Former TSA Contractor Gets Two Years for Damaging Data – PCWorld Business Center

A former U.S. Transportation Security Administration contractor will serve two years in prison for messing with sensitive government databases used to identify terrorists as they try to enter the U.S.

James Duchak, 47, pleaded guilty in October to charges that he messed with code at the TSA’s Colorado Springs Operations Center in October 2009. Prosecutors say he tried to damage the TSA’s vetting database, just a week after learning that he was to be let go from his job.

Duchak deleted important code, used to properly format the birth dates of people entered into the system.

Duchak had been working as a data analyst at the TSA for about five years at the time of the incident. His job was to update TSA servers with data scraped from the government’s terrorist screening database and the United States Marshals Service Warrant Information Network.

The former contractor’s replacement — who Duchak was training at the time of the incindent — noticed the code changes, and the TSA shut down the database immediately.

via Former TSA Contractor Gets Two Years for Damaging Data – PCWorld Business Center.

TSA wants cyber forensics info — Washington Technology

TSA is interested in products that would give the agency the ability to scan, capture, identify, report, and resolve IT forensics matters, according to a sources sought notice published on the Federal Business Opportunities Web site June 1. The agency said it’s not issuing a solicitation at this time.

The agency is interested in solutions that would allow TSA forensic users to deal with insider threats, e-discovery procedures, data leakage, misuse of IT assets, anomaly detection, identification of malicious code, and compliance verification, according to the notice.

TSA wants companies to provide detailed descriptions of how their products work and what makes them unique. Specifically, TSA is interested in how a product:

  • Supports legal e-discovery processes.
  • Manages and performs enterprise forensics activities across multiple IT systems.
  • Can be used to schedule periodically recurring scans.
  • Integrates with desktop products.
  • Manages and tracks forensic information.
  • Identifies suspicious system activities, including any known exploits.
  • Supports remediation activities to remove identified threats while sweeping for known malicious code.
  • Reports problems.
  • Analyzes data.
  • Interfaces with other systems.
  • Is designed from an IT architecture perspective.

via TSA wants cyber forensics info — Washington Technology.

TSA document release show pitfalls of electronic redaction

The inadvertent exposure of a sensitive Transportation Security Administration security manual last month serves as a sobering reminder about the pitfalls of trying to redact, or hide, electronic text.

The lapse occurred when a contract employee posted the improperly redacted security manual — which described TSA airport screening methods that are designed to thwart terrorists — on a public Web site for federal procurements.

Other organizations, such as HSBC Bank and Facebook Inc., have also had embarrassing incidents in which text in electronic documents that they thought was unreadable was revealed.

Such lapses often result from a simple misunderstanding of how electronic redaction works, said Barry Murphy, an analyst at Murphy Insights, a Boston-based consultancy specializing in e-discovery and records management.

“Obscuring portions of text in a word processor by placing black boxes over it, for instance, does nothing to redact it,” Murphy said. The text may not be viewable, but it still can be indexed, making it very searchable and easily retrieved by copying and pasting the blacked-out portion to another document, he said.

via TSA document release show pitfalls of electronic redaction.

Twitter Weekly Updates for 2010-01-03

  • RT @dipnote: President Obama is now speaking live on major news networks regarding recent attempted terrorist attack. #
  • Special Agents from Homeland Security/TSA question and serve subpoena on blog authors | http://bit.ly/8SfeXM #
  • Federal agents seize computer from travel blogger for forensic analysis http://bit.ly/6MdX2b #
  • RT @ronfriedmann: RT PosseList @AdvertisingLaw "MS GC: Outside Counsel Must Integrate with Clients' Businesses" http://bit.ly/86Qno8 #
  • RT @IntegreonEDD: Can You Meet and Confer without an e-Discovery Expert on Hand? http://bit.ly/8UOIwi | Integreon Blog #
  • Blogger Threatened by DHS for Posting New TSA Screening Directive | Threat Level | Wired.com http://bit.ly/5G21wZ #
  • RT @IntegreonEDD: 2009 Socha-Gelbmann Electronic Discovery Survey Report Now Available http://bit.ly/6jcSG8 #
  • RT @WanderngAramean: Another TSA document redaction failure http://bit.ly/88vB5y #

Powered by Twitter Tools

TSA drops subpoena for blogger’s information

31/12/2009 – SD-1544-09-06 : This Comes To An End

Shortly before 7:00pm this evening I received a phone call that would end this year and allow me to have a Happy New Year. My call this evening came from John Drennan, the Transportation Security Administration’s Deputy Chief Counsel for Enforcement informing me that the TSA would no longer be pursing me for information regarding the identity of the person who sent me Security Directive SD-1544-09-06.

