Lawmakers From The Great Theocracy Of Utah Looking To Block Porn On Cell Phones

from the pron dept

When we've talked in the past about government attempting to outright block pornography sites, those efforts have typically been aimed at sites hosting child pornography. Blocking child porn is a goal that's impossible to rebel against, though the methods for achieving it are another matter entirely. Too often, these attempts task ISPs and mobile operators with the job of keeping this material out of the public eye, which is equal parts burdensome, difficult to do, and rife with collateral damage. Other nations, on the other hand, have gone to some lengths to outright block pornography in general, such as in Pakistan for religious reasons, or in the UK for save-the-children reasons. If the attempts to block child porn resulted in some collateral damage, the attempts to outright censor porn from the internet resulted in a deluge of such collateral damage. For this reason, and because we have that pesky First Amendment in America, these kinds of efforts attempted by the states have run into the problem of being unconstitutional in the past.

But, as they say, if at first you don't succeed, just try it in an even more conservatively prudish state again. Which brings us to Utah, where state Senator Todd Weiler is leading the effort to purge his state of any access to porn on mobile devices.

Utah Senator Todd Weiler has proposed a bill to rid the state of porn by adding Internet filters and anti-porn software on all cell phones and requiring citizens to opt-in before viewing porn online. It's to save the children, he says. Weiler successfully pushed an anti-porn resolution through the state Senate earlier this year, declaring porn a "public health crisis." He now hopes to take his movement a step further by making it harder for Utah citizens to have access to digital porn.

"A cell phone is basically a vending machine for pornography," Weiler told TechCrunch, using the example of cigarettes sold in vending machines and easily accessed by children decades ago.

This is where we'd usually talk about how this sort of thing is almost certainly unconstitutional, not to mention how easily circumvented the attempt would be. And both of those remain true for this case. But I would like to instead focus on the lazy analogies Weiler chooses to make and let them serve as an example of how easily twisted people's opinions can become if you simply add "saving the children" to the goals of a particular piece of legislation.

Let's start with the quote above, although I promise you there is more from Senator Weiler that we'll discuss. He claims that a cell phone is basically a porno vending machine, like a cigarette vending machine. The only problem with his analogy is how wildly untrue it is. A cigarette vending machine has no other purpose than, you know, vending smokes. A cell phone, on the other hand, has a few other purposes. Like playing video games, for instance. Or serving as a music device. Or making god damned phone calls. A claim that a phone is simply a vending machine for porn shows either a tragic misunderstanding of basic technology or, more likely, is simply a veiled hate-bomb at the internet itself. Regardless, it is not upon government to decide how our property is used lawfully. And it isn't on government to parent children. We have people for that. They're called parents.

But Weiler wasn't done.

The senator says England was successful in blocking porn on the Internet. Prime Minister David Cameron pushed legislation through in 2013 requiring U.K. Internet service providers to give citizen's the option to filter out porn.

The good Senator must have a strange definition for success, because the UK law is easily circumvented, has managed to censor all kinds of educational and informational non-pornography sites and material, and was created by a lovely chap who was later arrested on charges of child pornography himself. If one wishes to draw upon the success of something in order to push his own interests, that something probably shouldn't be a complete dumpster fire.

Local Utah ISPs are already calling the plan unrealistic and comparing it to censorious governments that I am certain Senator Weiler would recoil from. Not that this matters, I guess, since Senator Weiler fantastically admits that he has no idea how this will all work under his law.

Weiler says he doesn't know how it would work but just wants to put the idea out there and that his main concern is kids looking at porn.

"The average age of first exposure to hard-core pornography for boys is eleven years old," he said. "I'm not talking about seeing a naked woman. I'm talking about three men gang-raping a woman and pulling her hair and spitting on her face. I don't think that's the type of sex ed we want our kids to have."

