News
3/18/2008
08:21 PM
Terry Sweeney
Terry Sweeney
Commentary
50%
50%

Information Is Power

Government officials' seeming inability to manage information has led me to conclude they don't need a backup and archiving policy so much as they need a virtual Roto-Rooter turned on their servers and tape drives and cardboard boxes. And here are three cases in point.

Government officials' seeming inability to manage information has led me to conclude they don't need a backup and archiving policy so much as they need a virtual Roto-Rooter turned on their servers and tape drives and cardboard boxes. And here are three cases in point.Sometime between now and Friday, the White House will have to tell a judge why it is the Bush administration shouldn't restore what may be as many as 5 million lost e-mails. Barring any sort of delay or request for continuance, I'm betting they plead one of two arguments: that such restoration wouldn't be in the public interest, or that executive privilege extends to the mail server that couldn't.

U.S. District Court Judge John Facciola said the White House must "show ... why it should not be ordered to create and preserve a forensic copy of any media that has been used or is being used by any former or current employee who was employed at any time between March 2003 and October 2005." He gave them three days to respond in writing.

It's a bit disconcerting how long these things can drag on. In a perverse bit of political timing, the Clinton Library in Little Rock, Ark., began releasing archived information today on the daily schedule kept by former first lady and presidential candidate Hillary Rodham Clinton.

The National Archives is releasing 11,046 pages, according to this account. More than 4,700 pages have parts blacked out, mostly to protect the privacy of third parties, including their Social Security numbers, phone numbers, and home addresses.

And it's pretty safe to say these wouldn't be seeing the light of day if not for the dogfight that the New York senator is in for the Democratic presidential nomination. Judicial Watch had sued for their release as well.

Last we come to the backlog of Freedom of Information Act requests. Despite an executive order from President Bush in December 2005, the number of unanswered requests dropped only 2% in the next two years, from 217,000 to 212,000. An audit of the backlog by George Washington University said the order "lacked both carrot and stick." No punishment, no reward, no movement at all.

Speakers at next-gen Internet conferences for the last 10 years have bloviated that content is king. I don't think this bureaucratic stonewalling is what they had in mind with that comment, but it applies here. It's ironic and possibly even criminal in this age of access and free flow of ideas that information can be so difficult to nail down. Content's quickly dethroned when those who generated the content have the keys to the archive.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
10 Recommendations for Outsourcing Security
10 Recommendations for Outsourcing Security
Enterprises today have a wide range of third-party options to help improve their defenses, including MSSPs, auditing and penetration testing, and DDoS protection. But are there situations in which a service provider might actually increase risk?
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.