US Customs Database Of Traveler Photos Was Hacked And Stolen

https://www.buzzfeednews.com/article/daveyalba/the-us-governments-database-of-traveler-photos-has-been

by pseudolus • 7 years ago

825 198 7 years ago

wil421• 7 years ago

CBP database with images of travelers and license plates breached via a subcontractor with access to CBPs network. Updates to follow.

Nothing else in the article.

spsrich2• 7 years ago

Astonishing! I never thought for a moment this data would end up getting lifted !

mehrdadn5• 7 years ago

Where did the license plate information come from?

tareqak2• 7 years ago

Just a guess, but maybe the CBP takes pictures of the license plate at land border crossings?

docbrown• 7 years ago

if not pictures, i would say license plate numbers are at least recorded digitally inside of their report.

Spooky23• 7 years ago

CBP does more than that.

They have a joint venture with DEA to have fairly comprehensive coverage of interstates. Also, private companies offer LPR services and sharing, not sure if this company did or if that database was breached.

ggcdn• 7 years ago

I would think it's from cameras at vehicle border crossings. You can see an example here: https://goo.gl/maps/GRAY5GVnAYLr7aSZ8

mehrdadn5• 7 years ago

Ohh I see, okay thanks.

velosol• 7 years ago

Not just land border crossings - there are also CBP-maintained checkpoints [1] within the '100-mile zone'.

[1] https://goo.gl/maps/Nfk1XjUFGsNh5QD29

jonahhorowitz• 7 years ago

Who could have predicted this would happen?

melan13• 7 years ago

anyone ? Why is a 3rd party given the ability to store such a large database to conduct such business ? They should at most store the last 3 months border documents, nothing older than this.

juandazapata• 7 years ago

I _think_ OP was trying to be sarcastic.

dmitrygr• 7 years ago

A large collection of valuable data that was questionably secured was somehow stolen!? Say it ain't so!

axaxs2• 7 years ago

On May 31, 2019, CBP learned that a subcontractor, in violation of CBP policies and without CBP’s authorization or knowledge, had transferred copies of license plate images and traveler images collected by CBP to the subcontractor’s company network
CBP ... is closely monitoring all CBP work by the subcontractor

What. In the private sector, they'd have been fired and probably legal action levelled against them. The CBP's punishment for this is 'monitoring'? Please tell me I'm reading this wrong...

txcwpalpha7• 7 years ago

Sounds like pretty standard PR legalese to me. I guarantee that the same is going to happen to the subcontractor (after a lengthy investigation, to be sure), but it's bad practice to go throwing around public legal threats, especially for the government which likely has a multi-hundred page contract with these people, and especially at such an early point in any investigations going on.

r00fus• 7 years ago

This is unless the corruption includes those who are managing the subcontractor identified. In which case, the subcontractor is blacklisted and the people responsible move onto another company (ie, Initrode vs. Initech).

idlewords3• 7 years ago

Remember the time Experian got hacked and the CEO subsequently retired with a $90M payday? The private sector is just as consequence-free.

fuzz4lyfe• 7 years ago

Only politically connected companies, if you and I ran a business like that the outcome would have been different. The state has no problem going after small businesses.

mehrdadn5• 7 years ago

Experian got hacked? Or are you referring to Equifax? I thought Experian was one of the ones with better security.

acdha2• 7 years ago

“In the private sector” covers a lot of ground and I have extreme skepticism about your faith in the process unfolding that way: ask yourself how many breaches you’ve been part of and whether anything more than a press release happened along with waiting for the news to die down. How many customers did Experian lose?

(In the enterprise software world, I can tell you how epic failure to perform on an 8+ figure contract unfolds: the sales guy takes a VP out to the next game so they can discuss it over drinks in the corporate box and nothing will change)

dijit• 7 years ago

I don't have _much_ experience with this but when I worked for a UK based e-commerce SaaS provider (which was focused on image, so, ymmv) we completely buried a contractor for using sub-contractors which didn't follow our data security standards (which the contractor knew about).

a breach wasn't found, but that contracting company eventually became bankrupt under the weight of our negative press and litigation. I know that this is essentially bullying but it was used as an example to other contractors who might try something like that.

Incidentally the SaaS provider no longer exists, gobbled up by netsuite (which was, itself, acquired by Oracle).

all_blue_chucks• 7 years ago

How many customers did Experian lose?

Experian didn't lose any customer data, though. They only lost data on their products. Their actual customers had no reason to stop paying for their services.