The subpoena that Chris Elliot was fighting was also dropped in its entirety by the TSA.

Hopefully this is the end of this situation, the agency will replace the MacBook they damaged, and we can all move forward.

I hope 2010 is the year the TSA can find a permanent Administrator the agency can find its defined focus to become a shining star within the Department of Homeland Security.

Happy Flying!

via Flying With Fish » SD-1544-09-06 : This Comes To An End.

Twitter Weekly Updates for 2009-12-20

  • @eMagSol I think you are a victim of spambots, many of which are targeting blogs. in reply to eMagSol #
  • To expand references & links to their sites. RT @eMagSol: @globaledd but what purpose does it serve? i'm so confused! must have reasons! #
  • RT @mix3travel: Was Secret TSA Screening Manual Posted By a Temp? – ABC News http://bit.ly/6LO5Ww #
  • Examining a Move to Change Securities Litigation – http://nyti.ms/6cnqNd #
  • Yes! RT @eMagSol: did anyone else's timeline freeze for a couple of minutes? #
  • RT @IntegreonEDD: RT @jfehrman Interoperability: The Other Side of Our Settlement w/ European Commission http://tinyurl.com/yj969eo #
  • RT @IntegreonEDD: RT @econwriter5 WSJ: How to Write an Operations Manual http://tinyurl.com/ycx9gsg (standardsand procedures for business) #

Powered by Twitter Tools

Twitter Weekly Updates for 2009-12-13

Powered by Twitter Tools

Did The TSA Compromise An Intelligence Program?

What the heck is WOMAP? The unredacted version of the Transportation Security Administration's supervisor security manual includes references for a heretofore unrevealed Central Intelligence Agency program called WOMAP — The Worldwide Operational Meet and Assist Program.

According to the TSA's regulations, “foreign dignitaries” escorted by CIA officers are exempt from screening so long as the CIA submits their name, date of birth, itinerary and other information in advance. In general, the CIA officers who accompany these dignitaries are members of the Agency's Office of Protective Services, which provides security for the agency, its assets and its people. There's a separate procedure for screening foreign dignitaries approved by the Department of State. So it would seem as if the WOMAP program serves another purpose. Helpfully, the TSA manual provides some clues.

Persons who receive WOMAP status must be provided to the TSA's Office of Security and classified at the For Official Use Only Level. It “may be provided at the classified” level too. Importantly, the WOMAP information is so sensitive that  ”[t]he title or position of the dignitary will be used by the Office of Intelligence to determine eligibility for screening courtesies, but will not be forwarded to the TSOC and respective FSDs.” That is — too secret for even the airport federal security directors, who have Top Secret clearance, to know.

via Did The TSA Compromise An Intelligence Program? – The Atlantic Politics Channel.

TSA Breach Exposes PDF File Risk — InformationWeek

Employees at the Transportation Security Administration inadvertently exposed classified information about the agency’s security procedures because, apparently, they don’t know how PDF documents work.

What’s not clear is how many other government departments, legal agencies, healthcare providers, and other organizations that deal with sensitive information are unaware that a quirk in Adobe’s Portable Document Format can leave data open to prying eyes.

TSA officials posted what they thought was a redacted version of the TSA's airport security operating manual on a Web site used by private contractors looking for government work. The problem: the officials didn't actually delete sensitive parts of the document—they just blacked them out using a graphics tool.

That method left the underlying words intact, and they were exposed when readers cut and pasted pages from the document, “Screening Management Standard Operating Procedures,” into a new file. The vulnerability isn't technically a bug in Adobe's product, but its existence shows how those handling secure information should be fully trained in the software they're using.

The end result of the foul-up was that highly sensitive information about TSA screening methods, interviewing procedures, X-ray machines and other terrorist prevention tools became easily available to millions of people on the Web.

via TSA Breach Exposes PDF File Risk — InformationWeek.