US Emergency Alert System private SSH key mistakenly distributed

    " Congratulations gentleman - you're everything we've
      come to expect from years of Government training."

    -- Zed, in "Men in Black"

1) .gov aka "G-job" means you can't talk about it, maybe even to your boss. Maybe you're making the left support bracket for the Manhattan project, no one in 100 miles knows what you're actually building. Maybe no one knows everything about the whole program. So you're kinda on your own in the machine shop, kinda.

2) Wanna build a model steam engine at work? Tell them the crankshaft is a classified part for some contract you can't talk about and they're not cleared to even see the blueprint.

3) But screwing around for fun doesn't have to be made to the tolerances for real a-bomb parts... So "close enough for govt work"

The other story I heard from oldtimers who were there, was there was an intense push in the early 40s to shovel as much out the door as possible. An automobile plant used to selling to rich dudes wouldn't dare ship a car with cosmetic issues, but tank crews don't care if there's a little weld splatter on the outside or runs in the paint, as long as it actually works in combat. And this created attitude issues when they converted back to making fancy cars for rich dudes after the war. "So there's a giant dent in the hood, the GIs don't care... Uh, yeah but we're not building jeeps anymore..."

http://www.healthit.gov/providers-professionals/health-infor...

Adding auxiliary data (comparable to X509 certificate usage restrictions only for code-signing or signing for emails) would allow you to have a (central hardened) machine hand out certificates to your "semi trusted" administrators that only allow login from a specific IP-address, to a specific target-system, up to a certain date or even time. Putting this functionality in a script (to acquire the certificate and login to a system) such a wrapper could most likely be used as a drop-in replacement for the normal ssh-client.

If your restriction is to use only the default openssh already deployed to the target machines, one quick solution to hide the critical private key from the developer/admin/service machines would be to place it on a (hopefully somewhat hardened) machine running the ssh-agent, and access the agent by creative use of tunelling. In essence then the hardened machine would act as a kind of "smartcard" for all your admins.

A quick sum of all the incidents in there adds up to 22 million health care records lost so far. It's hard to imagine the government could do much worse.

In case you don't feel like importing the CSV file somewhere, https://docs.google.com/spreadsheet/ccc?key=0AkJeZCqH2PsHdDZ...

(Not modified except for column width and a final tally)