781• 7 years ago

In the private sector, they'd have been fired and probably legal action levelled against them

Tell me again one meaningful action against a data leak in the private sector. I'll wait.

munk-a4• 7 years ago

Don't you remember how Equifax was hacked into and their stock price briefly dropped? Then they were burdened with all those email addresses people entered to check their credit... And they had to pay the ultimate price by spamming those addresses constantly with advertisements, and that's not cheap!

axaxs2• 7 years ago

The issue in question isn't so much the breach, but the misuse of data by the subcontractor. I've personally witnessed people be fired for this, and know of lawsuits that exist for this specifically, and that's just at the company I work for...

morpheuskafka• 7 years ago

They probably are doing some sort of critical service that can't be immediately stopped. That doesn't mean they will get contracts in the future or won't get legal action taken, but it takes time to review all that with the DOJ and decide how to proceed.

megaremote• 7 years ago

Ha. In the private sector, we discovered a vendor was using an actually health database with real users in it for testing their app. It was all covered up, with no monitoring, because we recently bought that vendor.

diveanon• 7 years ago

Equifax is in the private sector.

asveikau• 7 years ago

If this is a subcontractor, it is the private sector.

smsm42• 7 years ago

I'd expect at least huge fine and re-evaluation of the whole contract (it could be they are unique provider that can not be replaced, but more likely there are other options). Looks like causing private data of hundred thousands of people to be stolen is regarded as a minor thing not worthy of real punishments.

d33• 7 years ago

CBP requires that all contractors and service providers maintain appropriate data integrity

Requires, but how do they enforce it?

utefan001• 7 years ago

The sad truth is Congress is the biggest offender of poor network security practices. Every time they bring in Equifax, DHS, etc to explain why they didn't practice basic IT security due diligence or due care I am reminded of the time smart people were hired to implement basic network security for Congress. Once they realized Joe in IT (who was hired to keep hackers out) can see Congressman Bob has a foot fetish, fish fetish, whatever, Congress told IT to turn everything off.

drtillberg2• 7 years ago

Not far off from what it turns out (after investigation) really happened![1]

[1] https://en.m.wikipedia.org/wiki/Imran_Awan

vageli• 7 years ago

Not far off from what it turns out (after investigation) really happened![1]
[1] https://en.m.wikipedia.org/wiki/Imran_Awan

I don't see how that link supports your conclusion? From my reading of it, no data was stolen by Imran Awan?

chuckgreenman• 7 years ago

If only someone could have seen this coming, you know, outside of the thousands of people that saw this coming. This is just one of many reasons why mass surveillance is a terrible.

dsfyu404ed2• 7 years ago

Why is it terrible. Sure this has the potential to have negative consequences for the people who's data it was but as far as the government cares it's working fine.

roboys• 7 years ago

Now the innocent muslim community (who I expect are over-represented in these databases) gets to enjoy identity theft.

It's just a pile on at this point.

mattnewton3• 7 years ago

Well, I guess I believe the whole government for the people by the people bit so something that is bad for the people should be bad for the government.

sbov• 7 years ago

It's not clear to me if the whole database was downloaded and leaked or just part of it. Anyone know?

lsllc• 7 years ago

Rule #1 about databases: It will be hacked. Rule #2: see rule #1

izzydata3• 7 years ago

That would imply that security is irrelevant. Maybe you should re-work your rule the say that it will attempt to be hacked. Therefore you should always worry about security.

PascLeRasc• 7 years ago

Either that or rework what data you collect so that when you get hacked/leaked it's not as big a deal. Or don't collect data at all.

tgragnato• 7 years ago

I think OP is arguing that you should worry about security AND collect only what's strictly necessary.

smudgymcscmudge• 7 years ago

I'm with OP here. You just shouldn't have unencrypted, sensitive data in a database.

PeterisP• 7 years ago

It doesn't imply that security is irrelevant - it's just that you shouldn't really expect to succeed in preventing all attacks (since noone does), just reducing their number.

This implies that in addition to reducing the likelihood of breaches, you should also focus on all the other aspects of security, especially detection and mitigation; and for databases one of the main ways of reducing the impact of breaches is to avoid storing sensitive information as much as possible. In this particular example, was it really necessary to store pictures of license plates beyond a very limited period of time? A breach can't leak what you don't store, and you will get some breaches.

txcwpalpha7• 7 years ago

Security is not irrelevant, but that doesn't mean that everyone won't be hacked. There is a saying in the security world: "there are two types of companies: those that have been hacked, and those that just don't realize yet that they've been hacked".

Of course we shouldn't just 'give up' and stop trying to improve our security, but the unfortunate truth is that breaches are practically inevitable. In addition to constantly striving to improve our security, our society also needs to start investigating ways to make it so that breaches are less impactful (for example, stop using SSNs as any type of secret identifier, so that if an SSN database is breached, it doesn't matter).

0xffff2• 7 years ago

That's absurd. This statement is exactly why we use algorithms like bcrypt to store passwords. If we could be confident that our database wouldn't be hacked, we could just store passwords in plain text and save a whole lot of CPU cycles.

matz1• 7 years ago

no, the goal is not to make it unhackable because its impossible but to make it really really costly/difficult to be hack.