Look, I usually like to back up my rebuttals to these types of things with facts and figures, but I just don't have them in this case. That isn't going to stop me from declaring that the average first exposure to pornography is an eleven year old boy seeing exactly three men gang-raping a woman is a line of bullshit so deep that the Utah Senate certainly must provision knee-high boots to its membership for such a thing to even be suggested. And this should tell you everything you need to know about Senator Weiler's plans: he doesn't know how successful it's been elsewhere, he doesn't know how it works, and he's willing to sell it to the public on the basis of a scary lie.

Oh, and it's unconstitutional, so screw your law altogether.

Filed Under: government, mobile phones, porn, porn filters, porn license, todd weiler, utah

DHS Claims Open Source Software Is Like Giving The Mafia A Copy Of FBI Code; Hastily Walks Back Statement

from the psst...-your-ignorance-is-showing dept

Late last week, the DHS's Chief Information Officer Luke McCormack (or someone from his office) posted comments to GitHub arguing against the proposed policy of making 20% of its code (whatever that means) open source in the interest of better sharing between agencies. The rationale is that shared code could save tax dollars by preventing paying developers to perform redundant work. The DHS felt strongly about this and said as much using an Excel-based parade of horrors.

Many private companies (especially security companies) do not publish their source code is because it allows attackers to (a) construct highly targeted attacks against the software, or (b) build-in malware directly into the source code, compile, then replace key software components as 'doppelgangers' of the original. How will this be prevented? Government-specific examples: citizenship anti-fraud rules that are coded into software, identification of special codes used to flag law enforcement actions, APT threat indicator scripts, Mafia having a copy of all FBI system code, terrorist with access to air traffic control software, etc. How will this be prevented?

Contrary to the CIO's statements, open source software can actually be safer than closed source options. More eyes on the source means more people finding flaws and holes and working towards fixes, rather than simply compiling internal discoveries and forwarding them to the vendor and allowing the company to determine which holes/flaws should be repaired and in which order.

The DHS has now walked back this unfortunate comment, claiming it was just one of those mysterious things that somehow materialized out of the ether.

Those comments were "incorrectly posted" and do not represent DHS' position, agency spokesman Justin Greenberg told Nextgov in an email. McCormack's new comments "serve as the department’s official stance on the policy," the spokesman said. In his new comment, McCormack said the earlier comments reflected "a variety of individual positions across DHS components."

This explains next to nothing and leaves readers with the impression that the DHS has been publicly embarrassed by the "source code sky is falling [pending proposal approval]" emailed in by its CIO.

The DHS has a history of walking back things after they've received public criticism. This is good, but the walkbacks seem to be accompanied by obfuscatory statements that give everyone involved a pass on their misguided actions. Back in 2014, DHS component ICE started soliciting bids for a national license plate database (built from the hundreds of automatic license plate readers in use around the nation). Backlash ensued and DHS Secretary Jeh Johnson quickly issued a statement claiming the posting was done without the approval of "ICE leadership." In other words, the issuance was just a governmental glitch and the hasty retreat being beaten entirely unrelated to the public outcry.

Here, the same thing seems to be happening. The DHS CIO posts comments full of alarmism, is called out for it and a spokesperson appears on scene to say that comments released by a DHS official are not the official comments of the agency he represents. To borrow the blame-shifting parlance of law enforcement, a misguided comment "discharged" and no one should have to own up to actually pulling the trigger. Yes, mistakes were made. But apparently no government official should need to acknowledge they were just flat-out wrong.

Filed Under: dhs, government, open source

What's At Stake In Apple/FBI Fight: Who Gets To Set The Rules That Govern Your Privacy & Security

from the this-is-important dept

Lots of people, mainly those supporting the DOJ/FBI's view of the Apple fight, have been arguing that this isn't a big deal. They're just asking for one small thing. Other people have tried to examine "what's at stake" in the case, with a number of the arguments falling into the typical "privacy v. security" framing, or even something around precedents related to privacy and security. However, Jennifer Granick recently wrote a great piece that does a much better job framing what's truly at stake. It's not privacy vs. security at all, but rather who gets to set the rules over how software works in an era where software controls everything.

