Stolen NASA laptop had Space Station control codes

http://www.theregister.co.uk/2012/03/01/nasa_stolen_laptop_unencrypted/

by aptwebapps • 14 years ago

32 20 14 years ago

theregister.co.uk

There's something really annoying about the IG saying that NASA lost "the algorithms used to command and control the ISS" (emphasis mine). I understand that the laptop could have contained authentication information, including credentials, code, and/or documentation. But this seems oddly specific in a totally unintuitive and non-informative way.

Which, come to think of it, might have been the goal in his Congressional testimony, but really: this doesn't really say much useful about the incident.

jonnycowboy• 14 years ago

Yes these aren't the codes similar to nuke launch codes but rather algorithms, and software that provide a method of controlling the ISS' attitude. You'd still need an access code (presumably and hopefully not on the laptop) to be able to control it.

seclorum• 14 years ago

There's a big algorithm involved in commanding and controlling the Space Station .. fire your rockets one way, the station ends up somewhere else in orbit, and so on .. so I'd say this is quite an accurate report, actually, since the stolen laptop had the algorithm onboard to calculate when and where to fire boosters to attain certain orbits, and so on.

batista• 14 years ago

There's a big algorithm involved in commanding and controlling the Space Station

Well, that's more of a procedure (with the military sense) than an algorithm with the modern math/programming meaning.

(We do use procedures in the above sense, e.g the steps to a cooking recipy, as an analogy to algorithms in introductory books, though)

coolestuk• 14 years ago

It should be a criminal offence to have top secret national information or 3rd party personal information stored in an unencrypted format.

Even the much-hated Lotus Notes was encrypting databases back in the 1980s.

http://www.ibm.com/developerworks/lotus/library/ls-NDHistory...

It seems like it is going to take some monumental cock-up before governments prosecute people for not encrypting data. Mind you, since no-one lost their job after the monumental cock-up that was 9/11, maybe I'm just naive.

Symmetry• 14 years ago

I'd be surprised if the information was Top Secret, or even Secret - when I was working at an FFRDC we could but that on any computer that would ever be attached to the internet. I'm guessing it was just FOUO (For Official Use Only).

mvanveen• 14 years ago

Telemetry and commands for spacecraft at NASA fall under ITAR compliance (see http://en.wikipedia.org/wiki/International_Traffic_in_Arms_R...). Basically, this means that command and telemetry information must be safeguarded against access attempts by a foreign national. There are NASA employees who aren't US citizens that are not permitted to have access to this sort of information without explicit permission.

hindsightbias• 14 years ago

The STS commands documentation was marked FOUO in the 90's. NASA may have gone all ITAR since then, but I'd bet there are a lot of ISS docs and PDFs from that era that don't say anything about ITAR.

lawnchair_larry• 14 years ago

It's 2012. Zero excuse for not encrypting a laptop. If you don't encrypt a mobile device, do not be sad when someone else reads the data on it.

packetslave2• 14 years ago

Agreed, but even if your laptop HDD is encrypted, you still need to do a risk assessment as to the value of the data/code before trusting the drive encryption technology.

Example: Google doesn't allow source code on laptop HDDs, even though we use full-disk encryption. The risk of a bug/attack on FDE is non-zero, even though it is probably pretty small, so it's enough to tip the scale.

(edit: grammar)

sliverstorm• 14 years ago

So does that just mean no programming via laptops, or do you do your work on network drives? Or perhaps remote interactive session?

webjprgm• 14 years ago

I was going to ask wether using full-disk-encryption on Apple's Lion OS (aka "File Vault 2") would be sufficient. It sounds like Google is uncertain that it is.

Still, Apple's FDE is much better than no encryption at all! No excuse, NASA should require FDE on all laptops (even if they're working on something better eventually).

RobertKohr• 14 years ago

So does that mean that someone could de-orbit the space station?

jlarocco• 14 years ago

Theoretically.

Practically? Probably not. They'd need to realize what the codes were and have some way to communicate with the station.

It's possible there's software on the laptop for that, but it would go through a central server connected to the satellite dishes/antennas, and was probably locked out when it went missing.

archivator• 14 years ago

To add to that, there are people on the station who can presumably override anything sent from the ground. In fact, I believe one of their science videos showed them initiating a boost manoeuvre. As long as there are people up there, I'm pretty confident in the station's orbital stability.

Havoc• 14 years ago

Give the guys a break. FDE is tricky business, especially if you don't have 100s of engineers at your disposal.

willidiots• 14 years ago

I worked at NASA in a past life. Whole-disk encryption was banned at our center because it caused "problems" for the IT contractors. If you had ITAR/SBU data, you were to encrypt and decrypt it manually using Entrust, which is the biggest pile of dogshit PKI I've ever seen. So of course people forgot, or got lazy.

Another center was forced to keep using LEAP for years after it was broken, due to contract requirements.

I am completely unsurprised by this. Saddened, but unsurprised.

Stolen NASA laptop had Space Station control codes

Related Stories