Military Secrets for Sale on Stolen USB Drives

nTrfAce writes "Per a BBC Article, "US forces in Afghanistan are checking reports that stolen computer hardware containing military secrets is being sold at a market beside a big US base. Shopkeepers at a market next to Bagram base, outside Kabul, have been selling memory drives stolen from the facility, the Los Angeles Times newspaper says.""

Re:Strong encryption

[Saven Marek]

> I hope that those soldiers were using strong encryption for file systems.

Remember encryption isn't the be all and the end all. What happens when you lose your own keys?

And keys on a laptop itself, well that's all portable too. Laptop + usb key means nothing since you have to carry the encryption keys with you. Without doing that your data is useless, and carrying them with you means when the laptop is stolen, you have the key stolen with it.

Instant access to your data. If they have your key they also can unencrypt anything else of yours, so you have not just lost the USB drive but more than that. How much do you think an encryption for sale on the black market is?

Let me tell you it ain't cheap so there's profit to be made. Where there is profit there is motive. By using encryption you are adding additional motive to the thieves.

So why use the problems with encryption without the benefit? It doesn't make sense. Kapsky and Dilinger's 1999 paper addressed this issue on when widespread use of portable computing was just beginning.

More details in the original LA Times article

[rchatterjee]

The BBC article is based on a LA Times article which contains more details like the fact that on the thumb drives they found a list of soldier's SSNs which which they were able to track down the soldier's home addresses.

Original LA Times article [latimes.com]

Re:Why?

[blowdart]

Once upon a time it could force that it is not done.

Whilst not as fine grained as you are talking about you can completly disable USB drives, at least on Windows 2000, XP and Windows 2003 by tweaking file system permissions or the registry. Microsoft even detail it in a knowledge base article [microsoft.com] and it can be enforced by a domain policy if you're running AD.

Re:Why?

[Fred_A]

You can do so in any Unix by not putting the users in the usb group and setting the permissions accordingly.

Or by not enabling the usb-storage driver.

Re:Strong encryption

[snoozebutton]

By reading as many differing sources as possible, and making your own conclusions.