December 30, 2005
TAKING TECH SECURITY SERIOUSLY....The bad news is 2005 was an awful year for tech security. The worse news is the federal government could invest more in cybersecurity, but doesn't appear interested.
2005 saw the most computer security breaches ever, subjecting millions of Americans to potential identity fraud, according to a report published Thursday.
Over 130 major intrusions exposed more than 55 million Americans to the growing variety of fraud as personal data like Social Security and credit card numbers were left unprotected, according to USA Today.
The Treasury Department says that cyber crime has now outgrown illegal drug sales in annual proceeds, netting an estimated $105 billion in 2004, the report said.
At the same time, the Department of Homeland Security's 2005 research budget for cybersecurity programs was cut 7% to $16 million.
After the ChoicePoint debacle, the recent breakdown in tech security at Ford, and the fact that terrorists are coordinating operations online, you'd think cybersecurity research would get a little more than $16 million -- and wouldn't face budget cuts right now.
That, coupled by the fact that the Bush administration has gone through four cybersecurity chiefs in three years, hardly inspires confidence in the system.
—Steve Benen 1:43 PM
Permalink
| Trackbacks
| Comments (24)
I don't think protecting private data held by private companies -- the main impact you cite of these breaches -- is the government's responsibility, primarily. Sure, it would be nice if the government would impose a legal duty on the holders of the information to protect it, and provide for a substantial remedy to those harmed if they failed to perform that duty.
From there, most of the rest could be handled by the market.
Posted by: cmdicely on December 30, 2005 at 1:57 PM | PERMALINK
And, inasfar as the "terrorists coordinating operations online", the principle target of that is government work on penetration of cybersecurity, the budget for which is almost entirely, I would suspect, within the black budget of the NSA.
Posted by: cmdicely on December 30, 2005 at 1:59 PM | PERMALINK
Cmon, to the Bush admin, cybersecurity is just like any other branch of government--it'll get mucho funding just as soon as they figure out how it'll be funneled into the political machine. Why pick on cybersecurity?
Posted by: Kellogii on December 30, 2005 at 2:01 PM | PERMALINK
Doesn't anyone think that these 'thefts' from the likes of Citigroup ChoicePoint TimeWarner and LexisNexis (of all places) all in the past year might actually be among THE data added to this massive TIA re-brand NSA-plus project?
Posted by: JES on December 30, 2005 at 2:09 PM | PERMALINK
Cybercriminals obviously have better lobbyists. It's how the system works. Anyway, it's never the corporations that pay for these crimes. A fraud on a historically unparalleled magnitude(similar to one in France,I cant think of it's name, a century or 2 ago) may be in the offing.
You can bet the perpetrators wont be liberals.
Posted by: Michael7843853 on December 30, 2005 at 2:22 PM | PERMALINK
Can we at least pretend to be reasonable about this?
A per capita-type number here is what would be more relevant, given the massive increase in the absolute number of computer/internet users.
I'm sure a per capita-type number would still be alarming, but it just looks bad to refer to such an irrelevant stat like an absolute number.
Rhetorically, it's like getting bent out of shape because, say, the number of traffic accidents doubles. Without mentioning, hypothetically, that the number of cars on the road doubled.
Posted by: cdj on December 30, 2005 at 2:26 PM | PERMALINK
The Bushes don't do technology, never have. Aren't you glad we have Bush in the white house instead of Gore in these troubled times?
Posted by: Boronx on December 30, 2005 at 2:26 PM | PERMALINK
Also, don't forget about the Boeing HR system being compromised. I think 100,000+ people had their personal info (inc SS#) compromised.
Posted by: cdj on December 30, 2005 at 2:27 PM | PERMALINK
cdj
while i don't agree with your hypothesis about a possible massive increase in the number of people using the internet, i think another point is relevent. it's not that this is the first year that these types of unintentional disclosures have happened, it's that this is the first year any company has been required to report them, because of a California law that went into effect. there probably weren't, statistically speaking, a great deal more unauthorized disclosures this year than last or the year before. the difference is that this year companies were required to tell CA residents about them, who in turn told Media, or who turned out to be media, or the companies just thought it was easiest to make the disclosure initially through the media.
someone made a point on another thread (many moons ago) that when a person's identity gets stolen, the creditors are defrauded, but the person bears the brunt of the costs. i.e. having to prove unauthorized charges, and repairing credit, even when creditors acknowledge that the id was stolen. i think if creditors were made to truly bear the brunt of id theft, and could not reduce a person's credit rating due to id theft, they'd be a hell of a lot more careful with the info.
but i'm not sure that gov't regulation is the answer.
Posted by: e1 on December 30, 2005 at 2:56 PM | PERMALINK
e1 -
I don't myself (necessarily) agree with the hypothesis of a massive increase in internet users.
That's irrelevant.
My point was that THE STATISTIC GIVEN ignores that possibility, rendering it useless. Useless because THE STATISTIC GIVEN cannot bee used to tell the difference between same-number-of-users-double-attacks and double-number-users-double-attacks.