We live in a software-defined world. In 2000, Lawrence Lessig wrote that Code is Law — the software and hardware that comprise cyberspace are powerful regulators that can either protect or threaten liberty. A few years ago, Mark Andreessen wrote that software was eating the world, pointing to a trend that is hockey sticking today. Software is redefining everything, even national defense. But, software is written by humans. Increasingly, our reality will obey the rules encoded in software, not of Newtonian physics. Software defines what we can do and what can be done to us. It protects our privacy and ensures security, or not. Software design can be liberty-friendly or tyranny-friendly.

This battle is over who gets to control software, and thus the basic rules of the world we live in. Who will write the proverbial laws of physics in the digital world? Is it the FBI and DOJ? Is it the US Congress? Is it private industry? Or is it going to be individuals around the world making choices that will empower us to protect ourselves — for better or for worse?

That's a big question -- and it's not necessarily one that should be decided by a magistrate judge, making use of a law from the 18th century.

The big question then becomes: Are people going to be forced to live in a surveillance-friendly world? Or will the public be able to choose products — phones, computers, apps — that keep our private information, conversations, and thoughts secure?

Right now, the FBI wants to decide these questions with reference to a law that was originally passed in 1789. The All Writs Act allows courts to “issue all writs necessary or appropriate in aid of their respective jurisdictions and agreeable to the usages and principles of law.” Obviously, Congress wasn’t considering iPhone security at the time. The AWA has no internal limits and provides no guidance for courts on how to weigh individual privacy interests with corporate liberty and business interests with public safety interests. It is an utterly inappropriate vehicle for compelling forensic assistance.

And if the DOJ wins this case, it's pretty clear where this goes:

If the All Writs Act can be used in this way — to force a company to develop forensic software that the government wants to deploy in a single case of terrorism — it could be used in any number of other (currently unforeseen) circumstances.

In other words, design mandates will be next. In fact, maybe it’s already happening behind our backs. When the Snowden documents showed that Microsoft had created surveillance backdoors in Skype, Outlook.com, and Hotmail, the company issued a statement. It said:

Finally when we upgrade or update products legal obligations may in some circumstances require that we maintain the ability to provide information in response to a law enforcement or national security request. There are aspects of this debate that we wish we were able to discuss more freely. That’s why we’ve argued for additional transparency that would help everyone understand and debate these important issues.

At the Center for Internet and Society, we’ve been trying to figure out what those legal obligations are. I wonder if these AWA arguments are part of it.

To make sound policy in this space, the public needs to know what the government is forcing companies to do, the full picture. This San Bernardino case is just one salvo in the ongoing war between a surveillance-friendly world and a surveillance-resistant world. The stakes for liberty, security, and privacy — for control over our software-defined world — are high.

This is not about one phone. It's not about one case. It's not just about encryption. It's about how we work as a society and who gets to set the rules. That's kind of a big deal.

Filed Under: fbi, government, jennifer granick, people, privacy, rules, security, technology
Companies: apple

The Need For Deep Pockets And Lawyers Means The FOIA Process Benefits Corporations The Most

from the and-the-general-public-gains-nothing dept

FOIA reform is (yet) again working its way through the bowels of Congress. Unfortunatley, the FOIA process is resistant to fixing because there's very little in it for the government. Agencies are supposed to err on the side of openness and transparency, but a stack of broadly-written exemptions makes it's far too easy for them to operate in opacity.

One of the major problems with the FOIA process is that it takes a lawyer on retainer and lots of money to get the most out of it. For most FOIA filers, an agency's refusal to respond in a timely fashion or release requested information is the end of the line. Unless they're working in conjunction with a major journalistic enterprise, the FOIA ball is completely in the government's court.

