« Your Evening Delusional Puke Fest | Main | I Can Think Of Worse Titles »

Rush To Judgment

Joshua Marshall has the story of the investigation into the leaked Democratic memos at the Senate Judiciary Committee. Marshall repeats the San Francisco Chronicle article that leads off with a technical inaccuracy. A full read of the article reveals that the Committee has 4 servers, and no mention of separate secure data networks. This is not how systems are usually designed on Capital Hill. All four servers were likely all attached to one network. The reporting that data was obtained from "the secure computer networks of two Democratic senators" is most likely factually untrue. The data was on one or more servers reserved for the use of the Democratic senators. The Committee network would be home to all the members and staffers data. The use of the space on the servers would be allocated for use by various groups and individuals. There is a difference - The Chronicle article attempts to make the access more sinister than it was.

Kevin Drum, in the title to his post Republican Hackers, introduces more sinister language by using the term "hacking". At this point this is baseless a leap forward in the allegations. Based on what evidence is the term "hacking" being applied? It certainly isn't based on any information presented by Committee Chairman Orin Hatch. There is no mention of the term hacking by Hatch, in fact there is an explicit avoidance of any characterization other than that files had been "improperly accessed."

Note to bloggers: hacking and improper access are not synonyms. Hacking typically involves defeating established security and access control mechanisms. As foreign as the concept may seem, Congress utilizes the latest in LAN technologies. All users have accounts with varying levels of access controls. There are always super user accounts that have access to all files regardless of the access controls in place.

Before rushing to conclusions, especially in the absence of facts, you must eliminate the most likely scenario before jumping to your own conclusion. No one has yet produced a shred of information that anything more than unauthorized access occurred (i.e. a user accessed a file in a location that they were not supposed to have rights to or normally access). Regardless of the access controls in place there is always at least one account with the ability to override those controls. The LAN administrator was likely a Republican staffer hence, given the lack of publicly available information to this point, the most likely suspect. No hacking required.

In addition the likelihood of internal hacking, as opposed to unauthorized access, is greatly diminished in cases where the unauthorized access is internal rather than external.

Atrios ominously includes the text of 18 U.S.C. 1030 (a)(3) concerning U.S. Government data security. He fails to note, that as with most laws, Congress is exempt***. There is a reason that most of the discipline is handled internally in Congress: A) Both parties like it that way; and B) Most laws don't explicitly apply so Congressional rules are used instead.

None of this is intended to diminish the significance of the allegations. Staff members found responsible should be terminated and tighter security should be enforced. As someone with Capital Hill IT experience I can attest to the often conflicting demands and requirements placed on IT support staff and vendors by elected officials. Committees are the demark point where information from both sides of the aisle are available on a shared system. The system in place was put in place by both Democratic and Republican members and any lapses in security are likely well known by industrious staffers in both parties. In this case it appears staffers were caught, but it is delusional to think that this is the first occurrence or that either party has a monopoly on "hijinks" when it comes to the Committee networks. I've been involved with those systems and users in the past - I'll leave it at that...

*** I do not explicitly know that Congress is exempt from this act, but it not listed here as applicable.

Update: Matthew Stinson notes that this kind of action is hardly unique. John Cole wonders how dumb are Democrats . To his credit Daily Kos is a little less expansive with the known facts in reporting the story.


TrackBack

Listed below are links to weblogs that reference Rush To Judgment:

» Matthew J. Stinson | weblog linked with Technology, politics, and snooping

» De Doc's Doings linked with Where there's smoke...

Comments (4)

There is a very, very large... (Below threshold)
Paul:

There is a very, very large probability it was poor security not a hack. (or more accurately a crack)

90% of computer security problems are not that somebody actively got thru security but that there was a whole a mile wide.

I think the bigger question is why does just one party on one committee need 4 servers? If that is any indication of the level of IT expertise in the place, I'd hold off calling anybody a hacker. Statistically it is far more likely whoever was doing security let that person go where they should not.

But I gotta say... I love the liberals who did not see a problem releasing classified information to win and election and did not see a problem keeping someone off the Federal bench because they are a minority suddenly embrace this story.

