INFOSEC Year in Review 1997 M. E. Kabay, PhD, CISSP Assoc. Prof. Information Assurance Dept. of Computer Information Systems, Division of Business Norwich University [email protected] Copyright © 2003 M. E. Kabay. All rights reserved. Page 1 INFOSEC Year in Review 1997 11 Breaches of confidentiality Category 11 Breaches of confidentiality 1997-02-23 medical data confidentiality PA News In Sheffield, England, a hospital handed over 50,000 confidential gynecological records to a data processing firm that hired people off the street and set them to work transcribing the unprotected data. The scandal resulted in withdrawal of the contract, but thousands of records were exposed to a wide variety of people with no background checking to ascertain their reliability. Category 11 Breaches of confidentiality 1997-04-08 QA operations security confidentiality AP, Reuters The General Accounting Office lambasted the IRS for improper operations security, saying that the IRS "misplaced" 6,000 computer tapes and cartridges. Sen. John Glenn (D-OH), who released the report, also introduced a bill to define criminal penalties against IRS employees who snoop into taxpayer records without cause. Glenn said that out of 1,515 cases of unauthorized browsing identified in the 1994 and 1995 fiscal years at the IRS, only 23 employees were fired for the activity. Category 11 Breaches of confidentiality 1997-04-30 medical confidentiality AIDS database UPI Greg Wentz was found guilty of anonymously mailing a list of 4,000 names of people with AIDS to two Florida newspapers. It turned out that he was acting vindictively to punish his ex-lover, William Calvert III. Calvert was also charged with a misdemeanor for misusing the list, which he obtained at work in the Pinellas County Health Department. Wentz faces up to 60 days in jail and up to $500 in fines. Copyright © 2003 M. E. Kabay. All rights reserved. Page 2 INFOSEC Year in Review 1997 11.1 Data leakage Category 11.1 Data leakage 1997-07-02 medical informatics telemedicine Australian A report by Trudy Harris in _The Australian_ reviewed risks of telemedicine, a technology of great value in Australia because of great distances and sparse population. Risks included interception of unencrypted medical information, modification of critical parameters for patient care, and unauthorized access to confidential patient records. Category 11.1 Data leakage 1997-07-10 hacker password attack Wall Street Journal Mark Abene, a security expert formerly known to the underground as Phiber Optik, launched a command to check a client's password files — and ended up broadcasting the instruction to thousands of computers worldwide. Many of the computers obligingly sent him their password files. Abene explained that the command was sent out because of a misconfigured system and that he had no intention of generating a flood of password files into his mailbox. Jared Sandberg, Staff Reporter for the The Wall Street Journal, wrote, "A less ethical hacker could have used the purloined passwords to tap into other people's Internet accounts, possibly reading their e-mail or even impersonating them online." Mr Abene was a member of the Masters of Deception gang and was sentenced to a year in federal prison for breaking into telephone company systems. The accident occurred while he was on parole. Category 11.1 Data leakage 1997-07-19 confidentiality error Telecomworldwire A firm of accountants received passwords and other confidential codes from British Inland Revenue. Government spokesmen claimed it was an isolated incident. [How exactly did they know that it was an isolated incident?] Category 11.1 Data leakage 1997-08-07 privacy journalists Internet Reuters; RISKS 19 28 The ICSA's David Kennedy reported on a problem in Hong Kong, where Reuters described a slip that revealed personal details about hundreds of journalists at the end of June. Passport and identity-card details were revealed on the government Website for a couple of days. DK commented, "I suppose that's one way to get the media interested in privacy matters." Category 11.1 Data leakage 1997-08-15 privacy credit reports database AP, EDUPAGE Experian Inc. (formerly TRW Information Systems & Services), a major credit information bureau, discontinued its online access to customers' credit reports after a mere two days when at least four people received reports about other people. Copyright © 2003 M. E. Kabay. All rights reserved. Page 3 INFOSEC Year in Review 1997 11.2 Unauthorized disclosure Category 11.2 Unauthorized disclosure 1997-08-28 privacy Web EDUPAGE According to an independent group that monitors government activities, US federal Web sites are failing to protect user privacy. OMB Watch said, "There is no government-wide policy regarding privacy concerns on federal Web sites... Agencies collect personal information about visitors to their Web sites, but fail to tell them why that information is being collected and what it is being used for." After the