Over the past few decades, this has led to only certain components of the American public being able to make the most of the FOIA process. And these entities aren't interested in dragging the government's secrets out into the open. They're more interested in acquiring information on other private entities via the government's transparency tool.

Prawfsblog, by way of Scott Greenfield, noticed something about some FOIA stats. The "people" making the most requests aren't "people" in the generally accepted use of the word.

Margaret Kwoka of Prawfsblog notes the law isn't really serving the purpose it was intended to.

The reality today, though, is that news media make up a tiny fraction of requesters – in the single digit percentages at most agencies. Journalists find the law slow in operation and the fight for access to be resource intensive. They simply don’t have the time or legal budgets to take full advantage. Nonetheless, despite the loud complaints about FOIA’s failings, the federal government now receives over 700,000 FOIA requests a year, so FOIA must be serving someone’s interests at least well enough to keep them coming back for more.

This is something that has been noted here before. FOIA requests roll in from journalists when hints are dropped (usually by anonymous government officials) about something not previously exposed. In response, government agencies quite often stonewall requesters until Issue X fades from the public eye. And there's not much any requester can do to expedite the process other than file a lawsuit -- which isn't an option for many people. Scott Greenfield points out what happens to the average (read: non-corporate) requester.

Make a FOIA request, wait your ten days, and get . . . nothing. Complain and get . . . nothing. Maybe you get a response years later. And when you do, maybe it’s responsive, or maybe it’s ten pages, fully redacted, out of 473, the rest of which is refused. Or maybe you get . . . nothing.

Somebody in the government is supposed to respond to a FOIA request. That somebody has a job to do, and it’s not responding to your FOIA request. Maybe you get notification that they would be thrilled to respond, if only you would send them $71,493.27 to cover the cost of your ten pages. And they will still get back to you when they’re good and ready, if at all.

What you gonna do about it?

The government knows this. And it likes it this way. FOIA reform is a perennial effort, but the law remains greatly unchanged. No one wants to shift too much power to the people and make the letter of the law approach the spirit of the law. But, as is the case with much of the government, it finds itself relatively powerless in the face of deep-pocketed corporate interests.

Large corporations have the staffing, money and lawyers to make the law work the way it's supposed to work. And the government is more than happy to oblige them. First off, these entities have the power to compel the government to produce requested documents. Secondly, the information being turned over to requesting corporations has very little to do with the government's secrets. As long as well-lawyered corporations are asking for little more than info on their competitors, the government is all too happy to reply to their requests.

There’s gold in government documents, and these are the documents that the government doesn’t care enough to keep private, mostly because what they reveal isn’t any of the government’s deep, dark secrets, but ours.

What's more, the information requested by these corporations goes into their private stock. It's very rarely offered up for public consumption. The government doesn't mind making its secrets someone else's secrets. But it certainly doesn't care for its secrets being made public knowledge.

The FOIA process is broken -- hopefully not irrevocably. There are moments where it works brilliantly, but mostly due to operator error on the respondent side. Things slip through that were obviously meant to be kept buried. Inconsistent redactions allow one requester to access what another couldn't, etc. But, on the whole, the "presumption of openness" urged by the administration is never going to take hold without serious reform of the existing law.

As Greenfield notes, the presumption of opacity is still in full effect, even when that opacity is patently ridiculous.

As of this date, the FOIA website still lists Eric Holder as Attorney General, even though he has been replaced by Loretta Lynch. When Holder’s resignation was announced, the Office of Information Policy made a FOIA request for the identity of the new Attorney General, so they could correct their FAQs. They are still awaiting a response.

Filed Under: deep pockets, foia, government, lawsuits, transparency

Government Ducking Even More FOIA Requests By Refusing To Ask For Official Legal Guidance

from the agencies-stood-together-to-ensure-OLC-stood-apart dept

The Freedom of Information Act was put into place to give us a more accountable government. The theory was that more transparency would lead to better governing. Our public servants would know their activities were open to scrutiny and might start acting like their employers were watching over their shoulders.