PopeDotNinja• 7 years ago

At a minimum, if something is secure by design, there's way less to worry about.

taneq3• 7 years ago

Security is relevant, it's what determines how long until you're hacked.

netsec_burn• 7 years ago

Sounds like Perceptics.

mzs2• 7 years ago

seems very likely, wapo journo broke this and it's alluded to: https://wapo.st/2ItjHfW

sehugg• 7 years ago

The Register reported the Perceptics breach on May 23: https://www.theregister.co.uk/2019/05/23/perceptics_hacked_l...

idlewords3• 7 years ago

Yes, one of the bright lights at CBP left the name in the title of an otherwise redacted Microsoft Word document, confirming that it's them.

exabrial• 7 years ago

Great, maybe it can fine itself for the breach. And by that, meaning it can return my tax money to me.

freewizard• 7 years ago

I would like to know:

how many individuals and vehicles has been impacted?

anyway we can hold the agency and its contractors accountable for this issue?

dannykwells• 7 years ago

We are living in a boring, yet somehow equally terrifying, dystopia.

dflock• 7 years ago

https://www.reddit.com/r/aboringdystopia

mehrdadn5• 7 years ago

Seems reasonable for the federal government to pay states to send new license plates to affect the compromised ones? I'm not under the impression license plates aren't recorded in public anyway, but still.

dwho168• 7 years ago

Funny how I was just reading another article about this this morning..

https://www.washingtonpost.com/technology/2019/06/10/your-fa...

pseudolus• 7 years ago

Fair compensation to those whose biometric information has been compromised should, at the very minimum, include free plastic surgery - in similar situations where social security numbers have been offered the government has provided new replacement social security numbers, so there is precedent. Seriously though, this highlights the danger of databases of biometric information, there's no way of remedying the damage because there's no credible way of altering one's personal biometric markers.

dawnerd• 7 years ago

Or let this be proof that biometrics are a terrible way to verify someone's identity.

souterrain• 7 years ago

If CBP is not directly forthcoming with facts relating to the breach (specifically, whose information was unlawfully taken from the CBP production network) how does one seek redress for the harms created by the actions of the contractor?

txcwpalpha7• 7 years ago

This is yet another reminder that managing the security of your company's third party contractors is just as important as managing your own company's security. Security is a game of weakest links, and it wouldn't have mattered if CBP's internal security was the best in the world if they were allowing access to a third party that doesn't have good security.

It is naturally very difficult to enforce security mandates on a company that isn't your own, but I feel that this is one of the best ways we can improve security overall in our society: companies need to start requiring that everyone they do business with have a strong, independently certified security program, or else no contract will be signed. This is already done for things like data center contracting, but it should be much more widespread and encompass every type of b2b deal.

dpau• 7 years ago

From the article: "The subcontractor's network was then hacked, though CBP said its own systems had not been compromised."

No, actually your system was compromised by allowing the subcontractor to copy the data to another, more insecure network.

canada_dry• 7 years ago

requiring that everyone they do business with have a strong, independently certified security program

As a start how about requiring ISO 2700x security certification?

ljm4• 7 years ago

According to the report, CBP is passing the buck on this one.

They created policies that could be ignored. That’s on them. They shouldn’t be able to use their position to avoid accountability or to scapegoat their contractors (that they likely hired without due diligence).

Government agencies should never be seen as victims. They hold power and authority that nobody else can hope to enjoy. There is no higher power to hold them to account because the electorate had already been subverted to maintain their position. So they should not be protected from fucking up. In this context, God or the Lord is not a higher power, it is also a scapegoat.

With great power comes everybody else’s responsibility... said only by people in this century.

Edit: to follow this up, CBP is also the agency that sucks up all the data on your phone and laptop. They have treasure troves of license plates, passport photos, and titty and dick pics.

They cannot absolve themselves of liability when they are invading everybody’s privacy. If they say they don’t use the data, and they are acting out of ignorance, then that’s a solid case for not collecting it in the first place.

As it stands, the US needs a GDPR.

kevin_b_er• 7 years ago

Indeed. CBP made the choice to subcontract w/o proper controls. It is still CBP's fault.

MrMorden3• 7 years ago

Given that the contractor violated the data handling rules in their contract, the only possible remedy is revocation of their facility security clearance, followed immediately by revocation of the personnel security clearances of everyone who claimed that these systems were operating in accordance with their SSPs.

I'd like to believe that this will happen, but I've seen plenty of cause for FSCs to be revoked and almost no FSC revocations.

gcb0• 7 years ago

made the choice to subcontract w/o proper controls

seems to have worked out very well for the army, and their contractors.

So well in fact, that a senator is on a campaign to pass legislation to specifically address the military case (leaving cases like the CBP which should be as obvious as from the get go, to be dealt individually too). The system is so broken in its lack of accountability that even well intentioned people are driven to insanity as the norm.

pvg2• 7 years ago

Government agencies should never be seen as victims.