report, three agencies that were collecting cookies files stopped doing so. Category 11.2 Unauthorized disclosure 1997-09-08 SSN privacy RISKS, EPIC Alert, AP 19 37 In September, six months after its ill-fated implementation of online access to the Personal Earnings and Benefits Estimate Statement (PEBES) service, the Social Security Administration announced its revised system. The most important change was that sensitive data such as the detailed earnings report would be available only by snail-mail; in addition, the system would impose a strict limit on the amount of information available online to any one requestor. Privacy advocates such as Marc Rotenberg of the Electronic Privacy Information Center (EPIC) congratulated the SSA on the improvements and praised it for consulting with the public. Copyright © 2003 M. E. Kabay. All rights reserved. Page 4 INFOSEC Year in Review 1997 11.3 Data theft Category 11.3 Data theft 1997-07-10 Web vandalism hackers credit card AP In early July, 2397 customers of the ESPN Sportszone and nba.com received anonymous letters containing the last eight digits of their own credit cards. Both Web sites were sited on the Starwave hosting service. The message said, "You are the victim of a careless abuse of privacy and security. This is one of the worst implementations of security we've seen." The perpetrators claimed to be "an anonymous organization seeking to make the Internet a safe place for the consumer to do business." Although none of the credit card numbers seemed to have been used fraudulently, Starwave managers warned customers to get new credit card numbers as a precaution. Copyright © 2003 M. E. Kabay. All rights reserved. Page 5 INFOSEC Year in Review 1997 12.1 Wiretapping Category 12.1 Wiretapping 1997-01-16 wiretaps law enforcement rules proposal EDUPAGE EDUPAGE reports: >The Federal Bureau of Investigation has released for public comment a new proposal for facilitating tapping of digital phone calls by law enforcement officials armed with court orders. Under the new proposal, which is significantly more modest than what the Bureau had asked for in a earlier plan, law enforcement officials would operate under a formula in which (for example) 523 phone lines could be monitored simultaneously in a place such as Manhattan. Privacy advocates oppose the FBI's plan as an unacceptable expansion of electronic surveillance. (New York Times 15 Jan 97 A8)< Category 12.1 Wiretapping 1997-02-18 wiretapping infowar court investigation Reuters In France, the equivalent of the supreme court examined the legality of an inquiry into illegal wiretapping allegedly carried out by a government anti-terrorism unit. The unit was active in the administration of the late François Mitterand. Category 12.1 Wiretapping 1997-05-29 wiretapping eavesdropping privacy telephones government investigation Reuters Government officials in Lebanon acknowledged for the first time that cellular phones and land lines were being systematically y tapped and the findings being distributed within the government. A parliamentary committee was formed to investigate the situation. Category 12.1 Wiretapping 1997-08-08 FBI wiretap warrant surveillance Internet phone Inter@ctive Week Online Law enforcement agencies have long been able to obtain a tap-and-trace authorization from any local U.S. attorney. However, to be able to install a wiretap that would allow monitoring of conversations requires police to obtain authorization from a judge. As phone companies move towards sending speech over the Internet, tap-and-trace orders can actually provide full access to conversations being sent over the Net. Civil libertarians are concerned about a possible abuse of privacy; the Center for Democracy and Technology (CDT) and the Electronic Frontier Foundation (EFF) have both expressed concerns to the Federal Communications Commission. The ACLU is also concerned about the FBI's new wiretap policy. Category 12.1 Wiretapping 1997-08-16 wiretap bug phone eavesdropping UPI A Dallas Schools Superintendant, Yvonne Gonzalez, caused anger among some employees by pursuing an investigation of corruption in the system. In mid-August, she was shocked to find possible evidence of a temporary bug on her phone — a couple of soldered wires. No other evidence of wire-tapping was found. Copyright © 2003 M. E. Kabay. All rights reserved. Page 6 INFOSEC Year in Review 1997 12.2 Interception Category 12.2 Interception 1997-02-06 cellular eavesdropping scanners AP Rep. Billy Tauzin, a Congressman from Louisiana, demonstrated to the House Commerce Telecommunications Subcommittee that an off-the-shelf police-frequency scanner can be modified to capture cellular phone calls in two minutes using a soldering iron and a two-inch wire. He then showed on the spot that the modified scanner could pick up a conversation between a cell- phone user and a regular telephone. The subcommittee is studying proposals to toughen enforcement of the law sponsored in 1992 by Rep.