Emergent Chaos

Call me crazy?

There's an article in the New York Times, "‘Mad Pride’ Fights a Stigma"

“It used to be you were labeled with your diagnosis and that was it; you were marginalized,” said Molly Sprengelmeyer, an organizer for the Asheville Radical Mental Health Collective, a mad pride group in North Carolina. “If people found out, it was a death sentence, professionally and socially.”

She added, “We are hoping to change all that by talking."

...
Participants write and distribute publications, stage community talks, trade strategies for staying well and often share duties like cooking or shopping.

...
Many psychiatrists now recognize that patients’ candid discussions of their experiences can help their recoveries. “Problems are created when people don’t talk to each other,” said Dr. Robert W. Buchanan, the chief of the Outpatient Research Program at the Maryland Psychiatric Research Center. “It’s critical to have an open conversation.”

Call me crazy, but I think these folks might be onto something. Learning about coping strategies from one another? Testing what works and what doesn't, and reporting on it? Maybe "we were broken into" isn't the most embarrassing thing you can say in public.

A question of ethics

Various estimates have been made regarding the quantity of personal identifying information which has been exposed by various mechanisms. Obviously, though, we only know about what we can see, so seeing more would make such estimates better. One way to see more would be to look in more places, for example on peer-to-peer file sharing networks. So here's the question: would it be ethical (and if so, under what conditions) to deliberately seek out files containing PII as made available via P2P networks, in order to better understand the extent to which such information is exposed, and how? I have an opinion on this question, but I'm very interested in what others think.

Italy Posts Tax Return Data on Official Website

How much do you make? How surprised would you be to learn that your magic number had been posted on the Internet by the government? And that it was not by mistake, as in other recent breaches of privacy.

How Much Do You Make? The Nation Already Knows. The data has already been removed from easy web access at the official site. Bloomberg's report indicates that it wasn't simply posted to the web, but offered up as spreadsheets:

A ministry Web site was bombarded by Italians curious to see what their neighbors or favorite actors declared as income, making it often impossible later in the day to download spreadsheets with the name, date of birth, total income and amount each taxpayer paid.

If anyone knows where the mirrors are, please share.

I ask not out of prurient interest, but because it's not so easy as taking data off the website.

The messenger is the message

In a blog post entitled "Lending Tree A Little Late In Cutting Off Network Access?", I read that in the recent Lending Tree breach:

several former employees may have helped a handful of mortgage lenders gain access to Lending Tree's customer information by sharing confidential passwords with the lenders.

Later, the author describes "an obvious chink in Lending Tree's information security armor", (reprinting a U.S. News quotation from Brian Cleary):

These are former employees—how can those user accounts to critical customer data still be active? Those should be shut down. So, their access to all of the information and resources should be revoked on the day of their termination.

USNews.com

Finally, he observes that

If you're going to rely primarily on human beings to implement the policies, then you'd better make sure that those human beings are either themselves subject to checks and reviews to make certain that they're following the policies.

All of this is nothing new to EC readers. What surprised me, and what I think is noteworthy here, is that the guy writing this is not some CISSP, CISA, or even CISO. He's the voice behind the Bank Lawyer's Blog, an attorney with banking and other corporate clients.

Not to read too much into this, but when the legal profession starts commenting knowledgeably about access termination policies, there's something interesting afoot.

University of Miami: Good for the body, bad for the soul?

The University of Miami has chosen to notify 41,000 out of 2.1 million patients whose personal information was exposed when thieves stole backup tapes.

The other 2.1 million people, apparently, should be reassured, that their personal medical data was stolen, but the University feels it would be hard to read, and well, there's no financial identity theft risk associated with it. If you believe the sorts of people who notify 1.9% of the victims of a breach. Sorry, ChoicePoint. Unfair comparison. You notified about 18% of the victims*, nearly ten-fold as many.

There's some analysis of how hard it would be to read the tapes. I'm skeptical: why does someone steal tapes from an Iron Mountain van if not to read them?

The Breach Blog feels differently. In "University of Miami reports stolen tapes affecting patients," he digs into the likelihood of the data being accessed.

Now, the University claims that the tapes are in a "complex and proprietary format," which seems to be "Tivoli Storage Management" from IBM. Now, Tivoli storage manager has encryption capabilities (page 3 of this PDF.) I'm curious why that wasn't in use.

