Military Secrets for Sale on Stolen USB Drives 225
nTrfAce writes "Per a BBC Article, "US forces in Afghanistan are checking reports that stolen computer hardware containing military secrets is being sold at a market beside a big US base.
Shopkeepers at a market next to Bagram base, outside Kabul, have been selling memory drives stolen from the facility, the Los Angeles Times newspaper says.""
Strong encryption (Score:4, Insightful)
I hope that those soldiers were not storing sensible data on those drives.
I hope that those soldiers were not storing weird photos involving prisoners
Real world tends to be different from hopes!
Re:Strong encryption (Score:5, Insightful)
If soldiers have been abusing prisoners, I'd prefer them to photograph themselves doing it and then store those photographs on disks which are later stolen and leaked to the press.
Otherwise, how will we ever know what our armed representatives abroad are doing in our names?
Re:Strong encryption (Score:4, Funny)
But shouldn't soliders have the right to strip prisioners naked and photgraph their anuses, without fear of government surveillance?
Re:Strong encryption (Score:3, Funny)
Re:Strong encryption (Score:4, Interesting)
I very much hope that I would.
I am not saying that the ends justify the means
Oh yes you are.
On the flip side (Score:2)
At least if they kept the abuse quiet, whilst it would be equally bad, I'd know we only had abusive non-redneck-retards.
Re:Strong encryption (Score:2)
Re:Strong encryption (Score:3, Insightful)
For example, would you have me read British news concerning America? Iranian? French? Libyan? German? How am I, the ignorant American, supposed to know which ones are truly impartial, and which ones are putting their Anti-/Pro-Am
Re:Strong encryption (Score:3, Informative)
Re:Strong encryption (Score:2)
It simply doesn't matter what their bias is. What matters is whether they report honestly.
Take the Wall Street Journal. I disagree very strongly with their bias, but I can't deny it's one of the best papers in the world and worth reading.
Re:Strong encryption (Score:5, Insightful)
Re:Strong encryption (Score:4, Interesting)
Re:Strong encryption (Score:2)
Re:Strong encryption (Score:2)
Try to define "sexually".
Then try to define "abused".
Those aren't hard code facts. Because sexually could mean anything from showing them pictures of nakked women to gang rape.
Abuse is also subjective... Does abuse mean calling them bad names or did they hold them down and shove electric cattle prods in their orifices.
By that statemnt we don't know what really happened... Just that some type
Re:Strong encryption (Score:2)
Does that qualify?
And, yes, according to all serious reports, that was done. They simply haven't dared to release the photos and videos yet.
Or do you think the Congressmen who have seen them and described them as "disturbing" are lying?
Re:Strong encryption (Score:2)
The rest of the culprits got off or were never charged - including those who ordered it in the first place.
Pictures of THAT would have been nice. But the media failed to print them, preferring instead to hawk government statements that were clearly lies.
Lies sell papers, too - in fact, more so than the truth.
Re:Strong encryption (Score:2)
How is the military carrying out his commands not representative of you? You don't get off that easily.
Actually... (Score:2)
Actually, the first time around they voted for the other guy. But, having had Bush as accidental president for four years, they clearly liked what they saw, and approved of his behaviour, because the second time they did vote for him.
Which is, when you think about it, fucking terrifying.
Re:Actually... (Score:2)
If they had chosen someone that vaguely represented the other half of the country, they would have won in a landslide. Instead, they tried to take advantage of the opportunity to get the person furthest in their camp elected!
To win a national election, you need to be
Re:Strong encryption (Score:2, Insightful)
I didn't, and neither did approximately half of US voters.
How is the military carrying out his commands not representative of you? You don't get off that easily.
I hope that someday you are personally blamed for the actions of your government, too, you jerk.
Re:Strong encryption (Score:3, Informative)
Remember encryption isn't the be all and the end all. What happens when you lose your own keys?
And keys on a laptop itself, well that's all portable too. Laptop + usb key means nothing since you have to carry the encryption keys with you. Without doing that your data is useless, and carrying them with you means when the laptop is stolen, you have the key stolen with it.
