Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US Customs Database Of Traveler Photos Was Hacked And Stolen

buzzfeednews.com

Post reply on HN
Print view View original

131–140 of 207 posts

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#131

Post by munchbunny »

ariwilson wrote: post #100
projectileboy wrote: post #86

I’ll just keep saying this, and getting dismissed by everyone I know - any data security discussion around a centralized data store that doesn’t begin with the recognition that that data store will be compromised, is a discussion that is just a joke.

Why does decentralization save you from compromise?

I wouldn't frame it as decentralization, more like compartmentalization. You harden your systems to prevent horizontal movement between services.

For example, you could try to put payment credentials in a separate subnet where they are never read out of that enclave. Access to that subnet might require separate authentication credentials that most employees don't have, and API calls might require the calling server to possess a separate type of short-lived certificate. So when the main DB is compromised through an employee, it's still hard to laterally access more sensitive data.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#132

Post by sailfast »

ljm wrote: post #60

According to the report, CBP is passing the buck on this one. They created policies that could be ignored. That’s on them. They shouldn’t be able to use their position to avoid accountability or to scapegoat their contractors (that they likely hired without due diligence). Government agencies should never be seen as victims. They hold power and authority that nobody else can hope to enjoy. There is no higher power to…

There’s a lot going on here, and I’m no fan of CBP but this is pretty much a low-grade by the book contractor failure here. They receive training on all of these things, and have gone through a lengthy award and due diligence process and then all it takes is one person thinking “hey I think I’ll take a sample dataset back to my Dev laptop to test things.” Could be a newbie or a senior - who knows, but it’s happened before.

Go after CBP for constitutionality of collection, for working outside of borders where they are legally not allowed to work, etc, but in this case I’d say let’s not blow things too out of proportion.

Remember when OMB lost hundreds of thousands of detailed compromising personal background check reports with all the identifying information including biometrics? This sounds like some port of entry data you could get with a camera in public.

Further: they are not absolving themselves. They are probably working their asses off right now to make sure this never happens again but somebody is going to pay for credit protection and insurance, and it should be the contractor that ignored their contract and all sensible security policy. So, there is is in the press release.

Lastly: I don’t think GDPR fixes this. Government (especially intel community and law enforcement) keeps the data as long as their record schedules allow.

Thankfully, laws about breaches required them to reveal this to us within a certain time. Privacy Officers have really hard jobs. To do them well is hard and thankless. Glad this one stuck to the law.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#133

Post by drtillberg »

vageli wrote: post #121
drtillberg wrote: post #61

Earlier quoted context omitted.

Not far off from what it turns out (after investigation) really happened![1] [1] https://en.m.wikipedia.org/wiki/Imran_Awan

> Not far off from what it turns out (after investigation) really happened![1] > [1] https://en.m.wikipedia.org/wiki/Imran_Awan I don't see how that link supports your conclusion? From my reading of it, no data was stolen by Imran Awan?

There were more serious allegations against the individual, but the gov't dropped those claims. All that was left was the fact this individual had extensive access to Congressional servers.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#135

Post by rasengan »

ljm wrote: post #60

According to the report, CBP is passing the buck on this one. They created policies that could be ignored. That’s on them. They shouldn’t be able to use their position to avoid accountability or to scapegoat their contractors (that they likely hired without due diligence). Government agencies should never be seen as victims. They hold power and authority that nobody else can hope to enjoy. There is no higher power to…

I’m shocked that there aren’t a bunch of public resignations. I’m also shocked that there aren’t more details - for example - let us know the scope of all the data that company had access to, so we can get an idea of the maximum exposure the public faces.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#136

Post by pastafarian »

ljm wrote: post #60

According to the report, CBP is passing the buck on this one. They created policies that could be ignored. That’s on them. They shouldn’t be able to use their position to avoid accountability or to scapegoat their contractors (that they likely hired without due diligence). Government agencies should never be seen as victims. They hold power and authority that nobody else can hope to enjoy. There is no higher power to…

What does god(s) have to with that ??

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#137

Post by a3n »

I haven't crossed the border in twenty years but I'm probably in this or a related database.

I'm a long distance trucker. A few weeks ago I was traveling north from Laredo. When i drove through the border patrol checkpoint, a bank of five or six cameras to my right flashed, i assumed getting my face, license plate, and likelihood of committing a crime in the near future.

The truck is registered to my employer, but I'm sure that can lead to me with a WHERE clause.

At the least they would know where they've seen this face in this truck. I wonder if being in a different truck would be suspicious. I guess it would be if they needed it to be.

Re: US Customs Database Of Traveler Photos Was Hacked And Stolen

#139

Post by School-Cotton »

DoofusOfDeath wrote: post #101
icelancer wrote: post #98

The government is never held accountable for mistakes they make. They are, in fact, too big to fail.

> The government is never held accountable for mistakes they make. In a functioning democracy "they" is "us".

> In a functioning democracy "they" is "us".

Leaving aside the question whether the US is a "functioning democracy"...

In a "functioning democracy", "they" is in fact very often not "us", by definition in fact, since every vote has winners and losers.

Plenty of stuff that I disagree with is electorally popular: unlimited police powers, extremely severe punishments for crimes, military intervention in foreign affairs, censoring of offensive speech, criminalization of victimless acts like drug use, cutting taxes, lack of restriction on CO2 emissions, and so on. I certainly don't define myself as part of any "we" that supports, or is implementing, any of that.

"The will of the whole Nation is expressed in the State" is an authoritarian idea, not a liberal democratic one.

Post reply on HN