That's a weird absolute, and that's before the side dish of theology and... Spiderman? You can be powerful or negligent or whatnot and still be a victim.

jgust• 7 years ago

In this case, CBP is collecting this data without the direct consent of _the people_, so who in this case is accountable?

It's not _the people_ who made the decision to collect this data.

TheSpiceIsLife• 7 years ago

They cannot absolve themselves of liability when they are invading everybody’s privacy.

This is incorrect. They can absolve themselves of liability an act with impunity.

You and I might not like that, but it is fact.

ljm4• 7 years ago

I accept it as fact insofar as it actually happens, and calling it a fact makes it immutable.

I think that giving the benefit of objectiveness makes it easier for them to continue down this path.

sailfast3• 7 years ago

There’s a lot going on here, and I’m no fan of CBP but this is pretty much a low-grade by the book contractor failure here. They receive training on all of these things, and have gone through a lengthy award and due diligence process and then all it takes is one person thinking “hey I think I’ll take a sample dataset back to my Dev laptop to test things.” Could be a newbie or a senior - who knows, but it’s happened before.

Go after CBP for constitutionality of collection, for working outside of borders where they are legally not allowed to work, etc, but in this case I’d say let’s not blow things too out of proportion.

Remember when OMB lost hundreds of thousands of detailed compromising personal background check reports with all the identifying information including biometrics? This sounds like some port of entry data you could get with a camera in public.

Further: they are not absolving themselves. They are probably working their asses off right now to make sure this never happens again but somebody is going to pay for credit protection and insurance, and it should be the contractor that ignored their contract and all sensible security policy. So, there is is in the press release.

Lastly: I don’t think GDPR fixes this. Government (especially intel community and law enforcement) keeps the data as long as their record schedules allow.

Thankfully, laws about breaches required them to reveal this to us within a certain time. Privacy Officers have really hard jobs. To do them well is hard and thankless. Glad this one stuck to the law.

_emacsomancer_• 7 years ago

There’s a lot going on here, and I’m no fan of CBP but this is pretty much a low-grade by the book contractor failure here.

Maybe government agencies shouldn't be allowed to contract out. And if they are, then they should be held ultimately responsible for their choice of contractors.

rasengan• 7 years ago

I’m shocked that there aren’t a bunch of public resignations. I’m also shocked that there aren’t more details - for example - let us know the scope of all the data that company had access to, so we can get an idea of the maximum exposure the public faces.

javagram• 7 years ago

“Initial information indicates that the subcontractor violated mandatory security and privacy protocols outlined in their contract,” the statement read.

Could this lead to criminal charges? Perhaps charging the contractor under CFAA for unauthorized access?

olliej• 7 years ago

Only if the contractor was not meant to have access to this data. I would put money on them being contracted to "securely manage" the data CBP accrued without consent.

lifeisstillgood2• 7 years ago

Can I play devils advocate here?

This is, of course, a serious breach and there will and should of course be consequences for the negligent parties

but

I am struggling to see the threat model being faced here.

biometric data is just a username. I flash my face around all day, and am careless as to where I leave my thumbprint.

The loss of so many photos and names is unlikely to have national level consequences (Compare this to say the Office Of Personnel management breach from some years back - that has horrible implications for US National security for decades) and the personal level consequences are ... hard to see

What this does underline is that we are outrageously careless as an industry with our data (comparable to early industrial "pollution" as Schneier points out). And it is not going to get better without a) career and business ending consequences b) new ways to store / secure data c) a new way of thinking about who owns and what is personal data

Personally I think we need a new form of intellectual property (just as we are trying to work out what kind of company FAANG are (not telcos, not newspapers, what is a platform?) we need to ask what is personal data

This comment is presumed under law to be my property, my copyright. I might license that property away (dunno never read HN T&Cs) but it is mine. But google and apple and others will track that I sat down at a certain time and place to write it, my ISP will see when I sent to which servers.

All of that data is also created by my conscious actions - should that data not also be my property. And if need be licensed - and compensated for its use?

And when (if) my data is held - then we should presume that it can be accessed by my agents for my benefit (from spending patterns to heart data). I would argue that Sometimes surveillance can be good for us - but only in ways similar to doctors knowing more about me can be good for me - the entire industry of medicine has individual interests at its heart and took a long time to get there.

We are heading in that direction (perhaps) but till we get there, carelessness will be the cheapest option, surveillance always bent agansit is (by state or other actors). We should rail against this stupid dumb breach, but punishing the "bad guys" is not even the first step on the road.

If I can make a bad analogy - It's not one incident that people got sick from one chef badly cooking chicken - it's we need to look at factory farming and meat consumption and healthy eating and marketing bias as a whole.

Macross8299• 7 years ago

I am struggling to see the threat model being faced here.