Instant access to your data. If they have your key they also c
Re:Strong encryption (Score:2)
And no, encryption might not be 100%, but it's still more than 0%.
(But then I couldn't exactly be able to trust someone to look after information if they can't even look after physical objects)
Re:Strong encryption (Score:2)
Darn, so all those passphrases I keep in my head get magically stolen along with the key they go with?
What kind of idiot keeps keys that can decrypt everything they own on a portable device, but doesn't make it so that you have to know a passphrase to use the key?
Well, leaving aside government users.
Quickly Wiped (Score:2)
Re:Strong encryption (Score:2)
I'm no military fan... (Score:4, Interesting)
Re:I'm no military fan... (Score:2)
Re:I'm no military fan... (Score:5, Funny)
Why? (Score:5, Insightful)
Re:Why? (Score:5, Insightful)
Re:Why? (Score:5, Insightful)
Most likely it's just sneakernet; moving files from laptop to PC etc. After transferring the files they forget to wipe the USB stick. The army will probably try to stop this by mandating it not be done. Which will work for a while till troops rotate and a new batch come in. The only real solution is to physically disable USB ports, which would be difficult with the number of legitimate USB peripherals now. Otherwise everything needs to be transparently encrypted. The military fears losing access to critical data in battle more than possible security breaches though.
Re:Why? (Score:5, Interesting)
Once upon a time it could force that it is not done. This is what levels of security above C and OSes like Trusted Solaris were all about. Not about being unhackable, but about it being impossible to copy data from a higher security container to a lower. Granted, someone with high enough security clearance and rights to declare his USB drive "secure" could have gotten past that as well, but the average PHB wannabie corporate ladder climber could not do anything about it. He could not "take work home".
This is also coming back. The slashdot crowd keeps bitching about Vista DRM being Digital Wrongs Management and being mostly promoted by pigopolists. Once again wrong. Along with AD it will allow any corporation to force a mandatory encryption policy on all the data on all media in the house at the click of a mouse. Throw in this the usage of TPM chips on all Vista ready PCs and this will make any data that a corporation wants to make unrecoverable without proper access credential on a PC really unrecoverable. All of this centrally controlled. This will also result in much faster adoption of Vista in the enterprise than people can even think off, especially for mobile devices.
This also means that if Linux is to compete for the desktop it will have to have the same features regardless of Stallmans desires. This is one thing on which Linus is absolutely right. The usage of DRM by pigopolists is a current fad which is only a minor fraction of its actual use. The real use of DRM is to enforce a security policy on data across an enterprise. Having this will be essential to the success of any OS out there in 2-3 years. Also, there is no problem with DRM being opensource. Essentially DRM is nothing but a crypto application. Same as with every good crypto - having the source should not allow one to break it.
Re:Why? (Score:2, Informative)
Whilst not as fine grained as you are talking about you can completly disable USB drives, at least on Windows 2000, XP and Windows 2003 by tweaking file system permissions or the registry. Microsoft even detail it in a knowledge base article [microsoft.com] and it can be enforced by a domain policy if you're running AD.
Re:Why? (Score:4, Informative)
Or by not enabling the usb-storage driver.
Re:Why? (Score:2)
Sounds plausible, but there's a problem in your logic. Money.
How much money is there in enterprise-level security? Now compare that with the balance sheets of the music and the film industry. Seems to me that the weight and influence of the those ind
Re:Why? (Score:2)
As much money as the music and film industry have, it doesnt hold a candle to the banking, financial services, legal services, and insurance businesses, all of which would be interested in the GP's DRM mention.
Nice try.
B
Re:Why? (Score:2)
How much money is there in enterprise-level security?
Well, as someone who makes a living in enterprise-level security -- there is an enormous amount of money in it. Most of the clients I work with consider spending $100 per year, per employee on workstation-level security a no-brainer, and are willing to spend significantly more, and that doesn't even consider the back room infrastructure, or the cost of all of the security people and the admins that implement their policies.
Now compare that with the
Yes ....an no. (Score:2)
I consider that a Good Thing (tm).
