<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: reactionary]]></title>
    <link>http://securityratty.com/tag/reactionary</link>
    <description></description>
    <pubDate>Sun, 29 Jul 2007 08:39:01 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Schneier for TSA Administrator]]></title>
      <link>http://securityratty.com/article/5e368a8d3abaf29420cf0da59287f1d2</link>
      <guid>http://securityratty.com/article/5e368a8d3abaf29420cf0da59287f1d2</guid>
      <description><![CDATA[It's been suggested . For the record, I don't want the job. Since the election, the newspapers and Internet have been flooded with unsolicited advice for President-elect Barack Obama. I'll go ahead...]]></description>
      <content:encoded><![CDATA[<p>It's been <a href="http://www.foxnews.com/story/0,2933,453093,00.html">suggested</a>. For the record, I don't want the job.</p>

<blockquote>Since the election, the newspapers and Internet have been flooded with unsolicited advice for President-elect Barack Obama. I'll go ahead and add mine.

<p>[...]</p>

<p>And by "revamp," I mean "start over." Most security experts agree that the rigmarole we go through at the airport is mere security theater, designed not to make us safer, but to make us feel safer by making it increasingly inconvenient to fly. TSA's approach to security is too reactionary -- too set on preventing attacks and attempted attacks that have already happened. And please, whatever you do, resist the temptation to let TSA workers unionize. Security from terror attacks should be a federal jobs program. You need the authority to fire underperforming screeners quickly and effortlessly. Three game-changing possibilities to head up TSA: security guru Bruce Schneier, Cato Institute security and technology scholar Jim Harper, or Ohio State University's John Mueller.</blockquote></p>

<p>Although I'd be happy to see either Jim or John with it.</p>

<p>I don't want it because it's too narrow.  I think the right thing for the government to do is to give the TSA a lot less money.  I'd rather they defend against the broad threat of terrorism than focus on the narrow threat of airplane terrorism, and I'd rather they defend against the myriad of threats that face our society than focus on the singular threat of terrorism.  But the head of the TSA can't have those opinions; he has to take the money he's given and perform the specific function he's assigned to perform.  Not very much fun, really.</p>

<p>But I'd be happy to advise whoever Obama choses to head the TSA.</p>

<p>The job of the nation's CTO would be more interesting, but I don't think I <a href="http://weblog.infoworld.com/robertxcringely/archives/2008/11/the_once_and_fu.html">want</a> <a href="http://blogs.computerworld.com/obama_cto">it</a>, either.  (Have you seen the <a href="http://www.nytimes.com/2008/11/13/us/politics/13apply.html">screening process</a>?)</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=lxRoN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=lxRoN" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=doEjN"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=doEjN" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Tue, 18 Nov 2008 10:46:24 +0000</pubDate>
      <category domain="http://securityratty.com/tag/tsa">tsa</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/mere security theater">mere security theater</category>
      <category domain="http://securityratty.com/tag/cato institute security">cato institute security</category>
      <category domain="http://securityratty.com/tag/tsa workers">tsa workers</category>
      <category domain="http://securityratty.com/tag/security experts agree">security experts agree</category>
      <category domain="http://securityratty.com/tag/attacks">attacks</category>
      <category domain="http://securityratty.com/tag/terror attacks">terror attacks</category>
      <category domain="http://securityratty.com/tag/terrorism">terrorism</category>
      <source url="http://www.schneier.com/blog/archives/2008/11/schneier_for_ts.html">Schneier for TSA Administrator</source>
    </item>
    <item>
      <title><![CDATA[Lost Bank of Ireland laptops affect roughly 10,000 customers]]></title>
      <link>http://securityratty.com/article/cdce301ad485d26f982c886b564ce0ca</link>
      <guid>http://securityratty.com/article/cdce301ad485d26f982c886b564ce0ca</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
4/22/08

