Disappeared News

by Larry Geller

I’d like to ask readers to help with this. It’s something I want to get back to. For now, I’m gathering information.

Do you remember the recent newspaper article about hackers breaking into the University of Hawaii parking services computer? It turns out that the data included social security numbers and also that it was not stored in encrypted form. See: UH lax computer security to blame for massive leaks of private information (7/7/2010).

Through its lack of security, 53,000 records were exposed to hackers. Had the records been encrypted, there would be no exposure. Another issue is why there would be social security numbers in the database in the first place.

What brought this to mind was the recent scandal in Utah:

An anonymous group has distributed a list that is spreading terror and outrage among the Latino community in Utah. The list includes names, addresses, workplaces, phone numbers, birth dates and, in some cases, Social Security numbers of some 1,300 people that the group alleges are undocumented. The list was sent to law enforcement officials, state lawmakers and the media, and urges that those on the list be immediately deported. All the names are Latino, and they include over 200 children and the due dates for six pregnant women.   [Democracy Now, "They Have Terrorized Our Community": Anti-Immigrant List Targets Latinos in Utah, 7/15/2010]

Now, even with encryption, an employee can (for example) print out data and take it off the premises.

That’s why corporations also have programs that routinely monitor which records in a database have been accessed by whom, and when.

Back to Hawaii.

I speculated that if DHS were allowed to close its in-person intake centers and outsource the work to call centers, before long our phone calls might even be answered in India. They’d just have to learn some Hawaiian pronunciation. As it turned out, DHS confirmed later that it has already outsourced some calls to a Mainland call center.

Well, I ask, does that call center have access to personal information? What security standards are imposed on them, is it possible for DHS to verify them, and in fact, what security does DHS itself have in place to protect the personal information of its clients?  Does it impose standards on the two QExA contractors, subsidiaries of two Mainland firms?

Will we open our newspaper one day to read headlines that a list of personal information has been leaked from one state computer or another?

I already know a little. OHA, for example, outsources its email system support because it couldn’t handle it by itself. There’s a potential security problem. There was no risk analysis performed, according to an audit conducted last year.

Worse, at the time of the audit, OHA was sending backups of its data home with its IT manager, to be stored in his home safe. Yikes!

But wait… it gets worse than that. Here’s a database that is not being securely kept:

The Kau Inoa Native Hawaiian Registry is a database of Hawaiians who are willing to participate in the process of building a native Hawaiian governing body. Registration with Hawai‘i Maoli, which administers the Kau Inoa Native Hawaiian Registry website and database independent of OHA, requires providing sensitive information such as first, middle, last, and maiden names; home and mailing addresses; phone number, email address, gender, and date and location of birth. The process also allows for the scanning and emailing of the registrant’s birth certificate as one method to verify Hawaiian ancestry.
…
Although there is no evidence that the information collected is being mishandled, we did find that the lack of risk analysis contributed to weak contractual requirements for the security of the system. For example, currently, there is no provision in the contract that mandates regular audits and security checks of the database.

Although Hawai‘i Maoli is a separate organization from OHA, the consequences of a Kau Inoa database breach would directly impact OHA.

Now, you’d think that the state would have a Chief Information Officer, and that there would be security standards and regular audits. Well, there is a CIO, but:

In the State of Hawai‘i, the CIO’s duties are carried out on a part-time basis. As noted above, the current CIO was appointed by the governor in 2004 and also serves as the state comptroller.

It’s no wonder that the Auditor concluded:

1. The State’s IT leaders provide weak and ineffective management.
2. The State no longer has a lead agency for information technology.

Some of the state’s information technology standards go back two decades, according to the report, and 90 percent of the manuals are incomplete besides.

One of my favorite examples of poor security is a map, on the Capitol website, that pinpoints the location of one of their data centers.

In the 1970s corporations stopped showing potential evildoers where their data centers were located. They also stopped placing computers in show windows.

(In fact, I worked at a GE computer center in the street level window at 570 Lexington Avenue in New York City until it was moved to a nondescript data center in New Jersey. We put on quite a show for lunchtime passersby, spinning all the tapes and so forth. But GE moved us and closed the metal drop shutter on the large show window. Three months after we left, a bomb detonated in the lobby took out what would have been the data center (and maybe me!). The bomber didn’t know, of course, that all the equipment had been moved away.)

So my point is, it’s pretty basic security not to identify where the goodies are kept. And it’s not like I have not pointed this out to them, I have.

If you are aware of any data security situations that put public data at risk, why not send a message to leak@disappearednews.com. The social security number you help protect may be your own.

Permalink posted by Larry @ 7/15/2010 05:18:00 PM