, not allowing any writable / removable media on there facility just makes sense. On top of that, they should weld the cases on all of the workstations shut, disable pretty much all IO ports except for a physically permanent connection for the keyboard, mouse, monitor, and network cable. Monitoring to see if any new writable media becomes available on the workstation would be a good next place to flag for further investigation.
      • Re:horse (Score:5, Interesting)

        by jd (1658) <imipak&yahoo,com> on Friday December 10, 2010 @09:12PM (#34520372) Homepage Journal

        The problem is not the decision, so much as that allowing insecure mechanisms (in violation of NSA Security Information notices, Common Criteria instructions for the levels required for secret information and Federal Information Processing Standards, I should add) was not only bloody stupid to begin with, it was in violation of US law regarding the handling of classified information.

        Instead of prosecuting Manning, who at worst is guilty of far less than the Lockheed-Martin officials who publicly sold the plans for the current stealth fighters, one should ask why his actions were even possible in the first place. FIPS standards for secure platforms and NSA publications expressly prohibit the capability to transfer files to insecure formats. It is illegal, under US law, to install or use non-compliant systems for Government purposes. This means that giving Manning the computer violated US law. Do you see anyone charged with violating such US laws? I don't.

        • by bhcompy (1877290)
          I'm sure that some of those people were disciplined within the military, though. This kind of negligence doesn't get overlooked by the brass when uncovered, even if they quietly handle it because the military is capable of doing that behind closed doors.
      • The security they had was poor because of incompetence, the same incompetence will "secure" it again. Will it work? ;-)

        This isn't even really secure information and its extremely likely spies have always had this level of access. What I'd love to know is how secure the actually secure or extremely secure information is... and how easily accessed that is by foreign governments (and future internet leaks as the US government falls deeper into the authoritarian black hole.)

    • Re:horse (Score:5, Funny)

      by jpmorgan (517966) on Friday December 10, 2010 @08:24PM (#34520022) Homepage

      Oh, I don't know about that. The US military still has a lot of horses left.

    • Which horse? (Score:5, Interesting)

      by jd (1658) <imipak&yahoo,com> on Friday December 10, 2010 @09:03PM (#34520316) Homepage Journal

      The Pentagon had to ban USB sticks, et al, internally after the biggest single security breach caused by a virus passed around and brought onto the secure SIPRNET within the Pentagon itself. It's unclear to me if the problem was the virus relaying secret information off the secure network, or what, but apparently it was labelled the single biggest security breach by the Pentagon and they're unlikely to be overplaying security holes.

      Mind you, NASA has just released secret information into the public domain by selling hard drives known in advance to contain secret information. These are drives that FAILED in-house auditing for such stuff. And prior to that, disk drives containing blueprints for the current generation of super stealth fighters were sold by Lockheed-Martin to Iran. (And people think Wikileaks did bad stuff?!?!?!?! How the hell does a bunch of personal opinions compare with giving a terrorist-funding nation plans for the top US fighters? Internal to Iran, there's the possibility they will find a weakness. Think Death Star plans. Think the Stealth Fighter shot down in Serbia. Yes, the Serbians blew up one of America's best planes, and with a cruddy cheap missile at that. On an international level, the Russians will doubtless use the plans to improve on their own airfoils and may be able to exploit the design to improve on whatever shape-based stealth they've developed so far.)

      Add to that that NASA servers have been hacked in the past to turn them into file-sharing sites. Which means that whatever classified files were in those exposed directories have been shared as well. Quite plausibly these files were protected by DES only, not triple DES or AES, as "commercially sensitive" data is classified below secret and certainly only used basic DES up until a couple of years before that breech was discovered.

      Then, back in the 90s, there was a breech at the Pentagon due to computers containing classified information being on the public Internet and having .hosts files. (NASA used .hosts files and rsh well into the current millenium and may well still do so.)

      That's four Bloody Obvious horses, with gold bridles and gem-encrusted saddles, that have walked out and were only noticed after they kicked the door down at the stablemaster's house. There may be others.

