Thursday, October 04, 2007

The Clowns at Homeland Security

ClownsHow much faith do you have in the political appointees and federal civil service apparatchiks charged with protecting you from terrorist attack?

It’s no secret that I’ve looked askance on the Department of Homeland Security ever since it was just a gleam in George W. Bush’s eye. It has always seemed to be yet another bureaucratic black hole into which freight cars full of taxpayers’ money can disappear without a trace, not to mention a convenient and lucrative backwater into which favored political cronies can be shunted.

As of today we know one thing: the Department of Homeland security can’t even keep an email newsletter’s subscriber list secure.

The blog Suitably Flip tells the story:

DHS Pulls Bookcase Of Spam Over On Self

DHS threat levelI subscribe to a Department of Homeland Security mailing list called the DHS Daily Open Source Infrastructure Report, which is basically a collection of excerpts and hyperlinks to news stories about security issues in communications, transportation, finance, and other critical sectors. The highlighted stories are frequently about cyber-security — e-mail scams, viruses, stolen laptops, etc.

Today, though, the listkeeper (the National Infrastructure Coordinating Center) is flailing in an e-mail mire of its own design.

A little after 8:00 this morning, one of the list subscribers sent a change-of-address notice back to NICC, which — upon arriving in the inboxes of every subscriber — suddenly made it clear that the distribution list was unrestricted. Anyone replying to it was (and still is, apparently) able to hit the inboxes of thousands of security professionals, including law enforcement, U.S. military, federal employees, private security consultants, etc.

The accidental exposer chased his original message with a “recall” note, but the horse had long left the barn. In the hours since, about 100 list members have chimed in, frequently in an ironically futile attempt to ask other members to stop replying, so their inboxes will stop flooding. More than 20 list members were so fed up with all the replies that they’ve sent “unsubscribe” notices (some of them more than mildly perturbed in tone), but in so doing, they’ve frequently broadcast their e-mail addresses, names, and employers to the rest of the list, which may wind up backfiring spectacularly.

So now the email addresses of everyone who subscribed to the list are available to anyone on the list. If you were a clever and resourceful terrorist who subscribed to the list to keep an eye on what DHS is doing, then you got a surprise Ramadan present yesterday: an extensive list of people with a professional interest in US homeland security.

And if you’re a spammer, you’ve got a huge list of live email addresses to add to your database of recipients.
- - - - - - - - -
Maintaining an email list isn’t rocket science, but it’s easy to make mistakes. Most of us have had the experience of being on the receiving end of one of these “bounce floods” when some list administrator checks the wrong box in his list configurations and then someone on the list hits “reply all”.

And most of us could have fixed it promptly, as soon as it was brought to our attention. But not DHS — it took those government security experts nine hours to plug this particular security hole, and by then innumerable messages bearing the email addresses of everyone on the list had passed back and forth.

The DHS response was — wait for it — to blame the list subscribers themselves for hitting “reply”:

At 1:30, the NICC tried to kibosh the insanity with this message:

All -

Please do not use the “reply to all” when responding to the emails from this email address.

The listserve email address used has thousands of recipients and causes server problems when used this way.

v/r

NICC

That, um… didn’t work. List member “Tech Guy” was stupefied by the attempt.

Are you serious? Is this actually the official response and remedy for this issue?

I have refrained from commenting up till now as to not perpetuate this issue, but this sort of response is unacceptable and just goes to prove why so many lack faith in our government and government agencies.

How about utilize some common measures to ensure that others are not allowed to send to the list. Its actually pretty simple and common place to do.

Thousands of small businesses and private individuals across the country could have dealt with the problem in a tenth of the time it took DHS to get it right. Christine, who keeps the lists at CVF and has years of experience dealing with email groups, would have fixed the error within five minutes of getting the first email from a user.

But not DHS.

The members of the list reacted with commendable distributed intelligence, the hallmark of cyberspace:

List members have now set up at least two off-site forums (this one and that one), both to keep the networking channel open and in an attempt (thus far an unsuccessful one) to divert the message flood away from the listserve.