We don't really know the full details of the breach, but if the facial recognition database contained names in a column associated with pictures, that data can absolutely be leveraged and cross-referenced against other "fullz" for fraud that even passes a lot of online verification procedures.

lifeisstillgood2• 7 years ago

I agree that we don't know what was lost, and it could easily be waaay worse than I imagine

But this kind of comes back to my point - why do we have online verification systems that rely on things like knowing my address in the last three years - Equifax breach should have meant we gave up on using a credit risk scoring system as an identity provider.

But we don't.

We need to rethink what is identity (start with web of trust) and who owns data that links to that identity.

I mean this could be the start of a positive identity provider - grab that downloaded database and provide a system that says this is a picture of Paul Brian's face, and his passport, and on the 20th August last year a official of the US government compared them in real life and verified they matched (there may even be a hash of the digital images made at the time but I should not get my hopes up)

Now make that globally available. Is that useful and valuable - I think so. I would prefer if I had been able to upload my public key to that at the same time (I can always visit NYC again) but you get the idea. This leads to question like why does my passport not generate a key pair for me to use? Can I use facial recognition to match my gravatar / facebook / twitter ? Why is knowing a non-secret (mother's maiden name, passport or drivers license number, three digits on back of credit card) seen as security?

Why is it we use what we have to hand and not what is needed? Why don't american banks use chip and pin?

It's not bad that my online identity is clear and visible - as long as the legal and practical frameworks exist to support it - which they basically don't right now but we could make it happen

SanchoPanda• 7 years ago

"...though CBP said its own systems had not been compromised."

That's one way of looking at it.

cjhanks2• 7 years ago

The only way to prevent hackers from getting access to databases that contain our names, picture, and license plate number - is to never create such a database.

EForEndeavour• 7 years ago

Correct me if I'm being overly cynical, but this is an oft-repeated truism that is as useless as "the only winning move is not to play." It's technically the truth, but what are we supposed to do, revert all information systems to non-electronic media? What is the intended takeaway from this statement? If anything, it absolves data security efforts of responsibility by pointing out that there's always a chance of data breach as long as there is data.

That's trivially true, but the proper response to bad security is good security, not shutting down the whole system.

realusername• 7 years ago

They did not have to take a picture of that many travelers in the 90s (let alone social media which did not exist) and it wasn't less secure either. They probably never considered if their program is any useful or if it creates more harm than good.

mkagenius• 7 years ago

1. Do not collect unnecessary information.

2. Delete information after use.

maskedinvader2• 7 years ago

I am not going to speak for the OP, but the way I would read it is, don't keep centralized pot of gold,aka centralized servers, don't do dumb lazy things aka plain text passwords, etc, don't collect all that extra data, store data with good encryption,don't trade short term convenience for long term harm , FWIW, my personal view is that we should keep pushing for both , less data and more security for the little data we allow our governments or private companies to collect

oska• 7 years ago

an oft-repeated truism that is as useless as "the only winning move is not to play"

Not sure why you see that as useless; it's basically the moral takeaway from Hamlet. There are many situations where it's best to not join in 'the game'.

cheschire• 7 years ago

there are ways to store this information without storing the photos. Developing signatures which are stored and discarding the photos, for example. Consider how a site like haveibeenpwned works.

The photos themselves are pretty useless anyways. A database of images will only ever be searched by an ML algorithm for which signatures should be good enough anyways, or manually, based on highly specific timestamps, by some form of police.

cjhanks2• 7 years ago

The objective afaiu was to expedite entry into the country by creating a database of faces and personal identity information. And that's a great objective.

But often the risk of personal harm outweighs the benefits. And in the case of digital assets the question is when, not if this personal data will be exfiltrated. And when it is, that is often more inconvenient than any potential convenience benefits.

lostmyoldone• 7 years ago

Except for simply not collecting the data, the only other option is making the cost of retrieval be equivalent or greater, irreducibly, to the expected value of keeping it.

Approximately, the digital equivalent of having a human rifle through filing cabinets to get to that one folder that is actually important.

To this day, the only reliable way to achieve this has been printing things on paper, especially if put in individual folders do that even OCR efforts take some human work.

Time spent by human hands are, in a way, the only somewhat fair currency to measure privacy in.

taneq3• 7 years ago

And this is the same group that can force you to give them your social media credentials on entry. Terrific.

Edit: Wait, just social media handles/account names, not login details. That's less ridiculous. My mistake.

DrJokepu• 7 years ago

If someone hacks into the DHS or DOS database and gets your ESTA / visa application information, trust me, your social media handles leaking will be the least of your problems, there's plenty of juicier information about travelers in there already.

sokoloff• 7 years ago

Credentials or just account names?

maerF0x0• 7 years ago

The goal isnt to prevent it in an absolute sense. The goal is to raise the cost to either above the value of the data contained therein or compared to other direct means, like in person espionage or military actions.

zxcb1• 7 years ago

Single points of failure via centralization, comparable to monoculture in farming

savethefuture• 7 years ago

The photos were transferred to a subcontractor’s network and later stolen through a “malicious cyberattack,” a CBP spokesperson told TechCrunch in an email.