    • Re:horse (Score:4, Insightful)

      by mwvdlee (775178) on Saturday December 11, 2010 @04:18AM (#34521926) Homepage

      I'm sure the military had a ban on leaking information too.
      Why would they think a ban on removable media works any better?

  • by LiquidCoooled (634315) on Friday December 10, 2010 @08:14PM (#34519888) Homepage Journal

    Thank god they didn't ban floppy disks.

    I knew these bad boys would come in handy one day!

    • Re: (Score:2, Funny)

      by Anonymous Coward

      The problem is that they've read the evil overlord list and are padding all files to 1.45 MB in size...

    • Especially since the entirety of sensitive military documents takes up roughly 1.3 MB, according to movies!

    • What about punch cards? :P

  • Nothing to see... (Score:5, Informative)

    by Frosty Piss (770223) * on Friday December 10, 2010 @08:14PM (#34519902)
    This applies to SIPRNET machines, and specifically personal CDs, DVD, etc. The thing is, this has always been the rule. At least everywhere I've worked with SIPRNET access (Air Force).
    • I don't get it. No access to removable drives is part of Paranoia 101. I guess I'll just have to RTFA.

      Hope that helps.
      • Re:Nothing to see... (Score:5, Informative)

        by bill_mcgonigle (4333) * on Friday December 10, 2010 @08:24PM (#34520020) Homepage Journal

        Back in the day when Microsoft was advertising Windows NT 3.51 was C2-certified, we looked into the docs and one of the requirements on whatever PS/2 it was that was certified was that the floppy disk drive be removed. And off the network.

        The thing here is Manning brought a RW cd inside his CD player, and only then snuck it into his PC. Then, he snuck it out in his CD player. I suppose if he was smart he burned track 1 with music so he could 'prove' it was a music CD.

        The problem here is that a random private in Iraq had access to State Department cables from (e.g.) Honduras. Need-to-know-basis isn't a new idea, this was a major FU by the governing security body.

        • Exactly. The fact that there are supposedly MILLIONS of people with access to this network is the real problem. If it is really too much trouble to have any kind of need to know mechanism on this data it's time for a major review of what actually needs to be classified. The reality is that if the system hadn't been wide open to anyone with a need for any part of it this never would have happened.
        • by spitzak (4019)

          Is it possible nowadays to get a read-only CD/DVD drive? It would seem that would solve this problem pretty well.

          However I don't think I have seen a read-only drive in a long time...

        • Why does the SIPRNET client allow full export of data? The problem lies here, does it not? I'm presuming here that Manning did not use some kind of screen scrape technique. As an intelligence analyst it doesn't follow that he would have low-level access to the database.
          • Re: (Score:3, Informative)

            by Anonymous Coward
            SIPRnet doesn't have a client, per se, as it uses normal internet tools and programs over a secure /network/. We use IE 7/8 most of the time on Windows Vista in the Army, as we just fielded it (Vista) last year. I suppose we'll be getting 7 about 4 years after 8 is released...

            SIPRnet is US Federal Agency wide. It isn't limited to any one organization, and they each have their own policies on who gets to use it, how they use it, what systems are allowed access, and what software is allowed on those syst
        • by Facegarden (967477) on Friday December 10, 2010 @10:47PM (#34520892)

          ...The problem here is that a random private in Iraq had access to State Department cables from (e.g.) Honduras. Need-to-know-basis isn't a new idea, this was a major FU by the governing security body.

          Apparently the reason they did that was that the 9/11 commission said it was *too much* secrecy that left us unable to prevent 9/11. They said that if more people had seen all the little signs, it would have been more likely that someone spoke up. So then the military responded by allowing more people in the military access to that information.

          The real problem is that we keep doing a bunch of secret shit in private, and then tell the public "don't worry, everything is fine, the war is going great, things are totally cool." The public knows they were getting smoke blown up their ass, and they wanted the truth. So, they found it. The military is creating a market for the truth by keeping it from us.