Instead, our public servants focused their time and effort on finding creative ways to hide the same stuff they're obligated by law to reliquish. Instead of a better governing, we got private email servers, excessively-abused FOIA exemptions, revamped records retention policies and the erection of massive paywalls when all else failed.

This instinct to dodge, rather than deliver, bleeds into every agency in the federal government. The fear of FOIA requests has led agencies to avoid committing anything to paper -- either of the dead tree variety or composed of pixels and residing in an FOIA-able digital inbox. This includes the sort of thing that one would assume government agencies would want in writing: official legal opinions on agencies' programs and activities.

Concerns about legal opinions being made public under the Freedom of Information Act are leading various parts of the federal government to stop asking for written advice from the Justice Department's Office of Legal Counsel, a top Obama administration lawyer said Thursday.

"I think that has served as a deterrent to some in terms of coming to the office to ask for a formal opinion," said Central Intelligence Agency General Counsel Caroline Krass, who spent more than a decade at the Justice Department office that issues legal advice for the executive branch.

So, we have an Office of Legal Counsel that's been reduced to issuing verbal blessings for government activities. Not only does this keep the government's official legal justifications secret, but it prevents a) FOIA requesters from obtaining a copy and b) the legal opinion being used against the government in litigation. Josh Gerstein's article for Politico notes the number of official OLC opinions has declined steeply over the last several years, with the total number released over the last three years (29) barely topping 2009's release total (28).

The OLC admits it is issuing far fewer formal opinions. At the same time, it claims its secret opinions, delivered orally or via email, are just as binding. That may be great news for those with inside access, but for everyone else, it's just another door being slammed in their face.

But there's another reason the OLC is offering fewer formal opinions: the administration -- along with several other government agencies -- feel they're better served by working around this independent office. From Jack Goldsmith -- former Assistant Attorney General and member of the Office of Legal Counsel -- writing for the Lawfare blog:

Many people who would know have told me that OLC’s advice is now sought much less than in the past, especially in national security decisions. A few people have told me that OLC simply has no place at the table in important national security decisions.

[...]

I know from first and second-hand conversations that some important lawyers in the Obama administration came to Office thinking that OLC had too much sway in prior administrations.   And then the sky did not fall when Attorney General Holder, early in the administration, reportedly overruled an OLC opinion on the unconstitutionality of a D.C. voting rights bill after the Acting Solicitor General advised him he could defend the law in court.

The guidance of independent legal counsel could also result in better governing. But it's not going to change anything if many of the most powerful people in Washington consider its opinions to be liabilities, at best. The OLC obviously doesn't have any pull -- at least not with this administration. Judging from Goldsmith's comments in his post, it appears that power was on the wane throughout much of the previous administration.

In the end, it's just another way for the federal government to cut the public out of the loop. The government seems to really like other people's money and the power that comes with the positions, but has nearly no enthusiasm for accepting the additional responsibilities that come with the territory.

Filed Under: doj, foia, government, legal guidance, olc, transparency

Familial DNA Searches May Make You Think Twice About Signing Up With Private Genetic Services

from the running-in-family dept

Using DNA found at the scene of a crime to identify the guilty party is pretty routine these days, but, as Mike discussed many years ago, police have been getting more aggressive in going much further: carrying out "familial" DNA searches on privately-held genetic databases. That link is to a recent Wired article that concerns the case of Michael Usry, who became a suspect in a 1966 1996 murder case because of his father's DNA:

Detectives had focused on Usry after running a familial DNA search, a technique that allows investigators to identify suspects who don’t have DNA in a law enforcement database but whose close relatives have had their genetic profiles cataloged. In Usry's case the crime scene DNA bore numerous similarities to that of Usry’s father, who years earlier had donated a DNA sample to a genealogy project through his Mormon church in Mississippi. That project’s database was later purchased by Ancestry, which made it publicly searchable -- a decision that didn’t take into account the possibility that cops might someday use it to hunt for genetic leads.

