Congressional report rips U.S. TSA Web site security
521544
A Web site commissioned by the U.S. Transportation Security Administration (TSA) to help travelers whose names were erroneously listed on airline watch lists originally had multiple security problems that could lead to identity theft, says a congressional report released Friday.In addition, the TSA awarded the $48,816 contract for the Traveler Redress Web site based on a request for quotes with requirements that only one Web design firm could meet, says the report, released by the House of Representatives Committee on Oversight and Government Reform. The TSA&#39;s technical lead and author of a request for comments for the project was a longtime friend of the owner of Desyne Web Services and had briefly worked for the Virginia firm, the report says.&quot;This redress Web site had multiple security vulnerabilities: It was not hosted on a government domain, its homepage was not encrypted, one of its data submission pages was not encrypted, and its encrypted pages were not properly certified,&quot; the report says. &quot;These deficiencies exposed thousands of American travelers to potential identity theft.&quot;The TSA press office did not immediately respond to a request for comments on the House report. A receptionist at Desyne said the appropriate person for commenting was not available.The redress Web site went live in October 2006, and blogger Christopher Soghoian, a graduate student in informatics at Indiana University, pointed out security problems there last February. The TSA took the Desyne Web site down that month and now hosts a traveler redress form on its own Web site.&quot;This begs the question: Who are these guys, why don&#39;t they know how to use SSL, and how were they awarded this sweet contract?&quot; Soghoian wrote in February 2006. &quot;Why can&#39;t TSA do a simple form submission themselves?&quot;One of the biggest concerns raised by Soghoian and the House report is that the Desyne Web site did not use SSL encryption on its home page or on its submissions page. Travelers were asked to submit personal information, such as their Social Security numbers and birth dates. The site was not hosted on a government domain, meaning visitors &quot;lost any assurance they were visiting a legitimate government Web site,&quot; the House report says.The House report was also critical of Desyne&#39;s &quot;no-bid&quot; contract to operate the redress Web site. Desyne had done work for TSA since 2004, and as of late 2007, it continued to host the TSA&#39;s Web site where travelers could file claims for damaged property. The TSA&#39;s April 2006 request for quotes for the redress site said the design had to be consistent with the claims management site, and it had to be hosted on the same server that hosted the claims management site, the House report says.As of September, Desyne continued to operate Web sites for TSA, and the company has received more than $500,000 in business from the agency since 2004, the report says. &quot;TSA did not take action ... to sanction Desyne for poor performance,&quot; the report says.
445773
A top lawmaker assailed the US Visitor and Immigrant Status Indicator Technology program today, following a staff investigation of the $10 billion homeland security project.
615540
A new online method for trying to resolve travelers' problems boarding planes looks like a typical phishing attack. In 27B Stroke 6.
559455
(InfoWorld) - Many of the Web sites for members of the U.S. Congress lack basic information such as information on office hours or where to go if the reader has problems with a federal agency, according to a report released Monday. The overall state of congressional Web sites is "disappointing," said the Congressional Management Foundation, a nonprofit group advocating for a more effective Congress. The group gave only about 14 percent of the 615 lawmaker and congressional leadership Web sites it surveyed A grades for user friendliness. The top group of A-graded sites earn CMF's Gold Mouse award. Thirteen percent of the congressional sites received F grades, and another 25 percent received D's. "It's things that are missing, things that aren't updated," said Beverly Bell, CMF's executive director. In many cases, congressional offices seem to see Web sites as one-way communication mediums, she said. About 49 percent of the sites did not include sufficient information on how to contact the office about a problem with a federal agency, CMF said in its report. Just over 26 percent told visitors the best way to communicate with their offices, and 32 percent did not include links to sponsored or cosponsored legislation. Just 11 percent of House Web sites and 5 percent of Senate Web sites posted their office hours. "It's how you view your Web site," Bell added. "Are you seeing your Web site as a service center for constituents? There's not as much of that as we'd like to see. Or, are you seeing it as one big press release for yourself?" CMF produced two previous reports, in 2002 and 2003. Only three lawmakers have received awards in each of the Gold Mouse Reports: Representative Mike Honda, a Democrat representing part of Silicon Valley in California, Senator Jeff Bingaman, a New Mexico Democrat, and Senator Patrick Leahy, a Vermont Democrat known for his interest in tech issues. But overall, Republican sites scored higher than Democratic sites, with 66 percent of Republican sites scoring at least a C compared to 56 percent of Democratic sites. In some cases, lawmakers seem to believe that Web sites create more work for their staffs, and congressional staffs haven't substantially increased in size since the 1970s, Bell said. But a well-designed Web site can reduce workload by cutting telephone calls from constitutions about information such as sponsored legislation or visitor tours, she said. The John F. Kennedy School of Government at Harvard University, the University of California-Riverside, and Ohio State University assisted CMF with the report.
