On-Call-IT Assists In Government Data Destruction 163
covaro writes "Seems those on-site computer services may be helping to cover up government dirty deeds these days. The Wall Street Journal reports: 'Investigators learned that [Office of Special Counsel head Scott Bloch, who has been under investigation since 2005] erased all the files on his office personal computer late last year. They are now trying to determine whether the deletions were improper or part of a cover-up, lawyers close to the case said ... Bypassing his agency's computer technicians, Mr. Bloch phoned for Geeks on Call, the mobile PC-help service ... Bloch had his computer's hard disk completely cleansed using a "seven-level" wipe: a thorough scrubbing that conforms to Defense Department data-security standards. The process makes it nearly impossible for forensics experts to restore the data later.'"
Hire someone??? (Score:2)
You have to wonder - For those who can't do such things themselves, wouldn't it cost less to just buy a new HDD, and take a sledgehammer (or thermite, where readily available) to the old one?
Sure, for most Slashdotters who can do their own "seven level wipe" (or whatever number the current rumors claim works infallably), saving a few hundred
Re: (Score:3, Informative)
My DoD owned computer at work has the serial numbers recorded for all hardware installed inside the case.
Replace the HDD and somebody somewhere would know and think I stole the disk or data, wipe it and I just say I was removing porn. Porn would get me fired, stealing the HDD or data would get me fired and thrown in
Two words... (Score:2)
Taking a hammer (or thermite) to a hard drive is considerably more suspicious than saying you "wiped your drive because you thought you had a virus". In todays security-conscious environment, an overzealous old guy wiping his drive in such a manner can easily be spun into something done with a good conscience... or if you're feeling brave, stupidity...
How about Hanlon's Razor; "never attribute to malice, what can be attributed to stupidity".
And that's your perfect answer "Oops
Re:Two words... (Score:5, Insightful)
Thirty years ago, there was a huge uproar about some guy erasing a few minutes of tape. Nowadays, politicians get away with destroying evidence while under investigation...and the media doesn't even raise a stink. He who controls the media, indeed.
Re: (Score:2)
Re:Two words... (Score:5, Insightful)
That's the polar opposite of the perfect answer. This is a government computer we're talking about. End-users aren't to be performing maintenance, contracting out maintenance, or any other such notion. The idea of "oops, I must've got a virus" complete bullshit: any IT department worth its paycheck has ensured their systems are virus-proof. In the event that a virus did manage to make its way through, mandatory SOP would be for the in-house shop to determine how security was compromise, the extent of the damage, and ensure that the issue has been resolved properly. Now take that up a notch for government systems, and "oops!" is far from a perfect excuse.
This fucker needs to be investigated.
Re: (Score:2)
No, this fucker's superiors need to be investigated. This fucker should now be presumed guilty and immediately punished!
Re: (Score:2)
Re: (Score:2)
1. You don't end up with a highly suspicious wipe and reinstall.
2. You don't have to download extra, suspicious software to do the wipe for you as cipher.exe is included with Win2K and
Re: (Score:2)
Ah, there it is, cipher.exe was included in a hotfix. [microsoft.com]
Re: (Score:2)
Sure, for most Slashdotters who can do their own "seven level wipe" (or whatever number the current rumors claim works infallably), saving a few hundred bucks for "good enough" makes sense. But if you plan to spend the money either on a drive or an "expert", why not just physically trash the drive?
Physically trashing th
Re: (Score:2)
If he uses his own trash. As to bent or broken: Yes, data can be recoverd. At great cost and very slowly. Think 10's of millions and months to years. The one destruction you cannot recover from (besides a simple, complete overwr
Re: (Score:2)
Forget Curie point and just melt the sucker. Find an ironworks and throw the drive to a steel converter. Good luck getting data back from a railroad track which used to be a disk :).
If you don't have ironworks, take a welding equipment over every point of the surface of the disk until it physically
Re: (Score:2)
I doubt very much you will be allowed to do that.