Using general similarities as the yardstick rather than more exact matches means that false positives are more likely -- as in this case, when Usry's own DNA proved he had nothing to do with the murder. Those similarities were only found because his father's DNA was in a privately-held genetic database that the police could access. That's unusual, but becoming more common as services like Ancestry.com and 23andMe gather many more DNA samples.

According to an article on Fusion.net, Ancestry now has over 800,000 samples, while 23andMe has a million customers (Ancestry says that a more up-to-date figure is 1.2 million members in its database). Those are significant holdings, and it's only natural that the police would try to use them to solve crimes; both companies confirm that they will turn over information from their databases to law enforcement agencies if served with a suitable court order. A more recent post on Fusion.net notes that 23andMe has produced its first transparency report (direct link, but Techdirt readers outside the US may have to use the Google cache version for reasons that are not clear.) The report shows that a total of four requests were received from the US authorities, concerning five 23andMe customers, and indicates that the company was successful in denying those requests, without giving details.

Although understandable, this kind of access is problematic for people who sign up for these services, for reasons made clear by the Usry case. The DNA that goes into the database affects not only the donor, if a rough match to crime materials is found by the police, but many close relatives whose genetic make-up is necessarily similar. As a result, it's entirely possible that completely innocent people might have to go through the traumatic experience of being a suspect just as Usry did before more precise tests ruled him out.

That's unfortunate, because it adds a complicating factor to the decision about whether to provide DNA to interesting and innovative services like Ancestry.com and 23andMe: doing so means future generations might be put at risk of erroneous police interest. The only way to prove their innocence would be to hand over their DNA to the authorities for detailed testing, which then raises the question of what happens to it afterwards.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: dna, government, law enforcement, surveillance, transparency
Companies: 23andme, ancestry.com

IRS Still Working To Complete Computer Upgrade From Windows XP To Windows 7

from the by-2020-it-will-be-2010 dept

Like many other entities (both singular and conglomerate), the IRS was reluctant to sever ties with Windows XP. Microsoft forced the issue, however, and gave everyone plenty of time to migrate to an operating system released sometime in the last ten years. Even with this head start, the IRS has yet to meet this target.

An Inspector General's report notes that the IRS is almost finishing upgrading its workstations to an operating system that's only eight years old (Windows 7). Almost.

As of May 2015, the IRS has completed most of the Windows XP workstation upgrades across the country. Approximately 1,300 workstations have yet to be located or confirmed as running the old operating system.

At this point, I'm going to do something I rarely do: cut a government agency some slack. The IRS did have plenty of workstations to upgrade -- nearly 110,000 -- so if 1,300 went "missing," it's somewhat understandable. On top of this, budget issues forced the agency to upgrade old workstations instead of replacing them with newer systems, which would have greatly sped up the process.

The IRS claims it does know where these missing 1,300 workstations are, but that the Inspector General won't listen to it. The included "Management Response" says the following:

The audit incorrectly concludes that IRS has not accounted for all XP workstations. We acknowledge there were challenges with our inventory data due to the many antiquated systems in our IT ecosystem. In spite of this, we took extraordinary steps to identify, document and upgrade every XP workstation in the IRS. On several occasions throughout the audit, the IRS provided information to the TIGTA team that clearly documented the number of workstations to be upgraded, where those workstations were located, and our strategy to complete the upgrades. Although footnoted in the report, TIGTA opted not to change their assertion that the IRS had not accounted for all XP workstations. As of this date, only 71 Windows XP workstations remain to be migrated.'

The IG's footnote tells a different story.

After the conclusion of our fieldwork, the IRS provided documentation that these workstations were located and upgraded to Windows 7, as of July 22, 2015. We were unable to verify this information.

Beyond the workstations, there's the IRS's servers, which are also running up against Microsoft's upgrade clock. This not-overly-optimistic statement by the IG suggests the IRS will be living in the (OS) past for much of the future.

