Posts filed under ‘security’

UK: Raising the breach barrier, again

When HMRC (Her Majesty’s Revenue and Customs) lost personal information of nearly half the UK population, I called it “mind boggling”. I also thought that it would be the last time I’d write about data breaches. What could top that?

Never underestimate the Brits. They’ve now pushed the bar even higher.

All it took was a flash drive found in the car park of a pub, The Orbital. It had user names and the hashed passwords of Government Gateway accounts, which provides centralised authentication to important online services such as tax returns. Worse, the flash drive had the source code, security software, and a step-by-step guide to how the Government Gateway works. And, the fact that it belonged to Daniel Harrington, an IT analyst at Atos Origin, the company which manages the Government Gateway.

The flash drive was lost about two weeks ago. Daniel must have just started to believe that his prayers had been answered with the flash drive forever lost. No such luck. Tellingly, it was turned into a newspaper (The Mail on Sunday) rather than given back to the government.

The point isn’t that the flash drive was lost. What was all that data doing on it in the first place? The Prime Minister is pointing the finger at Atos Origin which is fingering Daniel for breaching operating procedures. Really? Sounds exactly like Chancellor Alistair Darling pointing to a junior official in the HMRC case. It really shouldn’t be so easy to evade accountability.

Why was the flash drive unencrypted? The passwords were encrypted but, throw enough resources at it, and it shouldn’t be that hard to break. It’s impossible to say how many copies of the flash drive may be in circulation.

Some will use this to question the UK’s plan for a National Identity Card. Others will again proclaim the death of passwords. Yet others will cry that it’s the tip of the iceberg- who knows how many other unreported breaches of this magnitude are happening around the world? I’m sure at least a few will wonder what if it had been biometric templates.

Me, I mourn the blows to trust in government and online services all over the world. And the frightening reality that past lessons are simply being ignored, taking us ever closer to a tipping point.

November 3, 2008 at 11:17 pm 1 comment

Esther Dyson on privacy

With so much happening around the world- the financial markets, politics, rugby (Union and League) – it seems terribly mundane to be writing about identity and privacy issues. C’est la vie!

It’s interesting to see that a leading magazine such as Scientific American focus on The Future of Privacy as the theme for its September issue. Another sign of privacy becoming a mainstream issue.

There seems to be a lot of interesting articles but the one that I picked first was How Loss of Privacy May Mean Loss of Security. Besides the title, what drew me was that the author is Esther Dyson. What’s so special about her? Lots of stuff that you can Google but the one fascinating fact is that, for the Personal Genome Project, she and nine other people will post their full genome sequences and accompanying health information online.

She remarked that “I was recently in the market for health insurance. I asked my insurance broker if he would like a copy of my genome, and he politely declined.”

Undoubtedly a person who’s going to have some radical views about privacy…and the article has some gems.

For example, perhaps linked to the above, her view is that “the coming flood of medical and genetic information is likely to change the very nature of health insurance.” She doesn’t see this as requiring a privacy trade-off. Instead, she believes the problem is making cheap and plentiful health insurance available balanced by “mandating subsidies paid by society to provide affordable insurance to those whose high health risks would otherwise make their insurance premiums or treatment prohibitively expensive.”

Hmmm…so how is cheap and plentiful health insurance actually going to be made available in the first place?

She asks the question “What is the best way to limit government power?” The answer seems hard to swallow, “Not so much by rules that protect the privacy of individuals, which the government may decline to observe or enforce, but by rules that limit the privacy of the government and of government officials.”

Another suggestion seems better, “We should be able to monitor what the government does with our personal data and to audit (through representatives) the processes for managing the data and keeping them secure.”

On information privacy in general, while not new, she puts it elegantly, “Much of the privacy that people took for granted in the past was a by-product of friction in finding and assembling information. That friction is mostly gone.”

She goes on to say that, “Rather than attempting to define privacy for all, society should give individuals the tools to control the use and spread of their data.” Disappointingly, the tools she praises are the very limited access controls that Facebook and Flickr provide.