          In this day and age, if you deprive people of information, they're only going to want it more. The whole method of "damage control" that the US govt has been doing in the middle east is just flat out ineffective. I really wish they would just tell us the fucking truth. Then there'd be nothing interesting in these cables, and a lot fewer people would get away with fucked up behavior.
          -Taylor

        • I agree that a major part of the problem is a "need-to-know" issue. However, I don't think the army will publicize its steps on that issue. Just because they told us what the new regulations regarding removable storage are, doesn't mean they didn't set up new/refreshed procedures in other areas.

    • Re:Nothing to see... (Score:5, Informative)

      by fluffy99 (870997) on Friday December 10, 2010 @08:27PM (#34520052)

      This applies to SIPRNET machines, and specifically personal CDs, DVD, etc. The thing is, this has always been the rule. At least everywhere I've worked with SIPRNET access (Air Force).

      Close. It applies to SIPRNET and ALL removable media. If you have a legitimate requirement to use removable media it now must be authorized by your commanding officer in writing and you must have a procedure in place that uses two-person integrity.

      • Well, yes. I pretty much thought that went without saying when I said "specifically personal..."

        An example would be Tactics Laptops that flyers carry on missions - these replaced giant binders, the info of which comes off of SIPRNET and is now on CDs.
      • The two-person "trusted download" has also been in place for years.

      • Bottom line is that you need to have people you trust accessing your systems, and if you can't guarantee that (which you probably can't), then you need warm bodies looking over their shoulders, etc etc. Sucks, but if you're that serious about data security, then you've got to make the effort to prevent these low-hanging fruit attacks that are possible now that a gigabyte is the size of your thumbnail and not the size of a filing cabinet.
    • Except, of course, my USB stick is masquerading as a wireless USB mouse receiver, complete with a fully testable mouse functionality, but not by default. Only if I press some of the mouse keys in a right combo and then it sprouts a 16GB flash storage device. Another combo click and its back to mere mousing...

      And so on, etc and the like.

      Unless they ban all USB devices, all BlueTooth devices, all WiFi devices and pretty much go to Fallout-style green-screen VT100 revival terminals...

      • Unless they ban all USB devices...

        All USB devices were banned on both NIPRNET and SIPRNET earlier this year. WiFi and Blue-Tooth have certainly never been used with SIPRNET.

        • And so we will move onto one of these [newegg.com], a camera in my watch or Van Eck phreaking gizmo in my shoe (with all due respect to Mr. Smart) and so on ....

          I assume they did not strip everyone naked and checked their cavities and recent surgery marks...

      • All they need to do is install software that will alert security personel if a USB mass storage device is registered. Physical appearance does not play into it.

      • No, some simple settings in the security policy that only authorized sys admins can change and it doesn't matter if your USB stick can sprout wings, the system will not allow it. In fact, plugging it in will probably trigger a security event that will get you fired, court marshalled or jailed.
        • And so instead I will use one of the many other no-physical-hardware-contact methods available to me...

          Unless you disconnect that computer from that SIPRNET thing entirely and make sure that it has no classified data on its HDD, you are pretty much screwed if it comes to stopping skilled people from getting stuff out of it.

    • Re:Nothing to see... (Score:5, Interesting)

      by gatkinso (15975) on Friday December 10, 2010 @08:57PM (#34520282)

      Years ago we filled the USB ports of SIPRnet nodes at our site with crazy glue.

      • You'd also better prevent your users from plugging in devices onto the wired and wireless network.

        And disable bluetooth.

        The user could also open the case up and plug in a hard drive.

        Well, you'll never plug all the holes.

        • by gatkinso (15975)

          It seems as if you have never worked in an accredited environment.

          An AIS (computer) that hosts classified information cannot have wireless capability. No wireless NIC, No bluetooth. Yes they issue waivers for this all the time, which is stupid. In that case the wireless device is to be physically shorted out (which many people don't do they simply disable in the BIOS which is also stupid).

          Yes you could crack the case and get at the hard drive (which is also marked classified), good luck doing that unnot

  • by www.sorehands.com (142825) on Friday December 10, 2010 @08:18PM (#34519942) Homepage

    It is really hard to ban removable media given that you can attach a phone and it becomes a USB drive.