Not being able to distinguish between those two renders the stat useless (for get-yer-dander-up purposes at least). And that regardless of which of the two scenarios you or I *think* happened.
Posted by: cdj on December 30, 2005 at 3:07 PM | PERMALINK
e1 -
After reflection: we're vehemently agreeing - just fiddling with a fraction in different ways.
:)
Posted by: cdj on December 30, 2005 at 3:08 PM | PERMALINK
My point was that THE STATISTIC GIVEN ignores that possibility, rendering it useless. Useless because THE STATISTIC GIVEN cannot bee used to tell the difference between same-number-of-users-double-attacks and double-number-users-double-attacks.
The number of intrusions -- or the ratio -- arguably isn't the important number anyway; the number of persons exposed to particular harms (which isn't a function of the number of intrusions but their magnitude) is more important. And the ratio, if any, relevant there is to the national population, not internet users (particularly with identity theft), since you don't have to be an internet (or even computer) user to have your data in, e.g., ChoicePoint's databases.
Posted by: cmdicely on December 30, 2005 at 3:22 PM | PERMALINK
Or as Fark.com put it:
Although now a larger problem than illegal drugs, Federal budget for fighting computer crime cut to $16 million. That's "million" with an "M"
Posted by: b on December 30, 2005 at 3:32 PM | PERMALINK
cdj
the difference is, you're hypothesizing a massive increase in internet users that would somehow skew the data, and i know that the law change has. and cmdicely's point is well taken that you don't have to use the internet or a computer at all to have your info in one of these data clearing houses.
so yes, we're agreeing that it would be irresponsible for a journalist to say that this was a "record year" for unauthorized disclosures. except that i'm saying it because there haven't BEEN any records before, not that were made public. not because i think some other trend in consumer/public behavior would make the number irrelevant.
Posted by: e1 on December 30, 2005 at 3:34 PM | PERMALINK
There is a bill currently in Washington to protect names, addresses and social security numbers, it's "H.R.1751." Unfortunately the bill, if made into a law would only protect police officers. No mention of protecting the billions of other citizens in the country. Washington always seems to protect certain groups.
Posted by: Stan the Man on December 30, 2005 at 4:09 PM | PERMALINK
b wrote:
"Although now a larger problem than illegal drugs, Federal budget for fighting computer crime cut to $16 million. That's "million" with an "M""
Posted by: b on December 30, 2005 at 3:32 PM | PERMALINK
So, logically we should now cut funding for programs to fight illegal drugs to about $20 million?
I wonder, has actual drug usage (in terms of individuals who use drugs) gone down in the last 50 years? How has the War on Drugs fared? Better than the GWOT? Have they defined 'victory' for the war on drugs yet?
Posted by: MarkH on December 30, 2005 at 7:24 PM | PERMALINK
Republicans are weak on effective law enforcement and regulation.
Because they steal.
They're the pro-white-collar-crime party. The party of fraud. The party of embezzlement. The party of war-profiteering.
Republican Culture of Corruption.
Posted by: Osama_been_forgotten on December 30, 2005 at 8:23 PM | PERMALINK
hey, the national security party Attroney General, John Ashcroft cut the counter-terriorism budget by $100 million on September 10th, 2001.
F**k republicans and their national security bullshit.
Posted by: justfred on December 30, 2005 at 11:22 PM | PERMALINK
I can't believe you folks are all this clueless; I'm going to have to believe that there's no such thing as fairness.
Computer security happens to be something I'm expert in, as opposed to politics, fighting wars, or law.
Statistics can be argued any way you like. Yes, there *are* a lot more users now. Yes, databases get compromised. No, it's not the government's responsibility if a private database gets compromised, unless you want it to be, but then if you did, you presumably wouldn't have a problem with NSA monitoring, would you?
The fact is, you should be concerned if government databases were being compromised. If private databases are being broken, don't patronize those companies. If you're concerned about your own security, be responsible for it. Use a firewall, don't give out passwords, and keep up with your antivirus software. In other words, don't be an idiot.
The government - outside of DARPA - has a horrendous record with technology, and it's got nothing to do with party affiliation. Our representatives of all stripes do not understand tech on almost any level, and they deal with it only to the point that it contributes to their reelection campaigns.
My point is that BOTH parties are guilty of not paying enough attention to enforcement of cybercrime, and a big part of that is that effective laws don't exist. I don't see either party doing anything about it. You think Kerry would have been any different? Don't make me laugh. Maybe if Gore had been elected, well, then, everything would have changed...
Posted by: dilettante on December 30, 2005 at 11:40 PM | PERMALINK
Oooga Booga!!!!
Are you scared yet?
No?
excuse please. Lemme try again.
e-Oooga Booga!!!
there. that worked.
Posted by: Joey G. on December 31, 2005 at 12:27 AM | PERMALINK
Invest in tech security? Why should they? It would just make it harder for the feds to spy on Americans.
Posted by: Brownie on December 31, 2005 at 10:21 AM | PERMALINK
Anyone have ideas on how smart cards could help with tech security?
Posted by: Neil' on January 1, 2006 at 6:11 PM | PERMALINK