John Klossner: Everybody's doing it

Earlier this month the Federal Aviation Administration became the latest in a long line of agencies and companies that have had data hacked into and/or stolen. It announced that "the personally identifiable information of more than 45,000 employees and retirees was stolen electronically.(As an aside, the FCW headline said that a "massive" data breach had occurred. It makes me wonder what the journalistic levels are for this terminology. At what number does it become a "massive" breach? I suggest the following terminology levels:

• 1- 99 "Human error."
• 100 - 751 "Trend-setting."
• 752 - 5,499 "Noticeable."
• 5,500 - 10,000 "Knocking on problem's door."
• 10,001 - 24,999 "someone's bound to hear about this."
• 25,000 - 39,999 "Typical."
• 40,000 - 74,999 "Massive."
• 75,000 - 125,000 "There's no such thing as bad publicity, right?"
• 125,001 - 250,000 "I'll call the press just as soon as I update my Monster.com profile."
• 250,001 - 750,000 "I'm not telling. You tell."
• 750,001 - 999,999 "Thank goodness we have a form letter for this."
• 1,000,000 - 10,000,000 "What's the record?"
• 10,000,001 - 50,000,000 "Can we get a book deal?"
• More than 50,000,000 "Do you think California will be mad?"

I was all prepared to write a sarcastic piece on this breach. I was ready to put on my school teacher's hat and play another version of the "Why aren't these people practicing commonly acknowledged security measures?" lecture. I had prepared a concept to make anyone losing data look foolish. I had lined up quotes taken out of context. I was poised to shoot fish in a barrel.

This snark tour de force was written and ready to ship earlier this week. I like to wait one more day before sending it out, in order to give myself 24 hours to look at it again and clean up the numerous mistakes in logic and spelling I normally accumulate in a short space, or come to my senses. In the meantime, I did some reading.

I draw cartoons for a couple of technology publications. In order to educate myself on possible cartoon subjects, I spend several hours reading whatever I can find on the topics. This week, while reading the various tech journalism outlets and waiting to send out the blog entry, a couple items caught my eye.

• Federal Computer Week ran a follow-up on the FAA data breach situation.
• In the course of checking out my usual outlets, I found stories covering at least a half dozen breaches -- in both the federal and private sectors -- this week alone, with remnants and follow-ups on three or four other breaches. In short, data breaches aren't the isolated incidents they used to be. In addition, to ridicule them -- as entertaining as that can be -- is simplistic and doesn't nearly acknowledge the depth of the problem, or the efforts of those addressing it. (As a working cartoonist, I will deny ever having made that statement. The editors added it. And this.)

In particular, the FCW article fleshed out the issue with points that can be applied to all data breaches. In particular, this line: "A new report from the Homeland Security Department's U.S. Computer Emergency Readiness Team (US-CERT) adds even more fuel to the fire. The report listed 18,050 cybersecurity incidents in agencies in fiscal 2008, compared to 5,144 in fiscal 2006."

The piece goes on to point out that the increase in reported attacks has a couple of angles to it. Is there really an increase? Or better discovery and reporting by those attacked? There may have been 18,000 attacks -- according to my chart, this would be headlined as a "someone's bound to hear about this" number -- in 2006, but the available security detection technology, combined with the fear of bad publicity, allowed only 5,000 ("noticeable") to be reported. The truth is probably somewhere in between, but I don't think anyone would argue that there aren't many more data attacks occurring today. Everybody is vulnerable, despite their best security efforts. Heck, the FAA's systems' security is so highly regarded that OMB chose it to be one of four agencies to help other agencies with their cybersecurity efforts. And they just had 45,000 names hit. (In a future snark piece, I will work up the recognition one receives based on the size of the security breach. e.g., 40,000 - 49,999, you get to advise other agencies, 50,000 - 74,999, you get named the cybersecurity czar, etc.)

The bottom line is that every computer system is under attack, and even vulnerable, despite the best security measures. Based on my own highly unscientific and even more highly anecdotal count, the vast majority of us have experienced a data theft in one way or another.

There are some legitimate complaints, however. The FAA, other than notifying authorities, was mum, waiting a week to notify those affected. As someone who has experienced several data breaches I can empathize with employees who receive little to no information and await communication from those supposedly charged with protecting that information. At the least, please realize I'm going to have to spend my time replacing information, so acknowledge that; don't add to my work by making me have to chase you down for the smallest tidbit of information. If I can go back to my snarky opus, why is everything about a data breach high tech, 24/7, etc., and the organization responds with...a good old-fashioned letter? What, the Pony Express wasn't available? The FAA also used Social Security numbers as identification. If we're going to acknowledge that data attacks are ever present, it's probably not a good idea to leave skeleton keys laying about.

I'm also a little uncomfortable with one point of the FAA's defense. It was mentioned in the follow-up reports:

"The IT and security shop did it right," he said. "They couldn't stop all attacks, but they, unlike most agencies, actually found the problem. The user groups, on the other hand, had some files with personally identifiable information left in a vulnerable location.

In other words, it's the users who have a problem, not us.

You're only as strong as your weakest link, guys, and something tells me that, as a fed agency, you're going to have a wide variety of user groups with a wide variety of systems and security practices. It's going to be a long road getting everyone on the same security page, so please don't start by throwing bombs at the folks whose data you're storing. We're all on the same team here.

But this is going to be really hard for us snarkers.