    Using Windows Terminal Server, or Aqua Connect [aquaconnect.net] on the Mac
    you can prevent anyone from using a USB device, as the data will be on a server, presumably locked away from users.

    • Phones aren't allowed in secured areas that contain SIPR computers.

      Neither are any other electronics.
    • Concealing USB mass storage devices is trivial. They come in virtually any shapes and sizes(at the small end, limited largely by the smallest thing that falls reasonably close to the spec for a USB connector) and not too infrequently bundled with other devices(ie. "powerpoint presenter" widget that has an RF remote that is also a flash drive to store the presentation, various novelty crap, etc.) Further, all sorts of common, innocuous devices act as USB MSC devices when plugged in.

      Using them covertly is
    • by nurb432 (527695)

      Don't need Terminal Services.. you can disable USB via GPO or other remote means ( or even something simple like removing drivers and not giving anyone admin access to reinstall them ). Hell if you really want to be sure, just remove the USB chip by force and lock the case.

    • How is it hard to ban cell phones? No secure area that I am aware of has allowed cell phones, blackberries, or even two-way pagers, for years. Same with personally-owned devices of any kind, even to the point of pre-recorded CDs.

      • And that works fine for law-abiding folks who take their responsibility to keep the data in. But I bet you even one of them forgot to take his phone out of his pocket before walking through the magic door. Imaging if the forgetting was intentional.
  • And these are the people that we set loose with big guns, exploding doohickeys, and nukes.

    Of course the logical progression is to ban the use of cameras, photocopiers, cel phones, paper, pencils, and people with photographic memories.
    • by blair1q (305137)

      And these are the people that we set loose with big guns, exploding doohickeys, and nukes.

      Who? Slashdotters who read a headline and start posting as if they know all the details? Slashdot summary writers who type so fast they forget to read TFA themselves? Journalists who misquote and misread their own notes if they bother to take any if they bother to ask any questions?

      The logical progression is to learn something before posting, because the people who can order use of the big guns, exploding doohickeys, and nukes actually had these policies in place, and the people at the other end responsible

  • by CohibaVancouver (864662) on Friday December 10, 2010 @08:22PM (#34519990)
    It's used to be the case that some companies would squirt epoxy into the USB ports on devices - Doesn't really work any more as many devices no longer have PS2 mouse and keyboard ports.
    • by hedwards (940851)
      You can squirt epoxy in the front ones, and then use an enclosure that keeps the fingers away from the back ones without the right key, and probably some sort of tamper proof sticker to make it that much harder to do without being caught.

      But really, as soon as you allow physical contact you've blown security, this stuff is about making it as inconvenient as possible for an authorized party to be up to no good with console access.
      • Thin client + terminal server would work (linux or windows) then disable remote clipboard via policy... won't matter if the terminal has usb ports... at least not as much.
    • Just take out the drivers for USB drives, and don't install burners or floppies.
    • by blair1q (305137)

      so epoxy the mouse and keyboard connectors into the usb ports and just gum up the rest

    • by DrSlinky (710703)

      It's used to be the case that some companies would squirt epoxy into the USB ports on devices - Doesn't really work any more as many devices no longer have PS2 mouse and keyboard ports.

      Um, dude... That stuff may have been sticky, but it sure wasn't epoxy!

  • by Quiet_Desperation (858215) on Friday December 10, 2010 @08:45PM (#34520186)

    I've worked in classified areas in aerospace, and USBs have been disabled since the first USB equipped PCs showed up. In then early days I think they actually removed the USB interface chip. Now it's disabled in software.

  • So the leakers will now have to rely on plain old memorization, or print shit out. The only real way to prevent leaks is by monitoring access and severely punishing people for leaking. This leak only happened because the leaker all but knew he was impossible to catch. In fact, he was only caught because he bragged about it and someone turned him in.

  • by Opportunist (166417) on Friday December 10, 2010 @08:49PM (#34520208)

    Here's a little story from back when I was the "IT security guy" (they didn't want to shell out the wage for a CISO, I guess) of a large, very security conscious company.