Anyone think they approved the security of that subcontractor before giving sensitive information to them?

More importantantly, why is that type of data leaving CBP in the first place?

a3n2• 7 years ago

At best, ads. At worst, ...

MrMorden3• 7 years ago

Compliance with NIST SP 800-53 is mandatory per statute and DHS policy. That system has an identified ISSO, ISSM, ISSPM, DAO, and AO who are responsible for authority to operate being given. If the paperwork is in place, a government employee signed off on that network's operation. If not, it doesn't have ATO and there's a government employee (the AO or CIO) responsible for allowing a such a network to be connected to government systems and store government-controlled information.

01100011• 7 years ago

I worked at a government contractor who was rolling out NIST compliance. Everyone, from IT to engineers, hated it. You can rest assured that as soon as someone isn't looking, they're going to violate it.

txcwpalpha7• 7 years ago

Anyone think they approved the security of that subcontractor before giving sensitive information to them?

They almost certainly did, actually. FIPS [1] and FISMA [2] are pretty strict requirement for every company contracting with a government agency. IMO it's one of the rare situations where, at least conceptually, the federal government has done something right in terms of security.

Now whether FIPS/FISMA, and the people enforcing it, actually have any teeth or effectiveness is a different topic entirely.

1: https://en.wikipedia.org/wiki/Federal_Information_Processing...

2: https://en.wikipedia.org/wiki/Federal_Information_Security_M...

Johnny555• 7 years ago

If Fedramp is like other security certifications, written policies can be used in lieu of actual enforcement.

A policy could be something like:

"Vendor shall not move sensitive data out of CBP's secure network"

So it's pretty much on the honor system. And some new employee at the vendor may not even be aware of all of the policies they are supposed to be following. The vendor is still reponsible for that employees actions, but it can be discovered too late (as in this case, the breach was already made)

But instead of just a written policy (among dozens or hundreds of others) that people are expected to abide by, this could be enforced by limiting the vendor's access to the network. For example, by counting how many records they access, how many bytes of data they download over their connection to the secure network, or not giving them direct access at all and exposing only an API controlled be CBP that gives them access to only the data they require)..

xvilka• 7 years ago

Most of these are so called "paper security", while some real technical vulnerabilities can effectively crash all these fictional barriers.

DigitalVerse• 7 years ago

Don't worry folks, I'm sure this won't hinder the CBP and other related agencies from continuing to roll out systems that capture ever more of our data.

whygovwhy• 7 years ago

To me the real question is why is a subcontractor able to copy the entire database? Why wouldn't the government only allow limited access to the database to these contractors?

projectileboy2• 7 years ago

I’ll just keep saying this, and getting dismissed by everyone I know - any data security discussion around a centralized data store that doesn’t begin with the recognition that that data store will be compromised, is a discussion that is just a joke.

anigbrowl3• 7 years ago

You and a whole bunch of other people making the same extremely basic observation. It would be good if you would suggest some alternative strategies, since 'don't bother keeping that data' isn't a realistic option in this context.

joeblubaugh• 7 years ago

sure it is! you don't need to keep a centralized photo db of every person who enters your country all in one place, even to build ML models on. This could have been federated in a variety of ways that would've reduced a breach risk.

Or, we could avoid building a massive surveillance network that doesn't help make our world better.

projectileboy2• 7 years ago

I’m not sure why you’re being downvoted; I think it’s a fair comment. My response is that I’m honestly not sure what the best response is. But if we start with insecurity as a given, then I feel like we could at least be exploring better alternatives around... people storing data locally and always providing it for every interaction? Maybe.

manicdee• 7 years ago

1. Don’t bother collecting the data since it is not a net gain.

2. Don’t collect data that doesn’t actually help enforce any laws.

3. Don’t produce new legislation that doesn’t actually solve any existing problems (it is already illegal to break the law).

4. The best way to keep secrets is to not have secrets in the first place. Once you have secrets the best way to keep secrets is to not share them.

munchbunny4• 7 years ago

Part of my job is designing software that is resistant to amplification once the hacker is already in, so maybe I can help here.

When you plan your security, step 1 is making it hard to get in, step 2 is making it hard to persist, i.e. plant a command and control process somewhere inside the perimeter, and to move laterally in the system, i.e. get from one service into a more important service.

There's some basic stuff, such as firewall rules that prevent outbound traffic from ports/processes you aren't expecting. That makes it harder for the hacker's command and control systems to get instructions. There's other stuff like using separate credentials for low sensitivity vs high sensitivity systems, two-stage approval processes for especially sensitive operations to prevent a single compromised user from being able to get to the good stuff, automatic password rotation so that exfiltrated tokens aren't valuable, and more.