Based on our discussions with management, we determined it is unlikely that the IRS will have its servers upgraded to Windows Server 2012 any time this Fiscal Year.

This is due to the fact that the IRS is still struggling to upgrade its servers to seven-year-old software.

In fact, the IRS still has not fully upgraded its servers from Windows Server 2003 to the 2008 release. Currently, the IRS has approximately 3,000 Windows servers still running the 2003 operating system. Management informed us that they have upgraded approximately 4,100 servers to the 2008 version which is already seven years old. The IRS currently has no servers running the 2012 operating system in production at this time.

Time to start reeling in the slack I cut the agency earlier. This logistical issue seems especially absurd.

The IRS also discovered nearly 6,000 applications being used by employees to do their jobs that required an assessment of each application to determine whether it would operate on Windows 7.

Unfortunately, the report doesn't provide more details on the massive amount of applications being used by the IRS. Every interlocking piece presents a new possibility for a hole or an exploitable flaw, something compounded by the use of unsupported system software.

The IRS has already seen its system exploited by scam artists, who were able to use the credentials of taxpapyers to fraudulently obtain refunds. That its "user data" (the tax records and personally-identifiable information of millions of Americans) is secured behind a patchwork of outdated software presents criminals and rival governments other opportunities for exfiltration and exploitation of taxpayer data.

Even if the IRS manages to hit its self-imposed targets for the most recent round of upgrades, support for those operating systems is also on its way out.

Despite the eventual progress made by the IRS on the Windows XP upgrade efforts, we believe the IRS provided inadequate oversight and monitoring during the early phases of this effort, starting with including it among other Microsoft product upgrades rather than making this effort its own project up to the decision made by the CTO to oversee the project himself. In addition, after taking four years to upgrade to Windows 7, the IRS is now faced with the challenge of addressing Microsoft’s announcement to end extended support for Windows 7 in January 2020.

The IRS has agreed to a majority of the Inspector General's recommendations which means… well, it probably doesn't mean much of anything. Chances are the IG will revisit this in a few years and still see the agency struggling to stay current with its operating system software. It's eight years behind on system software and seven years behind on server software, with the latter's migration less than 50% complete. The IRS doesn't have it easy, not with 110,000 workstations, 7,000 servers and -- for god knows what reason -- 6,000 applications, but unless it's willing to give this the priority it deserves, it will always be in danger of making a flawed, bulky system even more insecure.

Filed Under: computers, government, government it, irs, windows 7, windows xp

Government Accountability Offices Finds Government Still Mostly Terrible When It Comes To Cybersecurity

from the can't-even-secure-a-filing-cabinet,-apparently dept

The government has done a spectacularly terrible job at protecting sensitive personal information over the past couple of years. Since 2013, the FDA, US Postal Service, Dept. of Veterans Affairs, the IRS and the Office of Personnel Management have all given up personal information. So, it's no surprise the Government Accountability Office's latest report on information security contains little in the way of properly-secured information.

It opens with this depressing graph, showing just how many agencies flunked its information security controls assessment. Keep in mind that it only surveyed 24 agencies.

But what's most concerning about the report (which is full of concerning conclusions) is that, in an era of cyber-everything, the most common "security incidents" have nothing to do with phishing, security holes or any other cyber-related threat. They have to do with people and the mishandling of dead tree byproducts.


Non-cyber incidents are defined by the GAO as:

...a report of PII [personally-identifiable information] spillage or possible mishandling of PII that involves hard copies or printed material as opposed to digital records.

The GAO reports that security incidents have skyrocketed over the past eight years, from 5,500 in 2006 to nearly 70,000 last year.


It also notes that incidents involving personally-identifiable information have increased steadily as well.

[T]he number of information security incidents involving PII reported by federal agencies has more than doubled in recent years, from 10,481 in 2009 to 27,624 in 2014.

