Ghosts in the shell

Grrrr said :

p1 said :

Perhaps the plans for things like ASIO buildings should not be put on computers?

Perhaps you mean “should not be on computers accessible by Chinese hackers, no matter how hard they try”?

Well, yes, that pretty much is what I thought. The plans, presumably, were drawn up on a pretty secure system, and not at that point hacked. They appear to have been hacked at a later time, when they had filtered down though various levels of security.

It is easy for me to say from the safety of hindsight, but maybe the actual contracting company didn’t need electronic copies on their own system?

Good perspective from Tony Wright:

http://www.smh.com.au/opinion/politics/chinas-payback-to-asio-the-latest-in-a-tradition-of-spookery-20130528-2n8wm.html

Baggy said :

At the end of the day it takes only one person with a USB, or even plugging a phone into a PC to charge.

Not if the USB port on the classified PC has been disabled.

p1 said :

Perhaps the plans for things like ASIO buildings should not be put on computers?

Perhaps you mean “should not be on computers accessible by Chinese hackers, no matter how hard they try”?

Presumably these “blueprints” would have drawn a Secret / HP or higher classification. This would have meant that the information was to protected from attack by infrastructure that follows a set of strict and comprehensive rules that apply for that classification. Rules written by people who consider precisely this scenario and know what needs to be done to avoid it.

So the real question is, who was the idiot not following those rules, and why the hell didn’t an assessment pick up the problems?

I’m not sure I agree with all the Green’s statements but there sure needs to be some answers here – and someone deserves to not get paid.

p1 said :

Perhaps the plans for things like ASIO buildings should not be put on computers?

Iran’s Natanz reactor was completely offline, and yet Stuxnet (IIRC) still managed to get into the network. At the end of the day it takes only one person with a USB, or even plugging a phone into a PC to charge.

p1 said :

Perhaps the plans for things like ASIO buildings should not be put on computers?

So… pen and paper everything, photocopy and post details out to all involved? It’d be a massive undertaking in itself, impractical and impossible to enforce. Somewhere along the line someone would scan something and email it rather than posting it and waiting 3+ days.

Perhaps the plans for things like ASIO buildings should not be put on computers?

> there’s growing evidence that the greatest threat to Australia’s national security potentially comes from foreign computer hackers

Nonsense. It’s from chipseal roads.

The Greens want an inquiry and justice for local contractors.