Those are just single things though. I think the more interesting part is an exercise like this: assume that the hackers have compromised a developer's computer. In that case, what does a system look like that would prevent that developer from exfiltrating payment info? I would argue that the developer doesn't normally need access to real payment info, so maybe the network should be configured so that the developer is unable to SSH into that set of database servers without first requesting a special short-lived SSH keypair. That at least means the developer has to explicitly ask for access. That doesn't make the hacker's job impossible, it just makes it harder. Also makes things less convenient for the developer, so is it worth the trade-off? For especially sensitive data, it probably is. With this setup, maybe the hacker gets to the account information, but they're stopped short of account numbers long enough to notice the breach.

This is all on the theoretical side, but that's the thought exercise once you go "let's pretend someone compromised ____ system."

ariwilson• 7 years ago

Why does decentralization save you from compromise?

munchbunny4• 7 years ago

I wouldn't frame it as decentralization, more like compartmentalization. You harden your systems to prevent horizontal movement between services.

For example, you could try to put payment credentials in a separate subnet where they are never read out of that enclave. Access to that subnet might require separate authentication credentials that most employees don't have, and API calls might require the calling server to possess a separate type of short-lived certificate. So when the main DB is compromised through an employee, it's still hard to laterally access more sensitive data.

jacquesm• 7 years ago

You can outsource work, you can't outsource responsibility. It will likely be a long time before the various powers that be really get this.

haberman• 7 years ago

Isn't monetary liability a form of "outsourced responsibility"? I'm not understanding why damages from lawsuits are not sufficiently motivating the industry to take data breaches seriously. Maybe they just aren't awarding enough damages to change behavior?

geggam• 7 years ago

Think liability insurance, by the same companies who charge you healthcare. We are spreading the cost of irresponsible folks across society then bailing out the companies who make those choices.

icelancer4• 7 years ago

The government is never held accountable for mistakes they make. They are, in fact, too big to fail.

DoofusOfDeath• 7 years ago

The government is never held accountable for mistakes they make.

In a functioning democracy "they" is "us".

icelancer4• 7 years ago

In one that is not too large to fail, I'd agree. We have a monolithic government that has been going away from "they" since the state restricted the size of the House of Representatives and have shifted more and more responsibility and power to the federal branch.

It's no different than the same moral hazard large corporations face that we empower through cronyism and the effects are obvious, notably events leading up to the great financial crisis in the late 2000s.

Large institutions not held accountable get to take outsized risks knowing they'll always be bailed out and not held accountable. This article is one of many examples of such.

komali2• 7 years ago

We don't necessarily have a functioning representative democracy, though - too much power is held by lobbyists, the fact that politicians can lie to the population, and the fact that our votes don't 1:1 elect officials due to gerrymandering and voter suppression.

slg• 7 years ago

Which highlights one of the flaws in a first past the post democracy. No reasonable voter is going to make this issue the single issue that flips them from a Republican to a Democrat or vice versa. The result is that both parties don't really care about it. If you had some type of ranked or proportional voting system, you could get a niche political party that actually makes things like this a priority.

jMyles• 7 years ago

In a functioning democracy "they" is "us".

That notion is generally not in keeping with the western common-law tradition, which holds a more skeptical view of governments which have the moral authority to operate within any domain and with any powers so long as they can connect those powers to the consent of the governed.

Instead, the tradition of the United States, for example, is that government power is limited and enumerated and does not change no matter what "us" may say about it in the form of political elections.

I suggest that you read (just an example) Federalist 10 by James Madison and consider how thoroughly these guys thought through the argument you are making about democracy and how hard they tried to make something better.

And none of this is to amount to founder worship: we can all see now that there was tremendous hypocrisy in founding a nation which didn't categorically prohibit slavery from the get-go. And in fact, slavery continues to this day in the form of a prison system that "us" has occasionally been happy to endorse, the rights of the incarcerated be damned.

All I'm saying is: don't tout democracy in such simplistic terms without also considering the arguments of its critics.

umanwizard• 7 years ago

In a functioning democracy "they" is "us".

Leaving aside the question whether the US is a "functioning democracy"...

In a "functioning democracy", "they" is in fact very often not "us", by definition in fact, since every vote has winners and losers.

Plenty of stuff that I disagree with is electorally popular: unlimited police powers, extremely severe punishments for crimes, military intervention in foreign affairs, censoring of offensive speech, criminalization of victimless acts like drug use, cutting taxes, lack of restriction on CO2 emissions, and so on. I certainly don't define myself as part of any "we" that supports, or is implementing, any of that.

"The will of the whole Nation is expressed in the State" is an authoritarian idea, not a liberal democratic one.

dang• 7 years ago

We detached this subthread from https://news.ycombinator.com/item?id=20151327 and marked it off-topic.