    Of course, no machine had USB ports or CD drives (not that CD drives could have allowed any software to leave the machine, but hey), nothing you could plug on parallel ports or serial ones, no floppy drives, no nothing. No way to plug anything into those machines that could remotely be used to transfer any data out of them.

    But of course, some people are more important than others, and some people have privileges. Needed or not. One department head needed to be able to use USB drives. It was actually a fairly level headed person and he was quite security conscious, was aware of the risks and able to handle it, and given enough pressure on the CEO he was finally allowed to use USB drives. This was actually still a fairly acceptable move. It was necessary for him and did increase his ability to work well and efficiently, and he could handle the additional responsibility and the risk was manageable and low enough to be acceptable.

    But then the invariable laws of the office privilege and status bullshittery set in. Because it is impossible that Department Head A gets something and Dufus B doesn't. I guess it's not hard to guess what happened next. Of course, all managers on this level had to be allowed to use USB drives, need them or not. And this was NOT acceptable anymore. Some of them were too dumb to actually plug an USB drive into their machine without causing a repair incident. But they had to get it, need it or not, but it's simply impossible that one of them gets a privilege and the others don't.

    So do not fear, people. Sooner or later this rule will be softened up and erode away because some people will have to have "privileges". Without being able to handle them.

    • But then the invariable laws of the office privilege and status bullshittery set in. Because it is impossible that Department Head A gets something and Dufus B doesn't.

      The whole concept of, "If I make an exception to the rules for you, I will have to do it for everyone" is such bullshit - both as an excuse not to make an exception and as a justification to do it for everyone else. Management like that might as well be replaced by a robot for all the value they add.

      • by H0p313ss (811249)

        But then the invariable laws of the office privilege and status bullshittery set in. Because it is impossible that Department Head A gets something and Dufus B doesn't.

        The whole concept of, "If I make an exception to the rules for you, I will have to do it for everyone" is such bullshit - both as an excuse not to make an exception and as a justification to do it for everyone else. Management like that might as well be replaced by a robot for all the value they add.

        You have clearly never been a manager.

    • The other possibility is that the whole institution will become increasingly paralyzed and unable to accomplish anything. Unlike a company, the armed forces can't actually go bankrupt. The USB ban and similar issues are already a problem for the Air Force.

  • Bit of an honest question really.

    If I log onto my online email, its an ssh site. So what's there to stop me shoving the stuff in an encrypted and compressed file - and then sending it as an email. If they're sniffing the packets they'll only get garbage. If I create an email address just for this - its pretty hard to trace I would expect.

    Hell, doesn't even need to be email (although its the simplest way to cover tracks) - what's to stop me sending it over any sort of encrypted network?
    • If I log onto my online email, its an ssh site. So what's there to stop me shoving the stuff in an encrypted and compressed file - and then sending it as an email.

      You can't log into your online email from a SIPRNET machine.

      • by Haedrian (1676506)
        Is that the only reason?

        Because there are a number of companies which let you log onto your online email - and have the same "You can't use USB" blocks.
    • by santax (1541065)
      Just take a picture with the cam in your phone. And take that out the door. It's a tested method and it works.
  • Has there ever been an explanation of what all the diplomatic traffic was doing going through the pentagon? Wouldn't separate channels, and perhaps distinct cryptology, whose individual security is checked and tested by the NSA be more secure in any-case?
    • Has there ever been an explanation of what all the diplomatic traffic was doing going through the pentagon? Wouldn't separate channels, and perhaps distinct cryptology, whose individual security is checked and tested by the NSA be more secure in any-case?

      In the aftermath of 9/11, lack of information sharing was cited as a critical flaw that allowed the attacks to happen. So they responded with information oversharing...

  • by hawguy (1600213) on Friday December 10, 2010 @09:47PM (#34520574)

    It's great that they finally figured out that letting employees write secret data to a storage device is a security risk, but are they also auditing outbound communication? Will they notice if an employee emails the data to his Gmail account? Or deposits it on some hacked server somewhere? Will they notice it if he uses steganography to hide it in other data?