I bet the media will report on the story and never mention what the memos say.

So are you suggesting that ... (Below threshold)

So are you suggesting that the various staffs on Capitol Hill apply no security at all to their servers? They just leave them open to everyone and hope that no one ever takes a peek?

I mean, I guess that could be the case, but it hardly seems likely. Enabling password protection is not exactly rocket science, and breaking a password is indeed hacking.

But if, as you suggest, it was really a Republican LAN administrator who did this, that's *more* sinister than hacking. Hacking is hard to do and you can protect against it, but there's nothing you can do to prevent a superuser from gaining access to your files. If that's really what happened, it's the worst possible kind of subversion.

It's not that they apply no... (Below threshold)

It's not that they apply no security, it's closer to what Paul touches on... In a Windows NT network password security is tied to the logon ID, there is no separate passwording of files (generally). If you gain access to the identity of another or if they put files in a folder where the Everyone group has acccess you can get to the files.

There so many possibilities that do not involve hacking (workstations left logged in, improper permissions) that frankly it's unlikely that any sort of password cracking was done. It simply wouldn't have been necessary. Other possibilities involve social engineering (obtaining passwords improperly) but given that there are still network users who leave their passwords on a Post-It note attached to the monitor even that is more effort that would usually be required.

However access was obtained it was wrong, but the technical abilities of most Hill users doesn't rise to the level required for hacking.

So are you suggesting th... (Below threshold)
Paul:

So are you suggesting that the various staffs on Capitol Hill apply no security at all to their servers? They just leave them open to everyone and hope that no one ever takes a peek?

Well- Quite probably. Or maybe something close.

The admin clicks and drags the name of a Rep staffer into a Dem group or some other simple goof. This is FAR more common than a paper pusher cracking their way thru a properly secured server.

There might be a geekish republican staffer up to no good. But quite frankly as someone who has admined more servers than I can remember that is sort of a long shot. It is the simple things that bite you on a server not the complex ones.

As for it being a Republican server administrator, I personally think that is the longest shot of all.

Still I find it amusing that you liberals don't mind the fact that Democratic SENATORS conspired to keep minorities off the Federal bench and you don't mind that Democratic SENATORS planned leaking classified information simply to win an election but you are outraged that a STAFFER might have done something wrong while obtaining the proof.

But your side often makes distinctions like that.

Paul

The other very large possibility is that some Dem staffer used their name as their password or something stupid like that. (or logged in on someone else's workstation and walked away. etc etc) Again, I'm tossing our examples to suggest the same point, it's the little things that bite you more often than not.




Advertisements









rightads.gif

beltwaybloggers.gif

insiderslogo.jpg

mba_blue.gif

Follow Wizbang

Follow Wizbang on FacebookFollow Wizbang on TwitterSubscribe to Wizbang feedWizbang Mobile

Contact

Send e-mail tips to us:

[email protected]

Fresh Links

Credits

Section Editor: Maggie Whitton

Editors: Jay Tea, Lorie Byrd, Kim Priestap, DJ Drummond, Michael Laprarie, Baron Von Ottomatic, Shawn Mallow, Rick, Dan Karipides, Michael Avitablile, Charlie Quidnunc, Steve Schippert

Emeritus: Paul, Mary Katherine Ham, Jim Addison, Alexander K. McClure, Cassy Fiano, Bill Jempty, John Stansbury, Rob Port

In Memorium: HughS

All original content copyright © 2003-2010 by Wizbang®, LLC. All rights reserved. Wizbang® is a registered service mark.

Powered by Movable Type Pro 4.361

Hosting by ServInt

Ratings on this site are powered by the Ajax Ratings Pro plugin for Movable Type.

Search on this site is powered by the FastSearch plugin for Movable Type.

Blogrolls on this site are powered by the MT-Blogroll.

Temporary site design is based on Cutline and Cutline for MT. Graphics by Apothegm Designs.

Author Login



Terms Of Service

DCMA Compliance Notice

Privacy Policy