CIA pulled officers from Beijing after breach of federal personnel records(washingtonpost.com) |
CIA pulled officers from Beijing after breach of federal personnel records(washingtonpost.com) |
When Snowden leaked the documents, no one was endangered.
This breach, and lots of people are endangered.
But are you getting calls for criminal investigation? Are heads rolling (other than the head of OPM, who was hated anyways)?
That's why I really like the NTSB's style of investigation (they're the people who investigate air crashes). Instead of going in and trying to pin it on one person, they look at procedures, organisational communications, chains of command, the whole works.
Most of their reports don't come out and say "engineer John Smith caused the accident by forgetting to tighten this bolt!" They say, we looked at John Smith, we found the mistake, then we looked at how John Smith's work is monitored, the procedures for this repair, the training given, what their manager did, their working conditions, etc.
Then finally they come up with some recommendations so it cannot happen again. These are normally procedural, training, and organisational changes, rather than simply saying "nobody should make mistakes ever again or jail!"
This is what we need for information security leaks like this. We need an NTSB-style org to come in, pull apart the organisation and how they operate, give everyone criminal immunity so they talk openly, and then generate concrete changes so this never happens again (and ideally send these changes to other departments).
... Or just jail everyone, whatever...
What is curious is that we aren't sure what the norms are for how to respond to cyber espionage, unlike with in person espionage which had a whole set of responses we could fall back on.
Certainly, negligence that should incur public disgrace.
Also arguably demonstrating one of the points made by the whistleblowers: You can't trust the government to properly manage all the information they collecting.
"We, too, practice cyberespionage and . . . we’re not bad at it"
- James Clapper
It seems to me that yeah... you kind are bad at it.
At the very least, a little less self-certainty might be in order.
James Clapper, the DNI, heads 16 intelligence agencies under him, one of which (CIA) didn't have their records stolen. Though the budget breakdowns are not disclosed, arguably, they are the largest of the bunch and only ones that have deployed field operatives.
Defensive is interesting considering how many federal departments there are and how they're all pretty autonomous in regards to IT. Going after employment records was especially devious as they aren't classified, so whatever requirements OPM had to follow weren't very stringent.
The real issue here, and something that affects the private sector as well is why are we not treating all IT data as classified? Why all the half measures? I think we're still in the early stages of digitization and automation and have to learn security lessons the hard way.
Also in autocratic states where information is tightly controlled, hacks like this don't make the news. We have no idea what the NSA is actually doing in these countries outside of Snowden, whose data is mostly (all?) domestic programs. And the stuff we do know about like Stuxnet, only come out because certain people wanted to turn it into a political football.
There's a time and a place for active sonar in finding and killing submarines, but it's not from your anti-submarine ship, all day every day.
http://www.amazon.com/The-Human-Factor-Dysfunctional-Intelli...
One can envision a time in the very near future (if not already), when a random foreigner is stopped on the streets of Beijing and asked to press his finger to a reader attached to an Android phone. The device would then display his picture, official position, address, salary, clearance level, etc. Or else, just walk into the restaurant he just left and take the fingerprint off a used glass.
If he's there in some intelligence gathering capacity, the Chinese could then have him followed, or send him packing, or maybe even detain him for a day as a form of harassment, knowing that the U.S. government is powerless to do anything about it. They have us over a barrel.
[1]http://blogs.scientificamerican.com/observations/what-could-...
We can't blame the OPM for the security issues. They were a victim of a bad national strategy.
If you "see something, say something" unless its about cyber security.
It should be prosecuted, in the court of public opinion if no one will bring it to a judicial court.
Though I may be judging it wrong based on only having used crappy sonar equipment.
Bingo; you've turned the civil population into military reconnaissance. Are they now a valid target? They certainly don't seem to be just plain civilians anymore, but they're not lawful combatants either.
As it turned out, I am led to believe that the app wasn't a great success, but it's still a disturbing trend.
[1] I say "Russia" because I can't dig out more detail right now. Obviously company X working with agency Y or some other such.