Also, looking around, I found this quote at an IBM partner site:

Much is made of the inbred security of the TSM system since the backed up data is so closely linked with the TSM database. While, to the layman this is true, and it is almost impossible to reconstruct TSM data without the database, it is possible in the right scenario, with the right skills at your disposal.

Until I hear more, I'm skeptical of the University's claims. I don't believe, and I have not believed for a long time, that breach notices are about identity theft. They're about the performance of a promise to protect information.

(*Footnote: 18% being 30/160, approximate numbers for the ChoicePoint incident.)

Microsoft Security Intelligence Report V4

Microsoft Security Intelligence Report (July - December 2007)

This volume of the SIR focuses on the second half of the 2007 calendar year (from July through December) and builds upon the data published in the previously released volumes of the SIR. Using data derived from several hundred million Windows users, and some of the busiest online services on the Internet, this report provides an in-depth perspective on trends in software vulnerability disclosures as well as trends in the malicious and potentially unwanted software landscape, and an update on trends in software vulnerability exploits. The scope of this fourth volume of the report has been expanded to include a focus on privacy and breach notifications, and a look at Microsoft’s work supporting law enforcement agencies worldwide in the fight against cyber criminals. [Emphasis added.]

Emergent Chaos readers are unlikely to learn new details in the analysis. What's important to me is that this helps to establish a new normal baseline around the way we're using information that's disclosed and gathered by folks like Attrition.

Virginia gets it

[...]an individual or entity that owns or licenses computerized data that includes personal information shall disclose any breach of the security of the system following discovery or notification of the breach of the security of the system to the Office of the Attorney General and any affected resident of the Commonwealth without unreasonable delay.

Virginia's new breach law

Emphasis added.

41 and counting

Virginia, West Virginia, and South Carolina are the latest states to pass data breach notification laws, bringing to 42 the total number of states with such laws on the books (including the one state with a law that applies only to public entities, Oklahoma)

See More Breach Notification Laws -- 42 States and Counting at the law blog of Proskauer Rose.

The FDIC's Cyber Fraud Report

The FDIC's Division of Supervision and Consumer Protection didn't release a report titled "Cyber Fraud and Financial Crime" on November 9, 2007. That release was left to Brian Krebs, a reporter with the Washington Post, in early March, who blogged about it in "Banks: Losses From Computer Intrusions Up in 2007" and "The FDIC Computer Intrusion Report."

One of the great things about having the full report is that we don't need to rely on Brian to interpret it for us. I love having data, and hate how rare it is for people who work in information security to have anything but summaries.

I found a couple of things interesting. At first they seem un-related:

• The largest category is mortgage fraud, costing roughly $600MM in the 2nd quarter of 2007, and up 15% from Q1.
• The second largest is check fraud. Check fraud is up, according to the FDIC (page 9) because the "Check21" program which sends images (rather than physical checks) is not sensitive enough to show watermarks or alteration detection by chemicals in the paper.

Both are really about risk tradeoffs, and it seems that with the rise in employment as a short term deal, the organizations become more focused on the short-term. [Updated: clarified that sentence a little.]

An example is the "zippy" memo, where JPMorgan Chase employees traded information about how to fool the computer into approving loans. (See "How to Get an "Iffy" loan approved at JPM Chase," or "Chase mortgage memo pushes 'Cheats & Tricks.'" Chase fired at least one person for distributing it.)

The advice included:

1. Lump all of an applicant's compensation as the applicant's base income, rather than breaking out commissions, bonuses and tips.
2. Do not disclose use of gifts for down payments.
3. If all else fails, simply inflate the applicant's income. "Inch it up $500 to see if you can get the findings you want. Do the same for assets.

Now, any security professional worth their salt can come up, post-facto, with fixes for each of these behaviors that prevent or detect them. But the real problem is that the commission isn't paid over the life of the loan, it's paid up front. Of course people are going to find ways to get the loans approved, and not worry about what happens next. Your community banker didn't actually get bonuses over the life of the loan, but did expect to be with the bank when a problem happened.

As long as (as Martin Wolff says) "no industry has a comparable talent for privatising gains and socialising losses," we should expect to be unpleasantly surprised by reading about bank fraud. (A bit more context on the Wolff quote can be found in this excerpt.)

94% of Philippine IT Professionals Endorse Breach Disclosure

"LOCAL SURVEY SHOWS: Private sector wants breach of information systems reported :"

MANILA, Philippines -- Local organizations want the breach of information systems and theft of personal information reported, a survey conducted by the Cyberspace Policy Center for Asia Pacific (CPCAP) showed.

