Re: Releasing details

[Willis Marti <wmarti () TAMU EDU>]

Eric Jernigan wrote:
> Cases like these present a risky situation to your team. They involve 
> problems that look solvable by a campus IT Security team. Assuming the 
> team has more than enough resources to solve the technical issue 
> (training, efficient logging, an accurate IP address from someone not 
> bright enough to go through a TOR proxy or a compromised machine –AKA 
> botnet machine,) it still leaves you in the situation of doing 
> investigative work which is outside of the charter of IT Security. The 
> only exception is if they are part of the Campus Police/Public Safety. 
> Investigation is a law enforcement function. Even if your team does 
> the right things and answer Joan’s question, the risk of tainting 
> evidence is probable. Even if you avoid that, what happens if you give 
> Joan the contact information? What can she do that won’t point back to 
> having to retrace the entire investigation again for the authorities. 
> In a worst case scenario, what happens if when Joan says ”take action” 
> she means hacking back the offender, or worse blowback-action 
> (semi-auto handgun)?
>
> It’s our duty (IMO) to assume Joan is truthful to the best of her 
> knowledge. Only when following up with her reveals otherwise should 
> you eliminate her complaint as being credible. With that in mind, this 
> is a serious complaint. In 1997 the laws didn’t take these situations 
> seriously (“See, Johnny’s learning computers…”). Now, it’s a different 
> world; John Doe (no relation…) has the risk of jail time now for 
> maliciously altering Joan’s account. Law enforcement must be involved.
>
> Because of these reasons, law enforcement at a minimum need to be 
> advised (and the contact documented) in any of these situations. If 
> your department is still one of the technology resistant- “computers- 
> phooey! Elliot Nest didn’t have one…”, you need to inform them anyway 
> and ask them to coordinate contact with the next level of support. 
> Helpful or not, the Campus Police/Public Safety need to be in the loop.
In theory, virtually every compromise of a computer is an issue for law 
enforcement - i practice law enforcement would be overwhelmed in just 
trying to triage each incident. Ever try to convince the FBI a 
compromise is worth their attention? IT Security has the responsibility 
to start data gathering ("investigation") and, based on their 
relationship with local LEO, pass it off or deal with it according to 
administrative rules.

Cheers,
Willis Marti
Director & CISO
Networking and Information Security
Texas A&M University