If you don't have ironworks, take a welding equipment over every point of the surface of the disk until it physically deforms. For extra credit, use an electric welder.
Sometimes the surest solution is good old-fashioned brute force.
Sounds more like good old-fashioned stupidity to
Re: (Score:2)
You can tell with a glance whether or not a drive has been melted. You can't tell with a glance whether or not a drive has been subjected to Curie point temperature on every point of the disk surface, just that it has been subjected to lots of heat. Melting the drive therefore ensures that no un-treated ones get thrown out by accident.
Furthermore, can you guarantee that the magnetic fields are the only mark left to the disk by writing ? Mayb
Re: (Score:2)
Nonsense. No such effect exits.
Melting the drive makes it completely unrecoverable for any technology short of reversing entropy.
As does exceeding the Curie-temperature. As to determining the Curie-Temperature, a simple literature-seach does that. Temperature can be stimated by glow-color very easily. As a rul
Re: (Score:2)
To the best of your or my knowledge, no. Why take a risk that that knowledge is incomplete ? It seems to me that the one common factor in most breaches of security is that someone got overconfident at some point.
Welding equipment is sufficient to melt steel; that's what welding is
Re: (Score:2)
He's done nothing wrong (Score:1, Insightful)
Re: (Score:3, Insightful)
Sounds like (Score:1)
Unless they happen to be ex-DoD IT employees, trying to make ends meet.
Re: (Score:3, Interesting)
Exactly as I suspected (Score:2, Insightful)
Notice the wording: _nearly_ impossible. But not impossible, huh?
Lessoned learned: don't trust a seven-pass DOD 5220.22-M. Use a 35 pass ( http://en.wikipedia.org/wiki/Gutmann_method [wikipedia.org] ) because you never know who wants your private collection of pr0n.
Re: (Score:3, Informative)
Also I wonder if this does not hasten the death of the drives it is used on.
Re: (Score:3, Informative)
Re: (Score:2)
Notice the wording: _nearly_ impossible. But not impossible, huh?
I'm not sure if you're joking or not, but in case you aren't, do you really trust the some dumb WSJ journalist over what HD experts have been saying for years? What likely happened is said dumb WSJ journalist asked the local tech guy about wipes, he said "yah, if you do it right it can't be recovered..", so that became "nearly impossible".
HD technology isn't secret. There may be some techniques the HD makers don't like to share, but the tech
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
The gist of the article was that when data's stored for a long time, it has a detectable effect on the surrounding areas. So, no matter how many times you overwrite the data, the signature of the original is still detectable if you have sufficient resou
Re: (Score:2)
Re: (Score:2)
I wonder what is the theory erasing solid-state memory....
Re: (Score:2)
If you're talking about nuclear launch codes or other truly valuable data, don't wipe the disk, destroy it by melting it to slag and get a new one. They only cost $100 dollars apiece, after all.
Re: (Score:3, Insightful)
This is likely just incompetent journalism. There is zero evidence that anybody can recover data after one overwrite with zeros on a modern drive.
Re: (Score:2)
See this: http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml [ucsd.edu]
So that's how the WH lost 50,000 emails! (Score:3, Insightful)
It's strange how there's no outrage over these kinds of things. The need for transparent government is seriously overlooked.
Re: (Score:1)
Re: (Score:2, Insightful)
Surely after all these years, you would expect governments to have some kind of backup system or plan. They should start using thin-clients, NFS (or any better thing) and do full backups weekly.
Re: (Score:2)
our rotation goes like this:
2 sets of Monday - Thursday tapes, that rotate.
5 sets of Friday tapes, Friday 1 is always the first Friday of the month, Friday 2, the second, etc.
That we we always have 2 weeks worth of full back-ups, 1 months worth of weekly backups, and the Friday 5 tape only gets used once a quarter. On top of that student records and financial data is all backed up separately as well
Re: (Score:2)
Does your *EVERYTHING* include every single desktop and lapop used by staff? Most organisations (like ours) don't do any backups of individual PCs, because most of the data is unimportant (on the disc image used to build the system in the first place), and there's no guarantee that the system will be on when the backups run.
