2003: New Electronic Surveillance System Vulnerable to Hacking, Exploitation

An internal audit shows that the cutting-edge electronic surveillance system, DCSNet (see 1997-August 2007 and After), is unacceptably vulnerable to hacking and exploitation. The audit finds numerous security vulnerabilities, including the allowing of multiple and shared logins, a lack of firewall and antivirus software, and Windows-based vulnerabilities surrounding the operating system’s administrative functions. Steven Bellovin, a computer science professor and surveillance expert, says the risks from insiders are particularly worrisome. “The underlying problem isn’t so much the weaknesses here, as the FBI attitude towards security,” he says. The FBI assumes “the threat is from the outside, not the inside,” and believes that “to the extent that inside threats exist, they can be controlled by process rather than technology.” He considers the entire system at risk both from insiders and hackers from outside. “Any time something is tappable there is a risk,” Bellovin says. “I’m not saying, ‘Don’t do wiretaps,’ but when you start designing a system to be wiretappable, you start to create a new vulnerability. A wiretap is, by definition, a vulnerability from the point of the third party. The question is, can you control it?” [Wired News, 8/29/2007]