If that’s the best tools we’re going to get, I think we’ve got a long, long way to go before loss of privacy isn’t a mainstream issue any longer!

September 17, 2008 at 11:01 pm Leave a comment

Invitation to become a bot herder

What else would you call it? Consider the facts:

– Owen Walker, aka AKILL, the Kiwi bot herder who was stupid enough to get caught, couldn’t stop smiling in court when the judge called him a “very bright young man.”

– He spent over two years building bot nets- not a person who was a mule but someone who actively recruited people for his A Team- and would have kept going if not stopped. The judge still sees no criminal intent on his part, just curiosity.

– Even the prosecution called for leniency. So much for the vaunted FBI operation Bot Roast.

– He controlled 1.3 million computers around the world yet escaped conviction (also video) since it might ruin the prospects of using his skills in a positive way. No doubt those 1.3 million people are thrilled at that prospect as is UPenn, which he crashed for a couple of days with an accidental distributed denial of service attack

– All he got was a fine of $9,526 or about US$ 7,300 for damage that runs into millions of dollars because all the police actually proved was the UPenn attack.

OK, so he was 16 when he started and suffers from mild Asperger’s syndrome but what message does the sentence send to bored teenagers? That the Internet is a lawless wild west? That if you’re stupid enough to get caught, don’t worry, there’s not going to be a hanging? Instead, the police and overseas companies will line up to give you a job? That all you’re going to get is a fine that you can probably pay from your first month’s salary (as you’ve already blown the $40,000 you’ve made)?

From the news coverage, it seems to me that all of the hinting that he might work for the police is just a red herring.

Owen Walker was not that good a programmer, even though the police think so (video), just a person with a very relaxed sense of right and wrong.

The message is physical crime is not worth it- you actually do get sent to jail and no prosecutor is going to ask a judge to discharge you without a conviction. The Internet is where the smart guys go to- it seems that everyone is on your side then.

On TV (video) they aren’t willing to speak out against the sentence. So what’s next? A book deal? An invitation to speak at the RSA Conference a la Frank Abagnale?

Ridiculous.

Do we get the crime that we deserve?

July 17, 2008 at 12:00 am Leave a comment

Elusive SSO

I’ve been a fan of usability guru Jakob Nielsen’s regular update (Alertbox) for a long time. It’s admirable how he keeps re-emphasising the fundamentals again and again.

I suspect that half the reason I read the updates so regularly is the futile hope that somehow- maybe by osmosis- his common sense approach will percolate into my sub-conscious and lead to better outcomes for the online services I’m involved in.

Jakob Nielsen would no doubt laugh at such nonsense, throw up his hands, and demand that I user test to objectively determine that one way or another.

Anyway, his latest piece is on enterprise portals. That is not an area that I often venture into but he had some stuff about single sign-on (SSO) that caught my eye:

“Single sign-on is the Loch Ness monster of the intranet world: People hear about it and even believe it exists, but they’ve yet to see it for real…In our initial research 5 years ago, it was already clear that single sign-on could dramatically improve user productivity and satisfaction, as well as immensely reduce support costs.”

“Our second round of research confirmed single sign-on’s potential — and its elusiveness… True single sign-on was and is extraordinarily rare… We can only conclude that it’s very difficult to achieve, despite its promise.”

What’s true of the enterprise is even more so outside it, for the Internet.

The benefits and business case for enterprise SSO are undoubtedly great. But for the Internet? That’s an area that I personally struggle with, notwithstanding that SSO is the original use case for federation and, to some extent, can be provided by OpenID (provided the person has logged on to the OpenID Provider).

Now, Internet SSO does mean convenience. It surely is a good thing to log on once and then be able to do whatever a person wants across the Internet without logging in again.

What worry me are the security and privacy implications. Those aren’t that big a deal within an enterprise context but are on the Internet. And, within government online services on a national scale, even more so.

From a security perspective, it’s about the loss of keys to the kingdom- passwords are just too easy to compromise. Now, if passwords were used appropriately (i.e. only where there is a low level of identity-related risks) then the consequences from a compromised password wouldn’t be too bad. But, realistically, passwords today protect far too much and a compromised password can be a widespread disaster for the person.

Then, there’s privacy. Using the same username & password to do everything (or lots of things) then raises the possibility of aggregation of information and building profiles.

So is Internet SSO a good thing? Yes, provided it is implemented in a secure and privacy-protective manner. Problem is, can that be achieved in an economical manner (that rules out advanced crypto) for the Internet?

July 15, 2008 at 11:16 pm 1 comment

Just what is ‘identity’?

As a term that most of us find intuitively easy to define, it turns out that getting a precise and generally accepted definition of the term ‘identity’ is far from easy.

The first question of course is whether it’s even worth the effort to try and get a precise definition. I think the answer is ‘yes’ for several reasons.

First, identity involves personal information and people expect that government collects and holds their personal information in a secure manner with their privacy appropriately protected.

Secondly, people need to prove who they are many times during a day. While typically people only need to do that with government infrequently, for a government agency it is of critical everyday importance to have confidence in the identity of the person they are dealing with. For example, an agency needs to be sure that government services are being delivered to the right person. Another example is ensuring that the right person has access to their own personal information such as health records or tax records.

On the one hand, people want convenient access to their information and government services. On the other hand, government as a whole has to manage the identity-related risks and ensure that the taxpayer’s money is spent well.

Finally, consider this quote from a recent report by Sir James Crosby to the UK Government, “… those countries with the most effective ID assurance systems and infrastructure will enjoy economic and social advantage, and those without will miss an opportunity. There is a clear virtuous circle. The ease and confidence with which individuals can assert their identity improves economic efficiency and social cohesion…”.

Looking around, both in New Zealand and overseas, we saw that most of the focus on ‘digital identity’ and ‘user-centric identity’. Also, ‘identity management’ is typically defined in technology terms such as ‘authentication’ and ‘authorisation’. And yet, all of these still don’t answer the fundamental question of just what ‘identity’ is in the first place.

To help get us a better insight into the thinking of the academic world and the approaches taken in some other countries, we turned to Victoria University of Wellington. Professor Miriam Lips, with the help of her student Chiky Pang, has now completed her report Identity Management in Information Age Government (PDF, 557 KB) and we have published it on the e-government website.

It turns out that the answer to our questions has a variety of answers. However, it does validate our current approach that one of the useful ways to look at identity is to consider that people have a single, unique identity but many context-dependent partial identities or personas. The result is more of an onion than linear, so that operating at the outer layers of the onion may not have any connection at all with the unique core:

Another interesting insight from the report is the move to an informational definition of identity from a document-based definition. The impact of the Information Age is to make it increasingly necessary for governments to consider identity information- its collection, verification, storage, maintenance, and disposal- rather than just the issue and use of identity documents.

As we look at these issues in finer and finer detail, it remains important to not lose sight of the basics. Such as, people own and control their own identity while government’s role is to manage their identity information well. And, the need to put theory into practice.

So that in the future, when Bill and Jessica want to return home to New Zealand, they have one less thing to worry about.

[Original post at http://blog.e.govt.nz/index.php/2008/07/09/just-what-is-identity/]

July 9, 2008 at 7:52 pm Leave a comment

Sweden: Lex Orwell

Sweden is more associated with the icy Björn Borg than throwing people into frenzied criticism.

But that’s just what they seem to have done with their new law giving its National Defense Radio Agency (FRA) the right to intercept all wired communications- including Internet traffic, email, SMS, faxes, and telephone conversations- at will and scan for keywords. So far, the FRA was limited to monitoring radio communications. The new law will allow FRA to monitor all traffic at the border, passing to or from or just through Sweden.

While the Swedish Government has cited the war on terror, FRA happens to be the agency that also has a global reputation for code breaking. It has its origins in intercepting and breaking encrypted transmissions from Nazi Germany. And, Sweden just happens to be a major transit country for cable traffic out of Finland, Russia, and the Baltic States.

Deputy PM Maud Olofsson can’t see why that’s such a big deal, “Sweden has always listened in as a means of ensuring we have the information we need to protect national security. I don’t think that’s a secret.” Sweden simply sees it as an appropriate response to external terrorist threats though most people call that a fig leaf for a more sinister agenda.

The new law, dubbed Lex Orwell, was delayed for a year and then passed narrowly after some last-minute political manoeuvring.

Google’s global privacy counsel, Peter Fleischer, has even gone so far as to club Sweden in the same privacy-invasive category as- wait for it- the US, “By introducing these new measures, the Swedish Government is following the examples set by governments ranging from China and Saudi Arabia to the US Government’s widely criticised eavesdropping programme.”

Even Kiwi commentator Bruce Simpson joined in the frenzy, “If I got blown up in a terror attack, I’d consider that a small price to pay for ensuring that my friends and family weren’t treated like criminals by their own government…I wonder how many others feel likewise but say nothing for fear of being seen as a traitor to ‘the war against terror’.”

Big words indeed.

But, with the Swedes intent on proving they are masters of security theatre, one can only sit back and watch in fascination as another nation steamrolls privacy in the name of security.

June 23, 2008 at 11:55 pm 2 comments

Freeing the cyber seas

Thoughts of war have been on mind recently. The seduction of using force to achieve just outcomes. The futility of war, in many cases, failing to make a lasting difference in addressing the root cause.

The US had Memorial Day, a day of remembrance for military men and women who laid down their lives. Over here, NZ has Tribute08, a time for the country to say sorry to our Vietnam Vets and welcome them home after decades.

The price of war shows up in various ways, with neither side spared. An example is the 100+ US soldiers who commit suicide each year. Or, the continuing unwillingness in NZ to really face up to the damage that Agent Orange continues to do to Kiwi Vietnam Vets and their families.

That’s the mindset with which I read the article, Freedom of the Cyber Seas, recently.

It takes us back to the late 18th century, when the Barbary States ruled the Mediterranean- seizing cargo from those vessels not protected by the European powers; extorting ransom from those that had not paid the ‘protection fee.’ For the newly independent America, the policy was to appease the pirates. By 1786, Barbary extortion demands totalled $1 million- one-tenth of the U.S. government’s entire budget at the time.

Thomas Jefferson was a proponent of Dutch jurist Hugo Grotius’ Mare Liberum or “free seas” doctrine published in 1609. Once Thomas Jefferson became President in 1801, true to his words, he sent in a group of American warships. Four years later, culminating in the Battle of Derna, the Barbary States were defeated and “free access to the world’s oceans a fundamental component of U.S. sovereignty” was established.

The authors’ purpose is of course not to give us a history lesson. Rather, it is to draw a parallel with “a new version of the high seas–the cyber seas” that threatens US military and economic interests. They call on the US to abandon the policy of appeasement to keep data flowing through global networks without hindrance.

Fortunately, they aren’t advocating what the US Air Force does, “America needs a network that can project power by building an af.mil robot network (botnet)… America needs the ability to carpet bomb in cyberspace to create the deterrent we lack.” They thankfully think that respecting international law is a good thing and recommend “policies, legal frameworks and enforcement mechanisms for Internet commerce and communications.”

Their plan is however not without a hard edge. Inspired by the US war on drugs, “the president also must charge an appropriate federal organization with the charter of patrolling the cyber seas–issuing challenges where necessary and taking proactive defensive action to disrupt organized threats. This organization must work closely with the law enforcement and intelligence communities to identify bad actors and devise strategies to exploit the vulnerabilities associated with online criminal activity.”

Even though this is a very US-centric view of the world, it does raise some interesting thoughts and parallels. What is the world going to do about the modern-day pirates? What is the Internet equivalent of the war with the Barbary States (today’s Russia and Eastern Europe)?

And, finally, the sobering thought that piracy on the high seas was not wiped out by a US victory in the Battle of Derna. Far from it as anyone familiar with piracy in the Malacca Straits.

So, what are we going to do? And will there be a lasting solution?

June 1, 2008 at 10:28 pm 1 comment

Older Posts


This blog is no longer updated. See the About page for more info. I'm currently active on Twitter.

Follow me on twitter

Feeds