It all adds up to something fairly disturbing. Not only are government agencies increasingly under attack from outside forces, but their internal handling of hard-copy PII is getting worse as well -- even if the percentage of non-cyber incidents has declined over the past five years.

And despite the government's increased focus on all things cyber, the first chart makes it clear there has been almost no improvement in information security controls since 2013.

It also appears as though there's only one agency taking the GAO's past recommendations seriously: the Department of Defense.

OMB established a fiscal year 2014 target of 75 percent implementation for strong authentication. In its report on fiscal year 2014 FISMA implementation, OMB indicated that the 24 federal agencies covered by the CFO Act had achieved a combined 72 percent implementation of these requirements, but this number dropped to only 41 percent implementation for the 23 civilian agencies when excluding DOD.

Obviously, overhauling security controls in a large number of agencies is an enormous undertaking. But this low level of implementation is both frightening and pathetic. The government demands large amounts of personal information from citizens, as well as from its employees and job applicants. There's no opting out. Then it takes this information and provides only the most perfunctory of protections. Government agencies clearly can't be trusted with securing this information, but there's no option other than to submit and hope for the best. It's even more disheartening when you realize that some of these directives that still haven't been fully complied with have been in place since 2002.

The government asks for too much and provides too little in return. Multiple agencies want to be the "ground force" in the cyberwar. But until the homefront is secured, it seems unwise to deploy elsewhere.

Filed Under: cybersecurity, dod, gao, government, nsa

Army Officials Withheld FOIA Documents To Push Out Its Spin On Head Injuries

from the information-wants-to-be-subservient dept

The Freedom of Information Act does open up the government to closer examination by taxpayers. The ideals of the law are rarely achieved, though. It requires agencies to respond in a reasonable amount of time, but far too often it takes a successful lawsuit to force an agency to give up the documents requested.

FOIA requesters are at the mercy of government agencies. If an agency wishes to punish a particularly tenacious FOIA requester, it can do so by unceremoniously dumping requested documents into the public domain, robbing him of any exclusivity. If an agency wants to wait until media heat dies before releasing incriminating/embarrassing documents, it can string along the requester for months or years without fear of reprisal. It's not that there aren't FOIA staffers who truly want to assist requesters, it's that there are far too many reasons agencies might want to stall the release of documents, if not withhold them altogether.

For instance, FOIAed documents can be withheld to allow government agencies to get out ahead of a negative story.

Two top Army generals recently discussed trying to kill an article in The New York Times on concussions at West Point by withholding information so the Army could encourage competing news organizations to publish a more favorable story, according to an Army document.

[...]

During a Sept. 16 meeting at the Pentagon, the Army surgeon general, Lt. Gen. Patricia D. Horoho, recommended to the superintendent at West Point, Lt. Gen. Robert L. Caslen Jr., that the Army delay responding to The Times’s request, according to the document. General Horoho then suggested trying to get The Wall Street Journal or USA Today to publish an article about a more favorable Army study on concussions.

“I recommend you let us publish this article BEFORE you release the FOIA to the NYT reporter,” General Horoho is quoted as saying in the summary, using an acronym for the Freedom of Information Act.

There's not much out there that's uglier than the government burying facts to control a narrative. And, of course, we'd know nothing about it if it weren't for another FOIA request. The biggest problem with how the Army handled this is that the FOIA side of agencies is supposed to be wholly divorced from its other goals. It should be a politically-agnostic process, with the only considerations being whether or not the requested information can actually be requested. The point of the law is to make the government accountable to the public. The process is never supposed to be subservient to the political/PR desires of government officials.

And yet it is. The officials quoted in the released document are claiming the things they said don't represent the things they meant.

Both generals acknowledged the authenticity of the summary, but said it misrepresented their discussion.

Well, OK then. But accountability is better served by putting the incriminating information in the public's hands and dealing with the consequences, not burying it until after the advance force spin team has had a chance to work its narrative magic.

Filed Under: army, foia, government, journalism, politics, transparency, withholding