Classified US military info available over P-to-P

Government and private files made available over P2P file sharing

Millions of documents, both government and private, containing sensitive and sometimes classified information are floating about freely on file sharing networks after being inadvertently exposed by individuals downloading P2P software on systems that held the data, members of a U.S. House committee were told Tuesday.

Among the documents exposed: The Pentagon's entire secret backbone network infrastructure diagram, complete with IP addresses and password change scripts; contractor data on radio frequency manipulation to beat Improvised Explosive Devices (IED) in Iraq; physical terrorism threat assessments for three major U.S cities; information on five separate Department of Defense information security system audits.

Information about the breach came during a hearing on inadvertent file sharing over peer-to-peer (P2P) networks held by the House Committee on Oversight and Government Reform chaired by Rep. Henry Waxman, (D-Calif.) One of those testifying was retired General Wesley Clark, who is currently a board member of Tiversa, a company that sells P2P network monitoring services to government agencies and private sector companies.

Clark described how "in a matter of hours" he was able to lay hands on over 200 documents containing classified and secret government data from P2P networks using Tiversa's search engine. He came across the documents while preparing for the hearing.

Some of the data appears to have come from the system of a contract worker at the Pentagon who installed P2P software on her computer, Clark said. The data included everything from Iraq status reports to a list of soldiers with their Social Security numbers. "They are the complete documents. They are not faxed copies. They are not smudged. They are as fresh as if they were printed off the computer" of the organization they came from.

"There's all kind of data leaking out inadvertently," he told the committee, noting that the documents he cited were "simply what we found when we put the straw in the water. The American people would be outraged if they are aware of what is being inadvertently being disclosed on P2P networks."

It's not just government data that is leaking out; So is a lot of sensitive corporate information, said Robert Boback, the CEO at Tiversa who also testified at the hearing. In written testimony, Boback listed several examples of corporate information Tiversa was able to pull from P2P networks. It found, for instance, the board minutes of one of the world's largest financial services organization, the entire foreign exchange trading backbone of a financial company and a comprehensive launch plan -- complete with growth targets -- of yet another financial company that was diversifying into a new region. Other corporate documents retrieved from P2P networks included press releases not yet issued, patent information, business contracts and non-disclosure agreements.

In addition, the ready availability of federal and state ID cards, passports, Social Security numbers, credit card information and bank account details make P2P networks a great source of information for identity thieves, he said.

Popular P2P clients such as Kazaa, Lime Wire, BearShare, Morpheus and FastTrack are designed to let users quickly download and share music and video files. Normally, such P2P clients allow users to download files to and share items from a particular folder. But if proper care is not taken to control the access that these clients have on a system, it is easy to expose far more data than intended.

Eric Johnson, a professor of operations management at the Center for Digital Strategies at Dartmouth College's Tuck School of Business, testified that inadvertent data disclosure on P2P networks is a "whole lot worse" than many assume.

Speaking with Computerworld after the hearing, Johnson said that accidental information disclosure on P2P networks has become a "substantial issue for government [agencies] and for banks and for large corporate enterprises. Many companies believe that they have implemented adequate internal controls to block access to P2P networksl, he said. The problem with these types of disclosures is that every employee, contractor, customer or supplier is a potential weak link.

"I spend a lot of time with CISOs and CIOs who think they have locked down their networks and made it difficult for people to join P2P networks," Johnson said. But those controls fail when employees take work home and then connect their systems to a P2P network. "CISOs can do a great job hardening their own networks but controlling what thousands and thousands of individuals do is impossible," he said

One company compromised in this manner is Pfizer Inc. In June, the company disclosed that personal data on about 17,000 employees had been inadvertently exposed on a P2P network after the spouse of an employee used a company computer to access a file sharing network.

Another example is the U.S. Department of Transportation. Daniel Mintz, the department's CIO, offered written testimony about how 93 DOT-related documents were inadvertently exposed on a P2P network. The exposure resulted when the teenage daughter of a DOT worker who was authorized to work at home installed LimeWire's P2P client on the computer containing the DOT data. The accidental data exposure was only discovered after a Fox News reporter informed the employee that he had been able to access several DOT-related documents from her computer, Mintz said.

DOT's inspector general "found that 30 of the approximately 93 DOT-related documents were publicly accessible at the time via LimeWire or other P2P software by virtue of residing in a 'shared folder,'" Mintz said. In addition, about 36 out of approximately 260 National Archives-related documents that were also on the employee's computer were in a shared folder and thus similarly exposed.

Recommended

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jaikumar Vijayan

Computerworld

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?