Schneier on Security

annoyed • January 4, 2007 12:17 AM

This is one more step into a swampy cesspool which the Office of Management and Budget dug when it overreacted to the VA laptop incident by issuing the infamous OMB 06-16 memo:

http://www.whitehouse.gov/omb/memoranda/fy2006/m06-16.pdf

This declared an open season of vast government waste spending on redundant encryption purchases on tight deadlines to protect a class of data that had not been clearly defined, while simultaneously enshrining a nonsense phrase–“personally identifiable information”, a.k.a. PII–as the code word for government stupidity in FY 2007.

Just think about that phrase for a minute. It means “information that is personally identifiable”. It’s gibberish. What they perhaps meant was “personally identifying information”, and it’s not clear how this is distinct in their tiny little minds from good old “personal information”. But now thousands of tie-wearing, headless chickens are running around the halls of government crying PII, PII, without any real thought given to what the real objective is–presumably, that government programs not contribute to identity fraud through mismanagement of collected data.

The result is a room at every agency filled with amateur philosophers, all incompetently and futilely trying to suss out the nature of OMB’s fabulous beast, the dreaded PII. Because of the divers sophomoric output of these committees, definitions of PII now in practice usually include things as aggressively moronic as publicly available names and telephone numbers, and thus we end up with these sorts of expensive mandates to encrypt all mobile devices, instead of a more sensible mandate to simply stop putting the so-called PII on mobile devices in the first place.

Meanwhile, the idiots at the top utterly fail to address the continuing real loss of personal information through myriad avenues such as improperly secured paper files, telework conducted from insecure home PCs, failure to encrypt emails between HR personnel, failure to sanitize media on excess equipment, failure to properly shred documents before disposal, etc, etc, etc.

It’s absolutely, utterly, infuriating. This is the classic exemplar of a poor security tradeoff, and I hope Bruce reconsiders his endorsement.

annoyed • January 4, 2007 11:58 AM

@Cerebus
“‘- No definition of PII.'”
“Incorrect. However, as a new definition, it takes a little time to settle down.”

Kindly point us to the useful definition of PII. The Privacy Act is tangentially germane, but when it gets down to brass tacks, agencies are having to define PII for themselves, and they’re doing a lousy job. You’re obviously not having to deal with dozens of reports of a stolen cell phone or PDA that “might have had some home phone numbers on it”. The failure to define PII in any rational way is wasting incident response resources in a profligate way, all the way up to US-CERT. Call US-CERT and ask them what proportion of their report-handling time is now spent on stolen mobile devices.

“How do you protect information on a compromised system?”

First of all, a stolen laptop is a compromised system. And you miss the point, which is that if we are defining a class of sensitive data, it needs to be tracked and protected everywhere it goes, not just on laptops. The only reason a blanket purchase is under discussion here–Bruce himself says it–is because it’s easier than determining which laptops need protection. That’s not a crypto problem; it’s a management problem. No one knows what or where the PII is, so purchasing FDE for laptops is an expensive way to sidestep the real problem.

Imagine if DOD were putting plaintext Secret data on a few laptops, and no one knew which ones. Would it make sense for them to buy FDE for every laptop they own, when only a few had the data? Wouldn’t the real problem be, obviously, that Secret data was not being handled properly?

The right way to solve this problem wouldn’t waste money purchasing, installing, and maintaining FDE and a keystore infrastructure for hundreds of thousands, perhaps millions, of laptops. Instead, it would establish rules for tracking all the PII and appropriately protecting it wherever it is stored. If PII has to be stored on a laptop (e.g. by Census), then FDE could be purchased for that laptop, along with appropriate other countermeasures (anti-virus, anti-spyware, firewall, etc.). A blanket purchase accomplishes the opposite of what is needed, because now every drone with a laptop will think it’s safe to put PII on his laptop, and storage of PII on laptops will increase, not decrease. And laptops, even with FDE, are the least secure systems in any enterprise because they keep getting connected to insecure networks.

“In re: paper, gov’t has rules on protecting that data (Privacy Act requirements).”