    Or maybe he'll use a program that converts the data to visible data that can be recorded by a camera (sure sure, cameras are against regulations, but stealing data is against regulations too...if he's a determined data thief, cameras can be hidden in all sorts of objects and body cavities). For example, a QR code can hold 4KB of alphanumeric data. If someone writes a program that displays 15 frames/second of QR encoded data and records it with a camera, that's 200MB of data every hour.

    If he's patient, he can record it as a 2400 baud data stream and record it on his MP3 player - he can steal around 10MB/hour using this method.

    Or maybe he can record it as a bit patter on a laser printer - if he can write at 100dpi reliably, thats around 100KB per piece of paper. If that can be stretched to 500dpi he'll get around 2MB per piece of paper, and will look like a grey piece of paper to the naked eye so security won't pay any attention "Oh that, it's scrap paper I'm taking home to my kids".

    How will he get such a data theft program onto the computer? Simple -- if he can't download it off the internet (perhaps a "gif" that just needs the first 128 bytes stripped off to make it an executable), he can plug in a USB keyboard dongle that acts as a keyboard and then let it type in the program for him.

    How secure *is* our secret data? Hopefully banning USB drives is just one layer and they are taking greater steps to securing who has access to such data.

  • Am I missing something?

    Now I realize there are probably many different configurations for workstations and such, but why is THIS not the point at which leaks are stopped?

    Order and implement workstations/terminals/laptops that simply do not have CD/DVD drives OR USB DRIVE PORTS installed. You know, no ports or drives to plug anything into? Short of photographing the image on a monitor, doesn't this pretty much rule out digital transfer of data?

    I've seen pictures online (some random image pack on Cryptome, me

  • by kawabago (551139) on Friday December 10, 2010 @10:05PM (#34520682)
    The military slaughtered innocent people and covered it up. That was the reason for the leak, to shine a light on wrong doing. To prevent a future leak the military should also own up to it's mistakes and not cover up innocent accidental deaths in future. That would do more to prevent future leaks than any amount of security.
  • by Swampash (1131503) on Friday December 10, 2010 @10:36PM (#34520842)
    This action by the US Government is a clear win for Wikileaks. It is EXACTLY what Wikileaks intends for its targets to do. Wikileaks's clear publicly-stated goal is for secretive corporate and government "conspiracies" to react to leaking by restricting internal communications. http://zunguzungu.wordpress.com/2010/11/29/julian-assange-and-the-computer-conspiracy-%E2%80%9Cto-destroy-this-invisible-government%E2%80%9D/ [wordpress.com]
  • Just under 1300 cables have been published; all 250,000 have most definitely NOT been published. They're being released in dribs and drabs. Source: http://213.251.145.96/cablegate.html [213.251.145.96]
  • by Anonymous Coward on Friday December 10, 2010 @11:17PM (#34521044)

    I worked in a defense contractor in 1989. Even back then we were forbidden to:
    - bring a camera to work.
    - have floppy drives working on any computer
    - have printers connected to any PC - printouts had to be sent to a special room.
    - use any kind of portable media (parallel port tape drives, etc).
    Of course, all our systems were on a private network - no internet access at all. Part of my job was to introduce software and tools into the network when formally requested - lots of paperwork. That's how compilers and 3rd party libraries were brought inside.

    IBM made desktops with locked sliders to prevent access to the floppy drives. I'd be shocked if those weren't still manufactured.

    Anyway - this has been solved, just forgotten.

    BTW, have you ever wondered why at least 1 Blackberry didn't have a camera? DoD users.

  • Hmph (Score:4, Interesting)

    by Greyfox (87712) on Saturday December 11, 2010 @01:40AM (#34521564) Homepage Journal
    When I was working back at Data General doing auditing of their C standard library for B2 rating documentation, the discussion of covert channels revolved around things like having an application consume more or less CPU time in order to signal applications in the non-secure domain that might be watching. There was also a nifty one about forging the return address on ICMP packets in such a way that you could send the packets to random addresses on the network and all the bounced returns would end up at a single machine.

    But yeah, banning removable media is also good...

After an instrument has been assembled, extra components will be found on the bench.

Working...