Schneier on Security

Davi Ottenheimer • March 13, 2005 1:00 AM

Ok, if I read this correctly, while the DoD wanted to restrict access to the OIG database to keep (the absence of) military satellite data secret, “NASA’s computer system at the Goddard Space Flight Center in Greenbelt, Md., suffered a crippling failure in early February and while it is still in operation, its capabilities are limited.”

Something tells me that the DoD people arguing for security were more intrested in “Confidentiality” than data “Integrity” or even system “Availability”. This is a classic mistake when funding and fighting for change in information security — to use “CIA” as a literal marching order. Experience in information security usually leads one to discover that “AIC” is a more effective approach since you effectively end up with Confidentiality if the system is off-line or the data is considered completely unreliable.

I worked on a few information security gigs at NASA and for some rocket science and astrophysics projects, and I must say I tend to agree with the conclusion of the scientist quoted in the article:

“So sometimes you go through these big hurdles trying to make things secret that are, in an open society, things you just can’t. All you end up doing is gumming up the works for everybody living ordinary lives, which makes the terrorists win.”

Of course most scientists are far too trusting, but that’s another story. The new policy for access to the satellite tracking system appears to me to be too broad/vague and unlikely to achieve any greater data confidentiality: Users must agree not to “transfer any data, including, but not limited to, the analysis of tracking data, or other information received through this website or any services described herein to any third party without the prior express approval of the Secretary of Defense or his delegatee.”

Ugh. Welcome to the 1950s. I wonder what approval looks like; a visit to the DoD so you can have your prints inked? Promise to give up your first-born?

Davi Ottenheimer • March 13, 2005 3:49 AM

@John

Perhaps you could clarify how satellite position information poses a risk to US national security? Perhaps you missed the part of the article that explains why the information is shared:

“Commercial satellite operators use the data to monitor civilian spacecraft, to predict – and avoid – collisions or close encounters, to determine when maneuvers might be required and to monitor space debris.

Researchers and educators use the information to train future satellite operators, to develop more efficient tracking techniques and to monitor space debris, which poses a threat to all satellites. Radio enthusiasts need it to determine when amateur satellites will be above their horizons.

And in the internet age, even casual hobbyists using widely available Macintosh and PC tracking software can find out when a given satellite will be visible from their location.”

And maybe you also missed the point that “NASA managers have never seen the OIG data as a security risk and even the Air Force, in a 1999 review, ‘assessed the NASA web site data and found no threat to national security,’ the GAO observed.”

But aside from all that, you probably also missed the point that “a small group of sophisticated amateurs do, in fact, track presumably ‘classified’ spy satellites, they do it the old fashioned way: by monitoring military launches, looking for new satellites in the night sky and computing their orbits.”

How exactly do you propose to avoid that? Prevent people from looking up? Ban the use of mathematics?

Hmmm, any links, dates, names or references to support to your point about Mother Jones? I’m sorry but it seems that you are saying that freedom of the press should not apply to a magazine that publishes freely available information, and its reporters should be jailed?