Flip has this final update:

Update: WSJ’s Washington Wire:

Everyday, the Department of Homeland Security emails an “Open Source Intelligence Report” about the nation’s critical infrastructure to hundreds, perhaps thousands, of security and emergency officials working for corporations, governors’ offices, big city police forces and a myriad of federal agencies. It is a group of serious, security-minded people, or so one would have thought.

[…]

A senior DHS official described the incident was a “non-event” for the department’s own security. No systems crashed; no backdoors were revealed. The reaction of the security professionals on the list, he said, was “much more worrying.”

It’s been about 90 minutes since the last message came through, so the problem appears to have been fixed (incredibly, a full 9 hours after the flood began). Now that it’s been pinched off, I’ll reveal that when I tried replying to one of the messages this afternoon, it bounced off an e-mail relay at the firm that handles this listserve for DHS, which then sent me a full list of the e-mail addresses my message did not reach.

Roughly 7,000 in all — presumably every e-mail address on the DHS Daily Report distribution list.

The level of incompetence in all this is mind-boggling.

Now, to be fair, maybe DHS gets the big stuff right and doesn’t sweat the small stuff. Maybe they can handle threats to the homeland, even if they can’t handle an email list.

They’re out there with their geiger counters and their automatic weapons, dressed in kevlar vests and helmets, standing guard against our nation’s enemies. We see them at the airport wanding nuns and making kids take off their shoes. Their reassuring presence lets us know that our homeland is secure.

Fortunately for the American people, all the bad things that have happened since 9-11 have no connection with terrorism. Whether it’s the guy who ran over people in North Carolina, or the fellow who shot up the El Al counter at LAX, or the would-be Sears Tower bombers, or any of the other incidents where American were killed or injured by wackos who just happen to be Muslims, it’s nothing to do with Islamic terrorism. We know this because the Department of Homeland Security has told us so.

And if anything goes wrong, it’s the user’s fault. He shouldn’t have hit “reply all” to that email message. He should have put an extra deadbolt on his door. He should have kept off the Golden Gate Bridge when the threat level was orange, and used an alternate route…

Which would you rather count on for protection, the Department of Homeland Security, or Smith and Wesson?


Hat tip: Larwyn.

5 comments:

kepiblanc said...

His master's voice?
He still doesn't get it.

Gringo_Malo said...

The Baron wrote: "We see them at the airport wanding nuns and making kids take off their shoes."

You forgot to mention roughing up wheelchair bound 83-year-old grandmas or relieving Joe Foss of his Medal of Honor. Do you remember the scene in the movie Airplane, in which a dozen or so security guards manhandle an elderly woman on a walker while a dozen or so Middle Eastern men stroll through the metal detectors with AKs and RPGs? The Zucker brothers were amazingly prophetic.

Given a choice between DHS and S&W, I'll take Mossberg or Remington. I'm fortunate in that my work does not require me to travel. I've flown once since 9/11/01, and vowed never to do it again. My wife and I drive whenever we take a trip on our own.

I'm afraid, however, that DHS will eventually begin performing random, warantless searches on motor vehicles, and perhaps even on pedestrians. Of course, Middle Eastern Muslims will still have the run of the country, and the government will continue to admit more of them. I expect these outcomes whichever party wins the 2008 election.

Dymphna said...

gringo_malo--

We have to stop this meeting of the minds...I appear to be growing more pessimistic, since I find myself more often in agreement with your sentiments than I had previously.

I don't do commericial flights, either. OTOH, I don't know anyone with a private license so I guess we ride or walk. Even ships aren't safe.

xlbrl said...

The Department of Fatherland Security was created to avoid firing a very substatial number of F.I.B. upper echelon personel and at least one-third of the CIA for incompetence. But in government we don't cut when we fail, we add. It would look unseemly to have added under the circumstances, so this was the solution.

Subvet said...

Looking for competence in our government has become similar to looking for virginity in a house of prostitution. Pity, it wasn't always this bad.

Now if you'll excuse me, I've got some guns to clean.