That does sometimes mean people lose data when their disc drive fails (saving on the desktop or My Docs), but that's their own fault; everyone is told that if they can't afford to lose
Re: (Score:2)
So who will stand up for his Rights? (Score:1)
Then again, the Inquisitors won't need the data, they can just torture whatever information they need out of him, in order to help prove that the current Administration is devil-spawn, while the promises of th
Re: (Score:2)
Um, he's "The head of the federal agency investigating Karl Rove's White House political operation" (first line of TFA).
So the message is: In Bush's America, if you investigate the administration, and someone will investigate YOU.
Re: (Score:3, Interesting)
From parent: "In Bush's America..."
So your kneejerk reaction is to criticize the current administration. While completely ignoring the fact that a Clinton Administration is completely capable of doing the exact same BS, for the exact same reasons. In fact, they have, and will - it is well known that the one thing you *don't* want to do is to cross The Hillary, not if you want to keep your sack intact. We saw what happens to folks back when Bill was Prez.
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Unfortunately I think it's too late to reform the elections system and false two part (opposite sides of the same coin) system. I hope it's not, but I am being realistic. Whether you believe it or not, the US government is bein
Re: (Score:2, Interesting)
Not so, for what it's worth, despite (or more probably, *because of*) what you might see/hear "reported".
I know some insiders, including a good friend in the Secret Service, and I've heard the stories first-hand. Much of the truth about politicians in general, and in this case, the Clintons in particular, *never* gets close to being reported tru
No need to waste money... (Score:2)
Two words that fuck up your plan. (Score:2)
Official
Most of the mouth-breathers who work for the government (especially the fogeys in the upper echelons) count themselves lucky if they know how to breath and spread bullshit at the same time.
Computers? That's like, magic or something...
In short, can you smell the Lud?
Dban also doesn't work (Score:2)
hope someone's still got the backups (Score:2)
All that remains is to find the tapes ...
business in destructable drives (Score:3, Interesting)
when i was a kid, an older geek guy told me, with admiration in his voice, about collins radio, and the manual that went with its equpiment for the military.
the 1st page of hte manual said something to the effect, if this equipment is about to be captured by the enemey, here is one thing you can do in 1 min to render the equiment unusable....
Re: (Score:2)
In other words, those instructions weren't there because the radio is so special, but rather because the military is so paranoid
Re: (Score:2)
sounds like there is a business selling physically destructable drives - a drive witha an easy open case, and a method to physcially damage the platter
Why do that? Just buy a large amount of flash ram. It can be erased rather quickly, and isn't recoverable. If you want to be "extra paranoid", do the 7 pass thing.
If you have a HD, just download, boot, and run dban [sourceforge.net] on it. It's not all that difficult, even for a neophyte.
Re: (Score:2)
i guess the question is how are you sure - like in bet a months salary sure ?
Depends on what the conditions are. Recovering a single bit on the whole hard drive sure? No. Recover anything meaningful? Sure. (BTW, with shredding the harddrive, A determined attacker would most certainly be able to recover something meaningful). Those bits are packed tight.
software methods always leave a doubt
It seems like this attitude persists, but I've never heard of anyone recovering anything after a full wipe.
Re: (Score:2)
Actually, they already exist. They require an accessory that costs about $50. [homedepot.com]
He should have used a Mac (Score:2)
Select your hard drive from the list on the left. Note that you can erase either a whole drive, or just a selected partition.
Click on the Erase tab, then on the Security Options button.
Click on the 7-Pass Erase radio button. On Tiger (10.4) it says this provides a "highly secure erasure" of the drive; on Leopard it names the MI
Somewhat off topic...MOD down if you must. (Score:4, Insightful)
Re: (Score:2)
This is a major latent difference between Americans and the English and much of RoW who accept the legitimacy of government even though they frequently complain about certain implementation details and effects.