273598
By Anonymous  HOMELAND SECURITY  What would happen to Internet reliability in the U.S.
428397
The Transportation Security Administration Tuesday asked domestic airlines to turn over detailed passenger information -- including names, addresses, credit card numbers, origin
167323
The three major US online travel sites fare worse than their European counterparts in finding the cheapest international air fares, according to a study released Friday.
262391
A government program that's automatically flagged nearly 5,000 U.S. travelers as "suspected terrorists"  appears to defy a Congressional prohibition against computerized risk ranking of ordinary Americans.  Ryan Singel reports from Washington.
293686
The Transportation Security Administration is denying allegations that an airport screener seized a toddler's sippy cup and mistreated his mother, taking the unusual step of posting security camera footage on its Web site.
637030
(InfoWorld) - The U.S. Department of Homeland Security's (DHS)Â CIO was on the hot seat Wednesday on Capitol Hill after an independent audit found that a database that screens U.S. visitors lacked security controls. The chairman of the U.S. House of Representatives Homeland Security Committee called on DHS CIO Scott Charbo to explain why he should keep his job after persistent cybersecurity problems at the agency. "What happened to leadership?" Representative Bennie Thompson, the committee chairman and a Mississippi Democrat, said during a hearing of the Subcommittee on Emerging Threats, Cybersecurity, and Science, and Technology. "What happened to accountability?" Lawmakers also said they were concerned that the agency reported 844 cybersecurity incidents in 2005 and 2006. "Although we still have a ways to go, we've made measurable improvements in the management of information security at the department," Charbo said. "Certainly, we need to increase our vigilance to ensure that such incidents do not happen again." Many of the 844 incidents were minor, and the agency has taken major steps to fix past cybersecurity issues, Charbo said. Many of the reported cybersecurity incidents related to problems like lost laptops that did not result in data breaches, he added. The subcommittee did not have a breakdown of the incidents Wednesday. Asked about reports of bots installed on DHS computers that could send information out to hackers, Charbo said he had "no evidence" that the bots caused a breach. Thompson's comments came as the U.S. Government Accountability Office (GAO) issued a report saying DHS continues to have "significant weaknesses in computer security controls that threaten the confidentiality, integrity, and availability of key ... systems." GAO investigators found no security controls on the US-VISIT database, the system that screens people who want to visit the U.S. for potential terrorists and criminals. Lawmakers are concerned whether terrorists could get into the database "and change or alter their names to allow them access to this country, and we wouldn't even know that they're doing it," said Representative Bob Etheridge, a North Carolina Democrat. A contractor provides IT security for US-VISIT, but DHS has its own security controls in place to protect the database, Charbo said. He didn't disclose specific security measures. The GAO doesn't have evidence that the US-VISIT database was breached, said Keith Rhodes, chief technologist and director of the GAO's Center for Technology and Engineering. "I did not see controls in place that would prevent it," Rhodes said. "I did not see defensive perimeters, and I did not see detection systems in place whether it had or had not [been breached]." GAO started a cybersecurity review of DHS a year ago but curtailed its efforts because it kept finding "more and more" problems, Rhodes said. "If we had continued to this day, I would argue we'd still be finding things," he said. "The problems were pervasive. The problems were systemic." Charbo outlined recent measures DHS has taken to improve cybersecurity there. The agency is collapsing multiple legacy WANs into a single WAN, and it is standardizing all e-mail and directory services onto a single platform, he said. The agency had 13 separate e-mail systems when it was formed out of 22 U.S. agencies in 2002, he said. DHS also is combining multiple data centers into a shared center, he said. Thompson asked how DHS officials can preach cybersecurity practices to other agencies and private companies while continuing to have its own problems. Among the incidents DHS reported were employees sending out classified documents on unclassified networks and contractors attaching unauthorized laptops to the DHS network, he said. "How can the Department of Homeland Security be a real advocate of sound cybersecurity practices without following some of its own advice?" he said. "What the department is doing on its own network speaks so loud that the message isn't getting across to anyone else."
322890
BOSTON - The U.S. government's Computer Emergency Response Team (US-CERT) and software security companies have issued warnings about a number of security vulnerabilities in versions of Oracle Corp.'s software.
199315
A service intended to help innocent travelers get off the No Fly List instead sent their personal information unencrypted to a Virginia company. Following a Wired News report, a congressman asks the TSA to explain itself. By Ryan Singel.
536569
A congressional report blames a litany of shortcomings at the Transportation Security Administration for security problems on a Web site set up in 2006 to help travelers remove their names from terrorist watch-lists.
377766
Hackers stole information from the U.S. Department of Transportation and several U.S. corporations by seducing employees with fake job-listings on ads and e-mail, a computer security firm said on Monday.
224580
(InfoWorld) - IT systems integrator Unisys Corp. is under fire for allegedly failing to detect the hacking of U.S. Department of Homeland Security computers, an incident that resulted in data being sent to a Chinese-language Web site. Unisys is now under investigation by the U.S. Federal Bureau of Investigation, according to an aide for the House of Representatives' Committee on Homeland Security, which started investigating the DHS and Unisys in April. The committee sent a letter to the DHS on Friday asking for its inspector general to open an investigation, the aide said. The letter said DHS had 844 "cybersecurity incidents" during fiscal 2005 and 2006, which the committee called "high and unacceptable." The data breach adds to the growing chorus of complaints from countries such as France, Germany and the U.K. thatÂ hackers in China have stepped up their game, hunting for sensitive information on government computer systems. In 2002, Unisys won a US$1 billion contract to manage computer systems belonging to the DHS and the Transportation Security Administration, which were created after the Sept. 11, 2001, terrorist attacks to shore up the nation's defense. Unisys received a $750 million contract in early 2006 to continue the work. Under the contracts, Unisys installed six intrusion-protection devices, said Lisa Meyer, Unisys spokeswoman. Those devices, which can detect unauthorized activity on a network, were not installed properly, alleges the committee. Three months passed before clues emerged that malicious software capable of copying and transferring files had been installed on 150 DHS computers. The data, although unclassified, was transferred late at night or early in the morning to a Chinese-language Web site, according to committee evidence and testimony. Two U.S. representatives also accused the DHS and Unisys of ignoring warning signs of the hacking. In a statement , Unisys denied the intrusion protection devices were improperly installed and that the company reported security incidents. Meyer said Unisys has not been notified by either the FBI or the committee of an investigation. She said she could not comment further on specific security incidents. The FBI referred questions to DHS officials, who could not immediately be reached. Â
139422
The American Government now has flight information on every person that boarded a commercial flight in the US in June. The Transportation Security Administration will use the information to test a new passenger screening system called Secure Flight.
645483
About 146,000 people using a U.S.  government jobs Web site had their personal information stolen  by hackers who broke into computers at Monster Worldwide Inc, a  government spokesman said on Thursday.