Organization
Bank of Ireland

Contractor/Consultant/Branch
Drogheda, Dunleer, Bagnelstown, Court Place Carlow, Stephens Green, Tallaght, and...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/boi.jpg" align="right" height="39" width="200"><font size="2"><span style="font-weight: bold;">Date Reported: </span><br>4/22/08<br><br><span style="font-weight: bold;">Organization: </span><br><a href="http://www.bankofireland.com/index.html">Bank of Ireland</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br></font><font size="2">Drogheda, Dunleer, Bagnelstown, Court Place Carlow, Stephens Green, Tallaght, and Montrose</font><br><font size="2"><br><span style="font-weight: bold;">Victims:</span><br>"customers who either obtained a quote or took out a Life Assurance policy with Bank of Ireland Life from the following branches:<br></font><ul><li><font size="2">Drogheda</font></li><li>Dunleer</li><li>Bagnelstown</li><li>Court Place Carlow</li><li>Stephens Green</li><li>Tallaght</li><li>Montrose"<br></li></ul><font size="2"><br><span style="font-weight: bold;">Number Affected:</span><br>~10,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, addresses, bank account details and medical histories"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"DUBLIN--Four laptop computers stolen from one of Ireland's largest commercial banks contain the unencrypted details of some 10,000 customers, the bank said on Tuesday."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.bankofireland.com/press_room/latest_releases/2008/General_Content_1000257.html">Bank of Ireland</a> <br><a href="http://www.iht.com/articles/ap/2008/04/21/business/EU-FIN-Ireland-Bank-Laptops-Stolen.php">The Associate Press via International Herald Tribune</a> <br><a href="http://newsinfo.inquirer.net/breakingnews/infotech/view/20080422-132008/Irish-banks-stolen-laptops-contain-10000-customer-files">Agence France-Presse via Inquirer.net</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Data Protection Commissioner, Billy Hawkes<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>DUBLIN, Ireland: Four laptops containing the personal details of 10,000 Bank of Ireland customers have been stolen, the bank confirmed Monday.<br><br>Ireland's second-largest bank made the admission after the chief regulator, Data Protection Commissioner Billy Hawkes, told Irish broadcasters RTE he had been informed of the lost customers' data only last Friday.<br><br>Bank of Ireland said the four laptops disappeared between June and October 2007 and contained the names, addresses, bank account details and medical histories of about 10,000 holders of the bank's life insurance policies.<br><br>Commenting on the delay in reporting the thefts to the regulatory authorities, managing director Brian Forester said internal procedures had not been followed.<br><span style="font-style: italic;">[Evan] Policies and "internal procedures" aren't worth squat if they aren't communicated to all affected persons <span style="font-weight: bold;">AND </span>enforced.</span><br><br>"Unfortunately in this situation the procedures were not properly adhered to. The thefts, while they were reported to the Gardai [police], the situation wasn't escalated to the level of management it should have been, through a human error," he said.<br><span style="font-style: italic;">[Evan] Yes, human error indeed.&nbsp; Humans run the bank, humans run the information security program (assuming one exists), and humans collect, create, store, access, distribute and destroy confidential information.&nbsp; This was more like "humans error", meaning more than one.</span><br><br>The bank said it had found "no evidence of fraudulent or suspicious activity on any of these accounts."<br><br>The four laptops all disappeared in Ireland, at least one of them from a bank worker's home.<br><br>The laptops contained information relating to some customers who either obtained a quote or took out a Life Assurance policy with Bank of Ireland Life from the following branches:<br></font><ul><li><font size="2">Drogheda</font></li><li>Dunleer</li><li>Bagnelstown</li><li>Court Place Carlow</li><li>Stephens Green</li><li>Tallaght</li><li>Montrose<br></li></ul><font size="2"><br>Anybody who is not a customer of these branches is not affected by this incident.<br><br>The customers' personal data was not encrypted to prevent easy access.<br><span style="font-style: italic;">[Evan] Should we be surprised?</span><br><br>The bank said it was beginning to encrypt customers' data on its remaining 5,000 laptops<br><span style="font-style: italic;">[Evan] Reactionary information security is ineffective.&nbsp; Organizations working with confidential information need to be proactive in risk management and information security in order to be effective.&nbsp; Let's think this through for a second or two.&nbsp; Here we have a bank (or a bank-owned entity) that has many highly confidential records.&nbsp; The bank employs ~5,000 laptop computers and encourages a mobile workforce.&nbsp; Do you think that there is a good (more than 50/50) chance that some of the laptops may be used to work with highly confidential information?&nbsp; Do you think there is a good chance that one of these laptops may be lost or stolen?&nbsp; Obviously the answer to both questions is "yes".&nbsp; Why then are these laptops not adequately protected?&nbsp; Is this another "human error"?</span><br><br>had yet to inform any of the 10,000 customers that their personal details had been compromised.<br><br>Bank of Ireland will be writing to these customers in the coming days.<br><br>a help-line has been set up to handle any customer queries 1850 365 365 and select the Bank of Ireland Life option<br><br>This customer help-line will be open from 9.00am to 6.00pm Monday to Friday.<br><br>Bank of Ireland apologises to customers and is committed to moving as quickly as possible to allay the concerns of affected customers.<br><br>Ireland's Data Protection Commissioner Billy Hawkes said his office was investigating what he described as "serious" security lapses.<br><span style="font-style: italic;">[Evan] Of course my purview is very limited, but I tend to agree that there are some serious information security gaps at The Bank of Ireland.</span><br><br><span style="font-weight: bold;">Commentary:</span><br>Baffling is the first word that comes to mind.&nbsp; Poorly protected confidential information and a poor incident response. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/04/22/boi.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 22 Apr 2008 05:35:39 +0000</pubDate>
      <category domain="http://securityratty.com/tag/bank">bank</category>
      <category domain="http://securityratty.com/tag/customers">customers</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/ireland">ireland</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/ireland life option">ireland life option</category>
      <category domain="http://securityratty.com/tag/ireland life">ireland life</category>
      <category domain="http://securityratty.com/tag/bank account details">bank account details</category>
      <source url="http://breachblog.com/2008/04/22/boi.aspx">Lost Bank of Ireland laptops affect roughly 10,000 customers</source>
    </item>
    <item>
      <title><![CDATA[Comparing Cybersecurity to Early 1800s Security on the High Seas]]></title>
      <link>http://securityratty.com/article/da0420717aad1f4a3f39a6590d2d2551</link>
      <guid>http://securityratty.com/article/da0420717aad1f4a3f39a6590d2d2551</guid>
      <description><![CDATA[This article in CSO compares modern cybersecurity to open seas piracy in the early 1800s. After a bit of history, the article talks about current events: In modern times, the nearly ubiquitous...]]></description>
      <content:encoded><![CDATA[<p><a href="http://www.csoonline.com/article/print/329164">This article</a> in <i>CSO</i> compares modern cybersecurity to open seas piracy in the early 1800s.  After a bit of history, the article talks about current events:</p>

