Security Incidents mailing list archives

Re: Biggest Incident This Week: Missing Hard Drives at Los Alamos


From: eric_j () NOVIA NET (Eric Johnson)
Date: Fri, 16 Jun 2000 08:17:54 -0500


I believe it is against the security regulations for anything within a
secure facility to be encrypted (that would make it easy for our aspiring
terrorists to keep their terrorist mailing list spools on their hard
drives at work). My experience is with military installations, not with
DoE, but I would be surprised if the standards were different.

-- Eric Johnson
-- eric_j () novia net

"Smoke me a kipper; I'll be back for breakfast!"

Ace Rimmer

On Thu, 15 Jun 2000, Eric the Fruitbat wrote:

Said Benjamin Setnick <bjsetnic () SPRINTPARANET COM>, regarding the Los
Alamos affair:
The real question is, if disk drives containing classified information were
stolen, why on earth would that information not be classified as well?
Could there be a political reason behind the release of this information?

Political motivation, during an election year?  Nah, couldn't be.

But Benjamin's point got me thinking:  what if this is a kind of honeypot?
Think about the difference between the following two scenarios:

A.  Drives are stolen.  DoE officials refuse to say what's on the disks,
    but announce that the data are encrypted and would take fifteen years
    to crack if you didn't know the passphrase, by which time the data
    would all be obsolete anyway, so it's not really worth anyone's time
    trying to find them.

B.  Drives are stolen.  DoE officials wring hands about vital nuclear
    secrets stored on the disks, how compromising it all is, and fail to
    mention any sort of encryption whatsoever, making it seem like all an
    aspiring terrorist needs to do is make a bid for these things and the
    rest is gravy.

Which do you think would generate more buzz in the underworld?  Which
would result in actual attempts to acquire the drives -- attempts which,
were they intercepted and tracked, could lead all the way back to the
person who stole them in the first place?

In case this seems too far-fetched, or "too smart for the government",
consider how they nabbed the Unabomer.

Eric
--
 Bank runs will start in mid 1999.



Current thread: