Politics

Department of Homeland Security has finally nominated a new Cyber Czar to run the Telecommunications and Cyber Security Divisions. It only took them about two years.

The next person to stick his neck out in this position will be Greg Garcia, the Vice President of a Policy Think Tank called ITAA (Information Technology Association of America).

As the Assistant Secretary of Homeland Security for Cyber and Telecom, Greg will be in charge of US-CERT which has received tons of criticism for poor execution of its mission to secure the nation’s cyber infrastructure. In truth, US-CERT does in fact work to alert technology chiefs about new cyber threats, but these alerts are almost always aged by 8 to 24 hours because of internal red tape and processes. An RSS alert feed from many reputable private organizations, like SANS, CNET and even the Register keeps me up to speed on threats in a more timely manner.

US-CERT has also introduced the CME program, or the Common Malware Enumeration system to clearly identify malware by a common identifier. Often the big Antivirus Companies would rush to press with the latest catchy or not-so-catchy name of a new threat, worm or virus, and it would sometimes get confusing when talking to other techs about the virus when everyone was calling it something different. No more confusion between different names of a worm or virus should exist now that CME is in place.

Once Greg gets settled in, his best bet will be to organize US-CERT based on the model of similar Response teams in the Military. This would put US-CERT at the top of an heirarchical pyramid in charge of all of the Federal CSIRTS. Right now the Federal CSIRTS are required to merely report about incidents and problems within the respective federal agencies. And while it is the law that they report under FISMA, many agencies are still confused about what to report, how often, or are outright neglectful in their reporting. By requiring all federal agencies to stream security logs to US-CERT, the US Government can reduce the burden of reporting and they will be able to correlate attacks against the government across agencies.

The biggest roadblock to making this happen is the Carnegie Mellon half of US-CERT which lobbies Congressmen and Senators on Capital Hill against allowing the government (and US-CERT!) to look at its own data- on grounds that doing so is an invasion of privacy. And with Cargegie Mellon University gobbling up well over a fifth of all funding for the National Cyber Security Division, including the mega-salary of Andy Purdy, the current stand-in Cyber Chief and employee of Carnegie Mellon, these roadblocks will remain in place.

If there is a coordinated cyber attack against the Federal Government today, US-CERT will have to rely on the kindness of other agencies to inform them that such an attack is taking place. Because after squandering hundreds of millions of dollars, US-CERT has effectively tied a blindfold around its own eyes so it cannot see the attack happening. Greg Garcia must overcome the crippling effect of US-CERT’s own blindness and somehow make the agency effective in stopping cyber attacks. Otherwise, we will be looking for a new head of NCSD again very soon.

Like This Post? Rate it and tell your friends! Click the Share button below.

According to the California State Police, servers at the state capital were hacked by external persons and data was stolen. Included in the data were taped conversations in which Arnold described a Puerto Rican lawmaker as “hot blooded.” This tape was given to the Los Angeles Times in an attempt to embarrass the Governor.

The State of California owes it to its residents to keep their servers secure against intrusion. And this also marks a rare instance of true political based hacking if this crime turns out to have been politically motivated.

From the SFGate here:

California Highway Patrol officials have opened a criminal investigation into “multiple” breaches and illegal downloads by outside hackers into the computers of Gov. Arnold Schwarzenegger’s office, after an embarrassing private taped conversation was leaked last week to the Los Angeles Times, administration officials told The Chronicle.

The governor was criticized last week after the Times reported that during a conversation in March with Susan Kennedy, his chief of staff, and Gary Delsohn, his speechwriter, Schwarzenegger referred to Latinos and African Americans — specifically Republican Assemblywoman Bonnie Garcia, who is of Puerto Rican descent — as having “hot” blood or a passionate temperament.

According to a senior administration official who spoke Sunday with The Chronicle, a preliminary investigation showed that an outside individual or individuals had apparently hacked into the computer servers of Schwarzenegger’s office and downloaded the tapes.

“The state’s computer system was breached from individuals using outside computers” on three separate occasions — Aug. 29, Aug. 30 and Sept. 4, the official said, describing the breach as “a very serious matter.”

Like This Post? Rate it and tell your friends! Click the Share button below.

On the night of the Democratic Primary elections in Connecticut, Democratic Senator Joseph Lieberman, who ran for Vice President under Al Gore in 2000, claimed that his website, www.joe2006.com was being “hacked.” Actually, it was under a severe DDoS attack, most likely against the DNS services which point internet users to the actual server. As of today, the website still says “This account under construction.”

From the UK’s Reg here:

A spokesman for US Senator Joseph Lieberman (Democrat, Connecticut) added a twist to the state’s Democratic primary election by claiming that their website was hacked, presumably by plumbers associated with challenger Ned Lamont.

“Voters cannot go to our website. They cannot access information,” Lieberman campaign manager Sean Smith explained. “It is a deliberate attempt to disenfranchise voters.”

The Lamont camp denied any knowledge of the alleged attack, and denounced anyone who might have mounted it. They also offered to lend the Lieberman people one of their admins, in hopes of helping them get their system working again.

The hacking accusation didn’t win any sympathy votes for Lieberman, who lost the primary by a margin of 52 per cent to 48 per cent of the vote. The 2000 vice-presidential hopeful is now threatening to run as an independent candidate for the Senate in the 2006 election.

This is a real case of voter disenfranchisement. As such, it is probably under investigation by the FBI. For all the cries of voter disenfranchisement by Democrats after the past two Presidential elections, it seems that Democrats are the ones disenfranchising themselves.

Cynthia McKinney lost too, but she is claiming that electronic voting machines were rigged to kick her out. What a crock. Democrats dont like voting machines because they are more tamper resistant that paper ballot boxes. Yes, Democrats have historically cheated at the ballot boxes, but does that make them bad people?

Republicans were not the ones launching a DDoS against Joe Lieberman’s website. It was the kooky anti-war left that did it. And these same so-called “hackers” would love to demonstrate that they can hack a voting machine by rigging an election, or ridiculously running up a tally for dog catcher in some district. Heck, Black Hat and Defcon just ended in Vegas. The largest convention of hackers in America, and not one single voting booth in sight.

The electronic voting machine is the new Chupacabra to Democrats. Its their Bigfoot and Yeti rolled into one. Everyones afraid of it, and there are numerous claims and sightings of voter fraud, but no one can come up with a shred of proof.

Like This Post? Rate it and tell your friends! Click the Share button below.

The Electronic Frontier Foundation and the American Civil Liberties Union have been trying to leak national secrets to the press and to America’s enemies by bringing lawsuits against AT&T to get them to divulge what information, if any, it gives to the National Security Agency.

A federal judge last week ruled in EFF’s case to not dismiss the lawsuit in San Francisco. But in Illinois, a judge threw out the case on the grounds of National Security. It will be interesting to see where the appeals courts sit on this issue.

From the San Jose Mercury News here:

Judge dismisses lawsuit over phone records

CHICAGO – Citing national security, a federal judge Tuesday threw out a lawsuit aimed at blocking AT&T Inc. from giving telephone records to the government for use in the war on terror.

“The court is persuaded that requiring AT&T to confirm or deny whether it has disclosed large quantities of telephone records to the federal government could give adversaries of this country valuable insight into the government’s intelligence activities,” U.S. District Judge Matthew F. Kennelly said.

Justice Department attorneys had argued that it would violate the law against divulging state secrets for AT&T to say whether it had provided telephone records to the supersecret spy agency.

The ACLU argued that the practice was no longer secret, because numerous news reports had made it clear that phone records had been given to the agency.

But the judge said the news reports amounted to speculation and in no way constituted official confirmation that phone records had been turned over.

In his ruling, Kennelly noted that he had received written statements from National Intelligence Director John Negroponte and NSA Director Lt. Gen. Keith Alexander in his chambers, with ACLU lawyers not allowed to be present.

It is interesting to note that the reason behind the judge’s ruling is secret and cannot be divulged to the ACLU. Ha.

Like This Post? Rate it and tell your friends! Click the Share button below.