"A surprising 94 percent favored the imposition by law of [an] obligation upon businesses to report [a] breach of security of information systems or theft or personal information," Claro Parlade, executive director of CPCAP, said in a summary of its survey that was presented to a technical working group created by the Commission on Information and Communications Technology to help Congress draft a data privacy bill.

The survey had a small sample size, but even so. 94%. It's like a sea change in just three years. How are you using breach data?

I see you stand like greyhounds in the slips...

...straining upon the start. The game's afoot!
Follow your spirit; and upon this charge
Cry 'God for Harry, England, and Saint George!'

So closes the speech before battle which Shakespeare wrote for Henry V. You know, the one which opens, "“Once more into the breach:” (Thoughts on the cumulative effects of notification letters)." I seem to recall Henry talking about the proper ownership of the French Crown and Harfleur, and not breaches. Only because the French crown is long settled, I'd like to follow Dissent and talk about breaches. She's responding to an article by Scott Berinato, "The United States of TMI." Both are worth reading. Quoting Dissent:

While their comments are thought-provoking, I don’t agree that learned helplessness is the appropriate paradigm to apply here, although I agree what the individual tells himself or herself upon reading a disclosure is key to how they respond.

Henry spoke to fire his men up for real battle. I think that we, like Henry's men, are fired up and straining at the start. We're aware of the danger in front of us, and the power which we have. We have today the ability to follow our spirit. We can agree that "in peace there's nothing so becomes a man, as modest stillness and humility." We can also see that our security measures are not working as well as we'd like, and actively engage with the problem.

There are two greyhounds straining. The first is the truth about the state of affairs, and the second is those of us sifting at start of the data, trying to make sense of it.

I don't believe we must learn helplessness. To the contrary, I believe that we must not. The landscape has changed dramatically since ChoicePoint. Talking about breaches has transformed the landscape, and will do so further. There's more embarrassment over coverups than over the breaches. Companies have emerged to address consumer and business concerns. We will see more.

So indeed. Once more into the breach, dear friends.

A Crime That Flourishes Because Victims Remain Silent

There's a fascinating article in the New York Times, "Report Sketches Crime Costing Billions: Theft From Charities."

“I gave a talk to a group of nonprofit executives a few weeks ago, and every single one of them had a fraud story to tell,” said one of the report’s authors, Janet S. Greenlee, an associate professor of accounting at the University of Dayton. “This has been going on for years, but there’s a feeling that it shouldn’t be discussed,” because of the effect it might have on donations.

...

But it will now be harder for charities to hide fraud, because beginning with tax forms they must file for 2008, the Internal Revenue Service has added a question requiring them to disclose whether they have experienced theft, embezzlement or other fraud during the year.

This resonated pretty strongly with points we make in the New School. It's about how problems fester when we don't talk about them. There's a principal-agent problem here, where charities, acting as agents for their donors, are actively concealing problems. And it shows yet another example of diverse perspectives helping to solve problems.

The report is available at "An Investigation of Fraud in Nonprofit Organizations."

Reporting on Data Breaches: US and Great Britain

Is the recent wave of reporting on British data breaches similar to what we've been seeing in the US? A couple of things seem true: the US has way more reported breaches per capita, but both locations have seen greatly accelerated reporting.

Here's a plot of all US (Country = 'US') and British (Country = 'GB') breaches in Attrition's DLDOS, as of March 13, 2008.

The incident count has been normalized by dividing each series by the total number of incidents in that series. The US had 840 reported incidents, Great Britain had 33.

What does this mean? I'm not sure...

Update: Added vertical lines to graphic, in response to Lyger's comment. Left one is Choicepoint 2/15/05. Right is HMRC 11/20/2007.

Are We Measuring the Right Things?

One of the reasons that airline passengers sit on the tarmac for hours before takeoff is how the FAA Department of Transportation measures "on time departures." The on time departure is measured by push-back from the gate, not wheels leaving the tarmac. (Airlines argue that the former is in their control.) If you measure the wrong things, you create incentives for bizarre behavior.

Which is why I was fascinated to read the new GAO report, "Information Security: Although Progress Reported, Federal Agencies Need to Resolve Significant Deficiencies."

While progress may be reported, PogoWasRight calls out:

The number of security breaches on government computers has quadrupled in the last 2 years – from just over 3,500 in fiscal 2005 to just over 13,000 in fiscal 2007.

If that's progress, maybe we need some regression?