They wouldn't have to. That's why they have IT depart
Re:Why? (Score:2)
Personally, I don't want TPM. It allows my computer to be uniquely identified down to the hardware. It's the same reason that people were so upset over the privacy implications of the Pentium III CPU serial number. The whole DRM nonsense that is destroying technology today is ridiculous. It's like y
Re:Why? (Score:2)
Easy solution to this - pass a law that states that anybody who buys or rents hardware is required to be given a human-readable list of all keys
Re:Why? (Score:2, Interesting)
At least this way, no president needs to leak [nysun.com] anything himself
Re:Why? (Score:3, Insightful)
Re:Why? (Score:2)
Why the hell is the military storing sensitive data on USB drives, which are prone to both theft and failure?
More importantly, why is the sensitive data not encrypted? You'd expect that people handling sensitive information receive some sort of training in how to handle that inofmration.
Alas, similar things have been happening in the Netherlands during the last couple of years: a public prosecutor throwing his PC with unencrypted info about criminal cases in the trash, a USB stick with sensitive mili
Re:Why? (Score:2)
As mentioned before, they tend to be used for things like sneaker nets, where bandwidth requirements of the data inside (G2/Int) would simply bog down the communications network. This is especially critical yo
Re:Why? (Score:2)
But a $10 USB drive can hold a soldier's email from home, some music to share with their friends, their transfer orders, a map of the local area's targets for the next day
Re:Why? (Score:2)
No it bloody doesn't... once classified data has been processed on the PC (whether it was on a USB disk or not) that PC is classed as classified itself. That's because temporary files get stored on the local hard disk... that's why machines used to process secret data have to have their hard d
Re:Why? (Score:2)
Er, what? How exactly did you jump from seeing that it had storage, to deciding that it co
Re:Why? (Score:2)
why/when. (Score:5, Insightful)
Here in the Netherlands, there has been a series of cases where sensitive information has leaked through stolen/lost hardware, and every time some official was breaking the rules.
The rules were unworkable: DO NOT TAKE YOUR WORK HOME.
So, no reading of a report on the train, no after-dinner report writing. Nothing. Ambitious people break the rules to perform better. So they take stuff home anyway. As long as the hardware doesn't get stolen, nothing is noticed. Big publicity when sensitive information makes it to the press.
But if they were to start policing the policy, a lot of the ambitious people would eventually give in to the rules, and simply watch tv after dinner, and read the newspaper on the train. Results? Productivity drop.
Re:why/when. (Score:3, Interesting)
I remember a case at a client in which we had to mail a very sensitive, very important document very quickly.
Turned out we couldn't mail it using the clients own mailsystem, as... it didn't allow Word-attachments (or Zip or
In the end we ended up taking the document on a floppy (yes, this was some years ago), to a 'learning centre' computer which was attached to the internet, and w
Re:why/when. (Score:2, Interesting)
Long time ago we had to transfer some sensitive data between two military bases. The data was saved to a floppy (8" floppy at that), put in sealed envelope, in the locked suitcase chained to the carriers wrist, into APC, to the airport, helicopter, APC, and straight to us. The whole nine yards.
And then we found that the caporal on the other end found it bizzare that there was something shuffling in the envelope, and to secu
Re:why/when. (Score:3, Funny)
Security thru immobilization!
Re:why/when. (Score:2)
Similar issues in the UK (Score:2, Funny)
Re:why/when. (Score:5, Insightful)
I personally disagree, in my experience you actually in the longer term get a productivity increase. Why ? because the people are more relaxed and more refreshed with a balanced lifestyle that isn't all "work work work". People who constantly take work home are marters to the job or just really bad at planning.
Re:why/when. (Score:2)
Re:why/when. (Score:2)
BUT, if the extra time is constrained by the same factors as the normal day, there will be no productivity gain.
The same is true for manual/trade labor - you only get a week's worth of work out of people, no mat
Re:why/when. (Score:3, Funny)
When he finally got approved he was allowed enter as far some guard post, at which point another guy came out and talked to him through a fence. He never once saw the machine.
