[iwar] [fc:IG.Finds.'Sensitive'.Data.Still.On.DOD.Web.Sites]

From: Fred Cohen (fc@all.net)
Date: 2002-08-02 07:52:49

Next message: Fred Cohen: "[iwar] [fc:China.second.to.US.in.web.traffic:.study]"
Previous message: Fred Cohen: "[iwar] [fc:openssh-3.4p1.tar.gz.distribution.recently.trojaned]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Message-Id: <200208021452.g72Eqn004871@red.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Fri, 2 Aug 2002 07:52:49 -0700 (PDT)
Subject: [iwar] [fc:IG.Finds.'Sensitive'.Data.Still.On.DOD.Web.Sites]
Reply-To: iwar@yahoogroups.com
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

InsideDefense.com
August 2, 2002
Sensitive information remains on several Defense Department web sites
despite earlier warnings that the data was inappropriate and should be
removed, according to the Pentagon inspector general's office.
In a July 19 report, the IG found that as of May 2002, thirty of the 200
documents on publicly accessible DOD Web sites that the Joint Web Risk
Assessment Cell previously identified as inappropriate were still available
for public viewing.
JWRAC identified the sensitive information eight months earlier in a
September 2001 report.
Established in 1999, JWRAC employs reservists to analyze data on DOD Web
sites and identify information that poses potential or real threats to
ongoing operations and DOD personnel.
Inappropriate information includes data labeled "For Official Use Only,"
"sensitive" or "classified," as well as other information at one or more
sites that, when combined, would be sensitive or classified, the IG report
explains.
The inappropriate information remained on DOD Web sites in spite of JWRAC's
assessment because the assistant defense secretary for command, control,
communications and intelligence did not establish "a mechanism to remove
potentially inappropriate information from Web sites," the IG said.
Further, the ASD (C3I) has not instituted "an adjudication process to
resolve differences between the Joint Web Risk Assessment Call and Web-site
owners on whether disclosures are inappropriate," the report adds.
The ASD (C3I)'s office did not concur with the IG's recommendation to
suspend Web pages that contain potentially inappropriate information. In a
June 14 memo, Deputy Assistant Defense Secretary Carol Haave said DOD
components should resolve differences of opinion on whether or not the
disclosures are appropriate before deleting them from the site. She added
that Web site postings are based on operational security evaluations at the
local commander level and, unless overturned by a higher authority, their
decision is final. 
"As the information in dispute is not classified, there is no generally
compelling reason to preempt the decision of command authorities pending
resolution of such disagreements, " Haave told the IG.
The IG took the opposite approach in its response, claiming, "information
that may place DOD at an increased risk must be suspended until resolved
through an adjudication process."
The Defense Information Systems Agency concurred with the report's
recommendation to publish the JWRAC's Standard Operating Procedures for
Discrepancy Reporting and Tracking and to establish a database system to
track Web risk-assessment activities.
-- Malina Brown

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/

Next message: Fred Cohen: "[iwar] [fc:China.second.to.US.in.web.traffic:.study]"
Previous message: Fred Cohen: "[iwar] [fc:openssh-3.4p1.tar.gz.distribution.recently.trojaned]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.2 : 2002-10-01 06:44:32 PDT