More seriously, I think it's great progress that we are talking about the failure rates. Now we need to start to question the things being measured that allow the GAO to summarize that state of affairs as progress.

I wonder, where else are we measuring the wrong things?

[Update: I was measuring the wrong agency.]

You Can't Say That: Blogging Your Failures

I forgot exactly where I saw the link to Ben Neumann's Views from the Trenches, but the opening lines of his post "Network Outage" are great, doubly for what he's just gone through:

Today was a NIGHTMARE-DAY! Globat.com just emerged from a major outage - the worst in company history and everybody - customers and staff alike - still feel extremely beaten up. Here's what happened:

At approximately 5:00am Pacific Time on Thursday, February 21, 2008 we suffered a major network outage, which effected nearly all Globat.com customers, our own Web sites and service infrastructure as well as our phone systems.

He goes on to explain what went wrong, and what he's doing to prevent it from happening again.

This sort of thing is fairly common in computer operations. People talk about what's gone wrong. And their customers, while annoyed, prefer this to the bravado and bull they get about security incidents.

In fact, it's common in a lot of industries to have failures discussed. And while it leads to some Monday-morning quarterbacking, it also leads to operational improvement.

Analyzing the Analysts

In Things Are Looking Up For TJX, or, Javelin Research - Credibility Issues?, Alex takes a look at research released by Javelin, and compares it to some SEC filings. Javelin is making the argument that companies that suffer massive breaches will lose market share. As do these folks at Response Source: "LATEST NATIONAL RESEARCH REVEALS LACK OF CONSUMER TRUST IN THE SECURITY OF PERSONAL DATA IN THE UK."

The trouble is, consumer behavior seems un-impacted.

Also in the looking at Javelin department, Chris Hoofnagle writes about "Making the Known Unknowns Known," which gets some additional thoughts from Dan Solove, in "Requiring Banks to Disclose Identity Theft Statistics." It's a very good and reasonably short article that makes the argument that the fraudsters have figured out weaknesses in the US banking system that aren't getting analyzed in a systemic way.

If this data thing were organized, it would be like a movement.

I've Made Up My Mind, Don't Bother Me With the Facts

The report, Educational Security Incidents (ESI) Year in Review, spotlights institutions worldwide, and Penn State was included in the report with one data breach last year.

...
"My goal with ESI is to, hopefully, increase awareness within higher education that not only is information security a concern, but that the threats to college and university information is not as simple as network and/or computer attacks," Adam Dodge, ESI creator, wrote in an e-mail.

...
The report also shows the majority of information breaches at colleges came from unintentional leaks, rather than hackers. But Penn State Information Technology Vice Provost Kevin Morooney said he isn't sure how deeply anyone should read into the report.

"I'm ignoring the report," he said. "Hackers are a constant and daily threat at the university, and we have many things put in place to mitigate the risk." (Emphasis added.)

"Security of data analyzed in study," The Daily Collegian at Penn State.

Adam Dodge runs the "Educational Security Incidents" blog, and his "Year In Review" is worth a look.

I hope that Vice Provost Morooney had other things to say about a comprehensive approach to security. Because otherwise, he's made up his mind, and don't wanna be bothered with no facts. A sad position for anyone at a University to take.

US Banks Rated for Identity Theft

Chris Hoofnagle has completed a paper which ranks US financial institutions according to their relative incidence of ID theft, based on reports to the FTC by consumers who named an institution.

Chris (like another Chris I know) would like to see more complete information on ID theft available to consumers, so they can make informed decisions about with whom to do business. In an earlier paper, he argued that banks should publicly disclose identity theft statistics.

From the current paper's abstract:

There is no reliable way for consumers, regulators, and businesses to assess the relative incidence of identity fraud at major financial institutions. This lack of information prevents more vigorous competition among institutions to protect accountholders from identity theft. As part of a multiple strategy approach to obtaining more actionable data on identity theft, the Freedom of Information Act was used to obtain complaint data submitted by victims in 2006 to the Federal Trade Commission. This complaint data identifies the institution where impostors established fraudulent accounts or affected existing accounts in the name of the victim. The data show that some institutions have a far greater incidence of identity theft than others. The data further show that the major telecommunications companies had numerous identity theft events, but a metric is lacking to compare this industry with the financial institutions.

This is an area fraught with methodological challenges, many of which are due to sparse (or, as I have intimated with regard to ID Analytics for example) proprietary data. Chris' paper simultaneously shows what can be done with what we have, and why we'd be better off if we had more.