Re:why/when. (Score:2)
I bet this all could be avoided by enforcing proper use of strong encryption. Ok, the hardware got stolen but the thief won't break the cipher. No biggie. Otherwise, it could be easily considered tre
Re:why/when. (Score:2)
OR the combined melodrama of a cowering public that believes that 98% of government members are going to be within fatal range of a gas bomb at one time, a scenario that would obviously go undetected if it weren't for data being stolen...
No don't tell me, I wanna guess
Re:why/when. (Score:2)
That's why I didn't talk about a conventional bomb, as it would require huge amount of explosives. But several smaller containers with mustard gas in the air vents of all th
Re:why/when. (Score:2)
Re:why/when. (Score:2)
Re:why/when. (Score:3, Funny)
Re:why/when. (Score:2)
Re:why/when. (Score:4, Interesting)
If thisis only about company sensitive information, then fine. But if you're talking about military secret or confidential, then the rules are a bit different. You can't read a classified document on the way home on the train, as other people around you could see it. And unless your home was certified as a secure site, it would be illegal to have the docement there. You'd also need special paperwork to take the document out of it's original building.
I have to ask who is doing this stealing. If it's by uncleared civilians, then what are they doing in proximity to classified material? Otherwise the stealing must be done by cleared personnel, which is a whole different story of criminal intent. Something doesn't add up here.
Re:why/when. (Score:3, Interesting)
Yet another chill pill moment (Score:4, Interesting)
So it's not large scale, hyperterrorsquads selling supersensitive secret soldier material to themselves. but rather small bits of pieces, that together will probably seem as just that. small bits of pieces. It is however always unfortunate that personal and classified information is handled carelessly, but if we can't even handle this properly at home, why should it be any better in Afghanistan.
I'll give the answer right here: First, get better at handling information security at home, before you start using the technology abroad.
Don't give sensitive material to people who haven't been screened on how they handled it (I thought this was already a goal the tried to achieve)
More details in the original LA Times article (Score:5, Informative)
Original LA Times article [latimes.com]
SSNs (Score:2, Insightful)
Everybody knows your SSN. Every employer you've had, every school you've been to, everybody you've applied for credit from, every company that's provided a service like long distance to you. Also, every firm any of those organizations have contracted out their data handling to.
Fewer people know what shoe size you wear.
Re:SSNs (Score:2)
So it seems to me that people knowing your SSN isn't bad per se, it's the fact that with -just- the SSN, they can do things they really shouldn't be able to.
It's like
Re:SSNs (Score:2)
*except* on their 'self service' tills. With these you just swipe your card and walk out - no pin *or* signature required.
So if you steal a card in the UK, you know where to buy your stuff from (and they sell a fair bit of high value stuff like TVs and Mobile Phones as well).
Re:More details in the original LA Times article (Score:2)
Re:More details in the original LA Times article (Score:2)
It's a good thing those foreigners can't read English. Looks like we dodged a bullet on this one.
Re:More details in the original LA Times article (Score:2)
Security thru Obscurity? (Score:2)
Anyway, you're basically making the security thru obscurity argument. If that model doesn't work for computer security, why should it work for . .
Great... just what our soldiers need! (Score:2, Funny)
Amusing comment in _Slate_ (Score:3, Insightful)
Re:Amusing comment in _Slate_ (Score:2, Insightful)
Far enough to make it worth the informant's while I'd guess.
Good Points Above (Score:3, Funny)
1. How big are the drives? I find that my 256MB one fills up all the time. If these are 512MB or more, I may want one.
2. How much? I can get a (new) 1GB drive at Costo for $60 (Canadian), so I'd hope these (used) ones are going for less then that.
A corrupt black market economy? (Score:3, Funny)
asking for it (Score:3, Funny)
They aren't just 'stolen'. (Score:2)
So there's G.I. John out in Iraq on almost basic army salary, and poor Mohammed running his market stall and a thriving economy for small items (I've even heard of trucks just 'going missing', then ending up miles away carting opium/hashish/people around the country).