<blockquote>In modern times, the nearly ubiquitous availability of powerful computing systems, along with the proliferation of high-speed networks, have converged to create a new version of the high seas--the cyber seas. The Internet has the potential to significantly impact the United States' position as a world leader. Nevertheless, for the last decade, U.S. cybersecurity policy has been inconsistent and reactionary. The private sector has often been left to fend for itself, and sporadic policy statements have left U.S. government organizations, private enterprises and allies uncertain of which tack the nation will take to secure the cyber frontier.</blockquote>

<p>This should be a surprise to no one.</p>

<p>What to do?</p>

<blockquote>With that goal in mind, let us consider how the United States could take a Jeffersonian approach to the cyber threats faced by our economy. The first step would be for the United States to develop a consistent policy that articulates America's commitment to assuring the free navigation of the "cyber seas." Perhaps most critical to the success of that policy will be a future president's support for efforts that translate rhetoric to actions--developing initiatives to thwart cyber criminals, protecting U.S. technological sovereignty, and balancing any defensive actions to avoid violating U.S. citizens' constitutional rights. Clearly articulated policy and consistent actions will assure a stable and predictable environment where electronic commerce can thrive, continuing to drive U.S. economic growth and avoiding the possibility of the U.S. becoming a cyber-colony subject to the whims of organized criminal efforts on the Internet.</blockquote>

<p>I am reminded of <a href="http://www.legalaffairs.org/issues/July-August-2005/feature_burgess_julaug05.msp">comments</a> <a href="http://www.cl.cam.ac.uk/~rja14/wtc.html">comparing</a> modern terrorism with piracy on the high seas.</p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=HBkZAAG"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=HBkZAAG" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=AFKpZIG"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=AFKpZIG" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Wed, 16 Apr 2008 10:27:30 +0000</pubDate>
      <category domain="http://securityratty.com/tag/seas">seas</category>
      <category domain="http://securityratty.com/tag/policy">policy</category>
      <category domain="http://securityratty.com/tag/cybersecurity policy">cybersecurity policy</category>
      <category domain="http://securityratty.com/tag/cyber seas">cyber seas</category>
      <category domain="http://securityratty.com/tag/consistent policy">consistent policy</category>
      <category domain="http://securityratty.com/tag/seas piracy">seas piracy</category>
      <category domain="http://securityratty.com/tag/sporadic policy statements">sporadic policy statements</category>
      <category domain="http://securityratty.com/tag/actions">actions</category>
      <category domain="http://securityratty.com/tag/piracy">piracy</category>
      <source url="http://www.schneier.com/blog/archives/2008/04/comparing_cyber.html">Comparing Cybersecurity to Early 1800s Security on the High Seas</source>
    </item>
    <item>
      <title><![CDATA[Patrick Smith on Aviation Security]]></title>
      <link>http://securityratty.com/article/dc900e84c4d7b8dda73b4aa15d9e6781</link>
      <guid>http://securityratty.com/article/dc900e84c4d7b8dda73b4aa15d9e6781</guid>
      <description><![CDATA[Excellent essay from The New York Times : In the end, I'm not sure which is more troubling, the inanity of the existing regulations, or the average American's acceptance of them and willingness to be...]]></description>
      <content:encoded><![CDATA[<p><a href="http://jetlagged.blogs.nytimes.com/2007/12/28/the-airport-security-follies/index.html">Excellent essay</a> from <i>The New York Times</i>:</p>

<blockquote>In the end, I'm not sure which is more troubling, the inanity of the existing regulations, or the average American's acceptance of them and willingness to be humiliated. These wasteful and tedious protocols have solidified into what appears to be indefinite policy, with little or no opposition. There ought to be a tide of protest rising up against this mania. Where is it? At its loudest, the voice of the traveling public is one of grumbled resignation. The op-ed pages are silent, the pundits have nothing meaningful to say.

<p>The airlines, for their part, are in something of a bind. The willingness of our carriers to allow flying to become an increasingly unpleasant experience suggests a business sense of masochistic capitulation. On the other hand, imagine the outrage among security zealots should airlines be caught lobbying for what is perceived to be a dangerous abrogation of security and responsibility -- even if it's not. Carriers caught plenty of flack, almost all of it unfair, in the aftermath of September 11th. Understandably, they no longer want that liability.</p>

<p>As for Americans themselves, I suppose that it's less than realistic to expect street protests or airport sit-ins from citizen fliers, and maybe we shouldn't expect too much from a press and media that have had no trouble letting countless other injustices slip to the wayside. And rather than rethink our policies, the best we've come up with is a way to skirt them -- for a fee, naturally -- via schemes like Registered Traveler. Americans can now pay to have their personal information put on file just to avoid the hassle of airport security. As cynical as George Orwell ever was, I doubt he imagined the idea of citizens offering up money for their own subjugation.</p>

<p>How we got to this point is an interesting study in reactionary politics, fear-mongering and a disconcerting willingness of the American public to accept almost anything in the name of "security." Conned and frightened, our nation demands not actual security, but security spectacle. And although a reasonable percentage of passengers, along with most security experts, would concur such theater serves no useful purpose, there has been surprisingly little outrage. In that regard, maybe we've gotten exactly the system we deserve.</blockquote></p><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=ezWEr2D"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=ezWEr2D" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=8ge5WlD"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=8ge5WlD" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/schneier/fulltext?a=kWp8eID"><img src="http://feeds.feedburner.com/~f/schneier/fulltext?i=kWp8eID" border="0"></img></a>
</div>]]></content:encoded>
      <pubDate>Fri, 11 Jan 2008 10:47:35 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/actual security">actual security</category>
      <category domain="http://securityratty.com/tag/security zealots">security zealots</category>
      <category domain="http://securityratty.com/tag/security experts">security experts</category>
      <category domain="http://securityratty.com/tag/security spectacle">security spectacle</category>
      <category domain="http://securityratty.com/tag/expect street protests">expect street protests</category>
      <category domain="http://securityratty.com/tag/airport security">airport security</category>
      <category domain="http://securityratty.com/tag/expect">expect</category>
      <category domain="http://securityratty.com/tag/american public">american public</category>
      <source url="http://www.schneier.com/blog/archives/2008/01/patrick_smith_o_1.html">Patrick Smith on Aviation Security</source>
    </item>
    <item>
      <title><![CDATA[Stolen laptops affect 337,000 Davidson County voters]]></title>
      <link>http://securityratty.com/article/dd7e2533e3fc9fb78ad0c24a58b10b34</link>
      <guid>http://securityratty.com/article/dd7e2533e3fc9fb78ad0c24a58b10b34</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
12/28/07

Organization
Davidson County Election Commission

Davidson County, Tennessee has an estimated population of 607,413. The county seat is...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/dcec.jpg" align="right" height="61" width="196"><font size="2"><span style="font-weight: bold;">Date Reported:</span><br>12/28/07<br><br><span style="font-weight: bold;">Organization:</span><br>Davidson County Election Commission*<br><br><font size="1">*Davidson County, Tennessee has an estimated population of 607,413.&nbsp; The county seat is Nashville.</font><br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Registered Davidson County voters<br><br><span style="font-weight: bold;">Number Affected:</span><br>337,000<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names, Social Security numbers, addresses and telephone numbers.<br><br><span style="font-weight: bold;">Breach Description:</span><br>A pair of laptop computers containing sensitive personal information belonging to 337,000 registered Davidson County, Tennessee voters was stolen from the Davidson County Election Commission office during the Christmas break.<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.newschannel5.com/Global/story.asp?S=7550025" target="_blank"> WTVF News Channel 5 Story</a> <br><a href="http://wkrn.com/nashville/news/info-on-337000-davidson-county-voters-stolen/135060.htm" target="_blank"> WKRN Channel 2 News Story</a> <br><a href="http://www.bizjournals.com/nashville/stories/2007/12/24/daily22.html" target="_blank"> Nashville Business Journal</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>News Channel 5<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>A break-in at the Davidson County Election Office at 800 Second Ave. has jeopardized a large number of voters' personal data, according to Ray Barrett, election administrator.<br><br>It looks as though they used a rock to break their way in.<br><span style="font-style: italic;">[Evan] A rock is all it took.&nbsp; There is no mention of any alarm system and it appears that nobody noticed until they came back to the office.</span><br style="font-style: italic;"><br>taken were two Dell Latitude laptops containing information of 337,000 registered Davidson County voters<br><br>"As we look deeper into determining the extent of loss that occurred during the holiday break-in, we now know that full social security numbers were included on the voter files contained on one or more of the stolen computers." said Ray Barrett.<br><br>"Initially, we thought that the only information was the same that the public can purchase when putting together mailing lists, we now know that was incorrect." <br><br>The Election Commission says it will formally notify the public by mail that their full Social Security numbers may be available to outside parties and is asking voters monitor their financial and personal accounts for any suspicious activity.<br><br>Barrett says he has asked Metro's information technology department to make immediate changes to safeguard against any future security problems. <br><span style="font-style: italic;">[Evan] I wonder what these people will come up with.&nbsp; Not only "immediate changes", but also effective changes.&nbsp; There are likely numerous changes that could be suggested.&nbsp; It all starts with policy.</span><br style="font-style: italic;"><br>The Election Commission says it does not anticipate that the theft will cause any problems in the upcoming Tennessee presidential primary.<br><br><span style="font-weight: bold;">Commentary:</span><br>This is an example of typical reactionary information security.&nbsp; "Immediate changes" are made after the significant loss of confidential information.&nbsp; I assume that there is not a well written or communicated information security policy at Davidson County.&nbsp; If there is, it is obviously not well enforced or supported by procedural, administrative, or technical controls.<br><br>Why are the offices not physically secure?&nbsp; If a rock is all that is needed to break-in and go undetected for x number of days, then the offices were not physically secure.<br><br>Why is confidential information stored on mobile devices (laptop in this instance)?&nbsp; Confidential information should be stored, whenever possible in a secure (physically and logically), centralized location.<br><br>Why are mobile devices that access, process, store, create, or transmit confidential data not encrypted?&nbsp; This is a point that I have been trying to drill home for years.&nbsp; Some people get it, some people fear it, and some people are oblivious.&nbsp; The sad thing is that consumers don't know which category the organization is in.&nbsp; Until consumers demand more, business as usual.<br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown</font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2007/12/29/dcec.aspx" type="text/javascript" charset="utf-8"></script>
<br>
<br>
<script type="text/javascript"><!--
google_ad_client = "pub-4721162729073131";
google_ad_width = 468;
google_ad_height = 60;
google_ad_format = "468x60_as";
google_ad_type = "text_image";
google_ad_channel = "";
//-->
</script>
<script type="text/javascript">
</script>]]></content:encoded>
      <pubDate>Sat, 29 Dec 2007 08:30:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/voters">voters</category>
      <category domain="http://securityratty.com/tag/davidson county voters">davidson county voters</category>
      <category domain="http://securityratty.com/tag/davidson county">davidson county</category>
      <category domain="http://securityratty.com/tag/tennessee voters">tennessee voters</category>
      <category domain="http://securityratty.com/tag/information technology department">information technology department</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/voters monitor">voters monitor</category>
      <category domain="http://securityratty.com/tag/sensitive personal information">sensitive personal information</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <source url="http://breachblog.com/2007/12/29/dcec.aspx">Stolen laptops affect 337,000 Davidson County voters</source>
    </item>
    <item>
      <title><![CDATA[Halvar Flake Denied Entry to U.S. for Black Hat]]></title>
      <link>http://securityratty.com/article/907d9460fafee84a9e79f4212649f4cb</link>
      <guid>http://securityratty.com/article/907d9460fafee84a9e79f4212649f4cb</guid>
      <description><![CDATA[Respected security researcher Halvar Flake has been denied entry to the United States for his presentation at Black Hat. It's all over some stupid technicality of the contract with Black Hat being...]]></description>
      <content:encoded><![CDATA[<br>Respected security researcher <a target="_blank" href="http://addxorrol.blogspot.com/2007/07/ive-been-denied-entry-to-us-essentially.html">Halvar Flake has been denied entry to the United States for his presentation at Black Hat.</a>

It's all over some stupid technicality of the contract with Black Hat being with him personally and not his company. In the process of interrogating him over it the DHS actually asked why the training he's doing couldn't be performed by an American citizen. I'm speechless. Flake will now need to get a Business visa from the U.S. embassy, a process that can take a long time.

Without going into specifics, this isn't the only story I've heard lately about the DHS stifling computer security research. Flake's problems seem to be the reactionary stupidity of some officials on the ground, whereas the others I've heard of were more political. In either event, the result is government at its worst.<img src="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~4/138554774" height="1" width="1"/>]]></content:encoded>
      <pubDate>Sun, 29 Jul 2007 08:39:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/black hat">black hat</category>
      <category domain="http://securityratty.com/tag/flake">flake</category>
      <category domain="http://securityratty.com/tag/computer security research">computer security research</category>
      <category domain="http://securityratty.com/tag/entry">entry</category>
      <category domain="http://securityratty.com/tag/stupid technicality">stupid technicality</category>
      <category domain="http://securityratty.com/tag/reactionary stupidity">reactionary stupidity</category>
      <category domain="http://securityratty.com/tag/process">process</category>
      <category domain="http://securityratty.com/tag/business visa">business visa</category>
      <category domain="http://securityratty.com/tag/dhs">dhs</category>
      <source url="http://feeds.ziffdavisenterprise.com/~r/RSS/cheap_hack/~3/138554774/halvar_flake_denied_entry_to_us_for_blackhat.html">Halvar Flake Denied Entry to U.S. for Black Hat</source>
    </item>
  </channel>
</rss>
