Goatse Security

Most of the media coverage on the AT&T leak is a mix of factual information and spokesperson quotes. Journalists ask us questions, which we are glad to answer because it means our opinion somewhat matters. But in the end, we mostly see the old full disclosure debate, and the attempt at labelling us white hats, black hats or brown hats. Yet I think there is something new here.

Gawker identified many high profile people in the list of emails leaked by AT&T. They could easily tell them from other individuals, because they had nifty .gov or .mil addresses. At DARPA, in the EUCOM, at the White House, NASA, DoJ, the FAA… So many government employees who really, really needed an iPad.

I hope there are still a few investigative journalists out there who will certainly be thrilled to try to answer the taxpayers’ question of who exactly paid for all those government officials’ iPads. But this is not what worries me the most here.

I graduated from a pretty elite engineering school. People from that school don’t usually end up plotting funny hoaxes or working for the entertainment industry (though my favourite one actually did). They often occupy high level positions in large corporations or government agencies. When I was studying there, people from the secret services came several times to teach us about the risks of information theft. They were very serious about it. If you were going to work for the government or a top national company, you would have to learn not to write down your password under your coffee mug, but also to be wary about data protection, cell phone eavesdropping, foreign agents, including more intimate spying techniques. The message was clear: information is power, you will have it, and others will want it.

Later I worked for a state-owned company. The IT people there were using an antique version of Microsoft Exchange and disallowed the use of Firefox because it had not been approved by the security people yet. I found that extremely annoying, especially since my previous works at several security companies led me to different conclusions about the products being used, but at least it showed that they cared about security, even for average employees. I was willing to give up convenience for security.

But Barack Obama disagreed. In early 2009, he fought to keep using his BlackBerry device, against the objections of secret services and government lawyers. Barack Obama wanted convenience over security. The country’s security. And by doing so, he gave tacit clearance to every fucking idiot in the government or the military to get the latest cool electronic gadget and use it with their government email account.

Since not so long ago, UK ministers can no longer use iPhones due to security concerns. Now I hear the FBI is going to… come for Goatse? Please, someone at the NSA wake up and give a good spanking to those US government idiots using a device with a public 3-month old unfixed security vulnerability with their military or government email account. And everyone else who let them.