National's slack internet security | The Jackal

15 Feb 2012

National's slack internet security

Today, stuff.co.nz reported:

The Telecom Xtra account was broken into by international hackers' collective Anonymous, potentially revealing sensitive Cabinet information and cable traffic from foreign posts.

McCully had asked that official emails be forwarded to that account while he was overseas in April last year.

Prime Minister John Key said he was aware of the breach and warned other ministers to be more careful, particularly about passwords.

[...]

McCully said he had not had an easily hacked password. "Any breach of security is serious. Mr Key made clear his expectations.

"My office and I are [now] more careful about these things."

Too many assumptions are going on here. Firstly there is no evidence that it was hacker collective Anonymous that gained access to McCully's email account or that the password itself was hacked. This appears to be spin to make the story juicy.

Slack security measures and incorrect procedures mean documents like this one (PDF) marked 'IN CONFIDENCE' and not intended for public release are readily available online from The Department of the Prime Minister and Cabinet website. Nothing groundbreaking... but it's another good example of slackness.

There are many holes in the government's Internet security, mainly because there are so many operators that don't know what they're doing.