Re: (Score:2)
This is a major latent difference between Americans and the English
I don't think "latent" was quite what you meant there.
Nor was "English".
In any case, your point is rather muddy. You describe Americans "worrying about" the actions of their government whilst the Brits "complain about implemention and effects". This would seem to amount to pretty much the same thing; I'm either concerned about what my government does and how it impacts upon me, or I'm not?
In terms of "illegitimacy" Americans have plenty to gripe about due to controversies over the last couple presidential
Re: (Score:2)
English because I don't believe the Scots, Welsh nor Manx have the trait to the same extent. At least not more than the French. The N.Irish do and are more like the English.
I may well have been unclear: everybody worries about the actions of their governments. Americans doubt the legitimacy of their own govt. And this is not new with G.Bush but has
Re: (Score:2)
Re: (Score:2)
People can be good people and still be ordered to do bad things. Some will resign or risk firing, more will complain and protest, but many will mainly reassure themselves that it's not their responsibility, obey orders and feel bad about the people affected. It takes a lot to stand up a
I am proud ... (Score:2, Funny)
Speaking on behalf of this guy... (Score:2)
Policy (Score:2, Interesting)
Most new HDDs have intenral "secure wipe" function (Score:2, Informative)
Takes a few minutes, and is allegedly more secure than DBAN but still not as secure as physical destruction.
You're welcome.
I broke the cardinal rule... (Score:4, Interesting)
Re: (Score:2)
Any "work product" should be kept on the servers. Within about a month, if no one asks for "missing report B", we do a thorough wipe and re-image.
This could have been a case of "while you guys are waiting for this wipe, can you look at something else".
Re: (Score:2)
Mr. Bloch was appointed to an office charged with providing oversight for the administration. The irony was, Bloch was appointed by George Bush but that position does not serve 'at the pleasure of the President'. The person in that position has a 5 year term and can not be removed except through disciplinary means. Theoretically, Bloch was independent from the WH and above partisan politics.
Bloch was charged with investigating whether or not the Whiteh
Simple answer (Score:4, Insightful)
Now let's suppose he did a good job of destroying all the evidence, now he can only be tried for destroying evidence, which is pretty bad, but perhaps not as bad as whatever it is he actually did.
If you were wanted for heinous crimes against humanity (I don't know uhh... biological warfare!), and the only person with any proof winds up dead at your hands, you just need to defend yourself against the murder charge.
Security depends on attack capabilities (Score:2)
I suspect that even after a single zero pass, the disk has to be mounted in some sort of electron microscope. Maybe it can stay mounted but the heads have to have analog circuitry attached. In either case, the question is over magnetism remaining after overwriting. I suspect that three good [uncracked] pseudorandom passes is more tha
Re:Security depends on attack capabilities (Score:4, Informative)
[PDF] Recovering Unrecoverable Data [actionfront.com]
Unless the company has made great advances in the product they advertise at the end of the paper, you can be sure that two passes are more than enough to prevent anyone from recovering your data. Intelligence agencies are more likely to kidnap and torture you than invest the extraordinary time and money to get your bits back.
Re: (Score:2)
Stunning eh? I'll challenge anyone to prove that it is possible to recover anything from a modern hard disk that has been overwritten once with anything other than a magnetic microscope. And even that is questionable.
Modern drives are so dense that drive makers have a hard enough time getting data back off of them after its been written.