Canada• 7 years ago

Great job, thanks guys. Shouts to NSA and the whole security industrial industrial complex for looking out for us. Glad to see all the research and 0day hoarding paid off. Really appreciate it.

noonespecial• 7 years ago

They've helped themselves to what seems to be limitless legal power as well as a functionally infinite budget... and still this type of incident doesn't surprise us in the least. Everyone just expects them to be one of the least competent actors in the space. And they don't disappoint. Hmmm.

lr2• 7 years ago

Quote from the article:

“There should never have been the ability to download a database like this off of government servers.”

Sorry that I don't have a ton of links to support this claim, but "believe me" (as our Commander-in-chief would say) that the US Government would cease to function if it were not for subcontractors (read, private companies) performing tasks on behalf of the government. Personally, I don't agree with this way of our government doing business, but that is the way it is.

When I was in college, I worked for an archeology lab, and our lab was the subcontractor, of the subcontractor, of the contractor that had contracted to provide a service to the USACE (US Army Corps of Engineers). And every way along the way, money was skimmed off of the top. It's just "the American way" of doing business.

People lament regulation all the time. I have a feeling the executives of Ingersoll Rand love it every time a new regulation is put into place.

Follow the money.

koolba• 7 years ago

“CBP learned that a subcontractor, in violation of CBP policies and without CBP’s authorization or knowledge, had transferred copies of license plate images and traveler images collected by CBP to the subcontractor’s company network,” said an agency statement.

How long will it take the general public and elected officials to understand that the only authorization that matters for digital data is the actual implementation. Policies, legalese, mandates or any other agreements are meaningless.

If the data can be get at from or transferred to outside of a controlled environment, it will.

mehrdadn5• 7 years ago

CBP’s networks were unaffected by the breach.

Why did citizens' private data leave CBP systems in the first place?

IOT_Apprentice• 7 years ago

The amazing thing is we became aware of this practice back in early May. It is now June and it has been hacked.

nihonde• 7 years ago

Just another reminder that there is no accountability left in America, and you reap what you sow. If you want a society that is accountable, you need to start with a culture that values honor and takes shame seriously. You can’t impose a sense of honor from the outside without building it slowly from within, any more than you can impose respect without earning it.

If you ignore these principles, you make room for people who lack self-worth, and those are the most destructive forces in a society because they have nothing to lose.

lr2• 7 years ago

Same story that is also trending on the HN homepage right now... My comment from that story which is from (https://www.buzzfeednews.com/article/daveyalba/the-us-govern...):

Quote from the article: “There should never have been the ability to download a database like this off of government servers.”

People lament regulation all the time. I have a feeling the executives of Ingersoll Rand love it every time a new regulation is put into place.

Follow the money.

grecy• 7 years ago

Quote from the article: “There should never have been the ability to download a database like this off of government servers.”

I love when I read quotes like this that are so obviously written by non-tech people that have no idea what they're talking about.

As we at HN all know, if it exists digitally, it can - and will - be downloaded. End of story.

sailfast3• 7 years ago

It is clear from the tenor of some of the posts here that more of you need to work for some non-zero time in the government so you can have some empathy / appreciation here. They’re hiring.

mattnewton3• 7 years ago

The same org separating children from their families at the border in violation of a court order? Why would I take a pay cut to work for that mission?

I don’t fault the engineers in any case, it seems like their technical security wasn’t tested here; it was some kind of policy failure that lead to the information leaving government control. And that’s the problem, we don’t solve this with engineering, or empathy for engineers, we solve this by letting legislators know what we feel and know as members of the industry, through letters and the ballot box.

sailfast3• 7 years ago

I meant government in general - not CBP. Without having worked in the federal space, it’s likely a lot of the context of this - policies, procurement, onboarding, security, etc is lost. Probably should have clarified and I deserve the downvotes. Agreed that CBP’s mission at the moment is a serious problem.

a3n2• 7 years ago

I haven't crossed the border in twenty years but I'm probably in this or a related database.

I'm a long distance trucker. A few weeks ago I was traveling north from Laredo. When i drove through the border patrol checkpoint, a bank of five or six cameras to my right flashed, i assumed getting my face, license plate, and likelihood of committing a crime in the near future.

The truck is registered to my employer, but I'm sure that can lead to me with a WHERE clause.

At the least they would know where they've seen this face in this truck. I wonder if being in a different truck would be suspicious. I guess it would be if they needed it to be.

mattnewton3• 7 years ago

And that’s why I don’t want my face as my passport.

rdiddly• 7 years ago

"First you say don't take your pictures. Then you say don't lose them in a breach. Make up your minds!"

tyleregeto• 7 years ago

Ccdwd

ChymeraXYZ• 7 years ago

Can I sue them for negligence with my personal information under GDPR as a EU citizen?

mg794613• 7 years ago

Nobody saw this coming or warn about this...

US Customs Database Of Traveler Photos Was Hacked And Stolen

Related Stories