G.I. John can't sell this stuff directly because he'd get his ass kicked by sarge, but once it gets passed o
I bought one of these (Score:2)
---
Date: Tue, 12 2003 21:54:35
From: DiamondDonny
To: George
Subject: too easy?
dude - go to google. Type in : weapons of mass destruction.
Dont hit search tho press the I'm feeling lucky button.
Date: Tue, 12 2003 22:03:15
From: George
To: DiamondDonny
Subject: RE: too easy?
> dude - go to google. Type in : weapons of mass destruction.
> Dont hit search tho press the I'm feeling lucky button.
wtf? Why didn't we think of using google for this before?
We just assume they are secrects (Score:2, Insightful)
Re:We just assume they are secrects (Score:2)
You know what they say about "ASS U ME", right?
Try reading the LA Times article. It goes into specific details about what was on the drives. Also read the Slate article (linked above).
Re:We just assume they are secrects (Score:2, Insightful)
It a war torn region like Afghanistan, it is no secret who is corrupt in the government, and it's no secret where military strike
You don't need to go to Afghanistan (Score:2, Funny)
What really happened (Score:2, Insightful)
"What?"
"Would you like to buy a usb drive?"
"No, leave me along."
"Wait, buddy. See that US base over there?"
"Yeah, so? This usb drive came from that base."
"Really?"
"Yes. Contains important US government data."
"I'll take it!!"
----
Takes drive home to find that it contains:
Three love letters.
One Word Doc. (A memo requestion vacation time.)
And a copy of solitaire.exe.
Re:Missing Classified Hard Drives (Score:4, Funny)
Scrapping the Military.. (Score:4, Interesting)
Somewhere in California (IIRC) there is a company that specializes in providing military aircraft for the movie industry. At the time he appeared in a documentary which I watched, the owner of this business had apparently assembled more than one Cobra Gunship from parts sold off by the Armed Forces as scrap and was well on his way toward assembling (what was at the time at least) a state-of-the-art Apache assault helecopter using parts draw from similar sources (they showed footage of it being assembled). According to this guy some of the things the US armed forces sell off to civillans as 'scrap' are downright scary both because they are sometimes dangerous (contain live munitions, toxic materials, rocket engines, etc..) and because this 'scrap' includes some pretty sensetive electronic equipment. So stolen PC's are not the only problem, the US armed forces quite freely sells off some pretty amazing stuff as junk. True enough, the information on a stolen PC can cause a significant security breach but an enemy nation getting it's hands on sensetive military electronics at a scrap auction is even worse. I suppose the way the military filters equipment for disposal may have improved over the last few years but somehow I doubt it.
Re:Scrapping the Military.. (Score:2)
Yep- damn near anyone with the bucks and baksheesh to bribe the local governments who are responsible for 'controlling the sales of weapons'.
And I'm not talking about 'demilitarized scrap', but full-up functional weapons.
Re:Scrapping the Military.. (Score:2)
Ahem - to spies POSING as US citizens - or US citizens bribed to buy the stuff, then turn it over to spies. You think US citizens can't be bribed?
Re:Missing Classified Hard Drives (Score:2, Insightful)
insiders sell it to the shopkeepers (Score:2)
Basically, the military is full of people who'd be in jail if they didn't have military jobs. Lots of stuff gets stolen. Even in the USA, soldiers have to stand guard duty to reduce theft. Some of the people sign up because they just like to kill.
If there were no military, we'd need bigger prisons and we'd have more crime at home.
Re:insiders sell it to the shopkeepers (Score:2)
People forget that most of their wonderful "boys over there" were assholes when they were over HERE.
It's no surprise to me that US troops are behaving like war criminals in Iraq, giv
Re:insiders sell it to the shopkeepers (Score:2)
Looking at his writing skills you can deduce that "sticking with what he knows" will be impossible due to the total lack of common sense and ignorance he portrays.
Nothing to see here move along.
Re:First Proust (Score:2)
Re:/. EXCLUSIVE: Classified Military Conversation (Score:2)
G.I. 1: If I ever find the guy, I will @#$%ing bury him. I've done it before and I've done it again.
(Throws chair)
Re:What really tickles me in this scenario... (Score:2)