But you asked for documentation:
NIST Guidelines for Media Sanitization
http://csrc.nist.gov/publications/nistpubs/800-8 [nist.gov]
He should have used a Mac (Score:2)
Seven-level wipe? (Score:2)
Forensics exper
Re: (Score:2)
Not if you wipe all the freespace (non-file or empty sectors) as well, which any good secure delete tool (like the open source Eraser) will do for you. Just give it eight (8) pases of pseudorandom and the whole drive is either intact files or psuedorandom background noise. About the only thing that an investigator can tell you then is that a secure deletion tool has been used, not what was deleted or even where it existed on
Re: (Score:2)
An investigator can tell you that there was data on the drive at various locations that got freespace wiped. He can tell you subsiquent files were securely deleted at various locations, and in what likely order. The secure deletion scribble
Couldn't do it himself... but many can. (Score:2)
And why didn't this guy just do a simple google search and use a DBAN boot disk? Moron had to call for help...
Backups? (Score:2)
Oh, wait. This is a gov't operation. Never mind.
Nearly impossible???? (Score:2)
A seven times overwrite of a modern disk with some random passes in between cannot be recoverd from by any means in this universe, that has to read the data from disk. The disk cannot hold 7 times as many data. It is not a question of reading equipment, but a coating material limitations. Magnetic microscopy
Plausible Deniability (Score:2)
Happens all the time (Score:2)
Regardless of whether there was ill intent, I'd just wanted to mention this bypassing happens all the time. I knew a business manager once who said that when wishing for a simple application, he would run into their internal department who were used to big projects. So instead of starting building (or even analyzing) with said app, they'd respond with giving him forms for access to new servers, allocating helpdesk people, assigning a project
Nothing weird here (Score:2)
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
Sledge hammer applied repeatedly.
Industrial shredder.
Thermite.
Persistant application of a grinding wheel.
Personally tossing in a large crucible of molten steel.
Fuming sulfuric acid.
We may not all have the resources to do all of the above, but I'd bet most of us can find a way to physically reduce a HDD to very very small chunks, if not completely dissolving/melting it at a molecular level.
Re:Why not just by a new hard disc (Score:5, Informative)
BTW, nitric acid would likely be more effective than sulphuric. And a mix of nitric and hydrochloric (commonly known as aqua regia) will probably do an even better job. The nitric acts as an oxidizing agent while the hydrochloric can help complex some of the resulting metal ions making the mixture more effective. Sulphuric would probably just get rid of some of the organic coatings in the time that it would take the aqua regia to chew through all the metals.
COVERUP - My Rejected Submission (Score:2, Interesting)
Re: (Score:3, Informative)
Just in case you are wondering what I was trying to hide, it was bank account details from about ten years ago.
Re: (Score:2)
For the most fun, though, nothing beats shooting them. (I'm a fan of 5.56mm at about 100 yards, since it keeps you well away f
Re: (Score:2)
No, you cannot read data back once it's been overwritten. Not even if you're the NSA. Not with modern drives, anyway, modern being "any drive made in the last ten years".
"Overwriting Everything" is surprisingly hard (Score:3, Informative)
Re: (Score:2)
These days, drives don't use simple "on/off" transitions to mark data. It's a gross oversimplification to say it's an analogue signal that gets recorded to the disk, but that's essentially what it is. The idea of detecting vague afteri
Re: (Score:2)
Take it to a service and have it shredded. In fact, since a lot of forensic data recovery is done with scratch files, etc., that may be stored separately, take the whole computer to a service and have it shredded. (Yes, at least here in DC, there are such services.)
Since this wasn't his computer, but his employeers' computer, I expect that he may find that his easure wasn't as effective as he would of liked, and that he may now be in a lot of trouble.
Re: (Score:1, Informative)
Re: (Score:3, Informative)
Re: (Score:2)
Three little words (Score:2)
(Sadly, that's just a video of an iPhone -- couldn't find one of a hard drive.)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Because the in-house IT guy probably knows that a nice, clean backup of the drive prior to wiping is his ticket to an early retirement. For the less cynical of you, he is a lot more likely to know that this is a no-no and call someone about
Re: (Score:2, Insightful)
There is no such thing as a reasonable level of privacy for the things you list [regardless of gov/corp status]. An employee has no right to use the employer's equipment/services for personal purposes, that includes "emails, web surfing history, porn or whatever o