Do you work at a government agency? If so, what care do your HR and physical security people take with personnel files? What email encryption do your HR and physical security people use? How does your incident response team deal with theft of paper files, or are they even consulted? If not, why is PII theft on a laptop handled by one group, while PII theft on paper is handled by someone else? Shouldn’t there be uniform handling of PII theft, no matter how it occurs?

“In re: backups and other electronic records, these things are being addressed”

Not in any uniform or even rational way.

Remember that all this stupidity was in reaction to one theft of a laptop that was not supposed to have the data on it in the first place. Meanwhile, no one keeps track of which other systems have these data on them, and laptop thefts are just the tip of the iceberg, even as mobile devices are concerned–how many PDA cell phones have been stolen in the past year? Why hasn’t that number been reported in the media, when laptops have? (Answer: because it’s theatre.)

“‘- No safeguards for transmission of PII over networks.'”
“Incorrect. Data has to be protected while in motion, and there are rules and standards for this.”

Really? And which of those rules and standards apply to PII? Why not enforce those rules?

Oh, wait–what is PII, anyway?

“The RFP being discussed is for data at rest which is a newly recognized requirement.”

The RFP is for a tiny fraction of the real problem, and is going to waste a large proportion of everyone’s security budget on theatre. Just setting up the FDE on all those laptops is going to chew up major resources, and then we have follow-on costs with maintaining laptop software, infrastructure hardware and software, and help desk support for the thousands of technical problems which will arise. And what evidence do we have that there has ever been any identity fraud based on data from a stolen government laptop anyway?

“‘- No requirements for labeling PII to indicate its status as such.'”
“Privacy Act again. What, you’ve never seen a Privacy Act cover sheet?”

Not on a laptop. Not on a web server. Actually, not anywhere, no. And I work for the government.

annoyed • January 5, 2007 3:08 AM

@Nicolai
“PII is defined in the privacy act but as always people start fantasizing movie plots and so expand the definition until it includes even a person’s initials in some randomized order.”

PII is never mentioned in the Privacy Act, which was written in 1974. The closest term that does occur is “individually identifiable information”, which is just as much gibberish as PII, and occurs only once.

The most applicable term that is defined in the Privacy Act is a “record”:

“the term ‘record’ means any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph;”

Note the “including, but not limited to…” This is completely open-ended, which is why agencies don’t know where to stop.

Meanwhile, a crucial term that is never defined in the Privacy Act is “identify”. It could mean “identify an individual uniquely,” but a name doesn’t do that in most cases, and a name is an alternative to other “identifying” information. So it could also mean “to narrow the field of candidate individuals”, which is the sense in the common term “identifying mark”. But then, how much does information have to narrow the field before we consider it “identifying”? Is hair color enough? Hair and eye color? Last four digits of phone number? MD5 digest of the street address? IP address? (If you think IP address can’t identify an individual, go talk to someone who’s been sued by the RIAA.) Who knows?

Now look at the definition of “record” and tell me what a “record” is when we don’t know what “identify” means.

It should be no surprise that, with this gobbledygook as starting point, agencies are defining PII to include things such as “a name combined with a telephone number”. On the one hand, they’re being instructed to protect all “PII” on mobile devices; on the other, they’re being given no practical guidance whatsoever on what PII is. Sure, if you have medical records and SSN, that’s PII, but most agencies don’t have that. They have names, phone numbers, email addresses, IP addresses in logs. Are web logs PII? What about email headers?

This isn’t movie-plot fantasy–it’s simply the chaos that results when the White House says “Jump!” without saying how high. It’s the fault of OMB for issuing broad mandates with short deadlines and no forethought. Agencies have already spent tens of millions trying to implement this crap. With this blanket purchase, they’ll spend hundred of millions, perhaps billions more. All that money could be used effectively if it could be targeted to protect the information that is deemed so important. But without defining that information in an actionable way, all the government can do is shovel money into the boiler and hope nobody asks any questions.

It’s time to start asking questions. Now.

annoyed • January 5, 2007 10:57 AM

@Sceptic
“Hard-working company man is running out of time for his report at night so he dumps a copy of a fileshare/database/whatever onto his laptop to take it home… That’s what laptop FDE is intended to address…”

Better solution: put hard-working company man in prison for mishandling sensitive data. I mean, if you actually care about the problem.