http://www.wtop.com/?nid=116 <http://www.wtop.com/?nid=116&sid=1256901> &sid=1256901
US Improperly Releases Threat Details September 27, 2007 - 5:45pm <http://media.bonnint.net/apimage/fc65c60f-8af9-4f6f-acb6-fc32765707a7.jpg> In this image from video released by the Department of Homeland Security, smoke pours from an expensive diesel electric generator during a March 4, 2007, demonstration by the Idaho National Laboratory, which was simulating a hacker attack against the U.S. electrical grid. (AP Photo/Dept. of Homeland Security) By TED BRIDIS and EILEEN SULLIVAN Associated Press Writers WASHINGTON (AP) - The Homeland Security Department improperly disclosed details about a serious threat to the U.S. electrical grid to industry researchers just days after it produced a video showing simulated hackers remotely seizing control over a $1 million diesel-electric generator. The equipment self-destructed in a cloud of smoke and flying parts. Worried that technical details could leak among terrorists or unfriendly foreign governments before equipment makers could fix the problem, the Bush administration contacted the small group of researchers afterward and urged them not to reveal anything they had been told. People familiar with the miscue described it on condition of anonymity because they were not authorized to discuss it publicly. The disclosures _ made by a Homeland Security employee without authorization from his supervisors _ occurred during private briefings in Atlanta at a trade conference in March. The video, obtained late Wednesday by The Associated Press, was marked "Official Use Only." It shows commands quietly triggered by simulated hackers having such a violent reaction that the enormous generator _ obtained from Alaska's power grid for testing purposes _ shudders as pieces fly apart and it belches black-and-white smoke. The video was produced for top U.S. policymakers by the Idaho National Laboratory, which has studied the little-understood risks to the specialized electronic equipment that operates power, water and chemical plants. The White House said Thursday it is working to improve cybersecurity with more coordination and cooperation among federal agencies, state and local governments and companies. "For example, with electrical grids, a lot of that security is handled by (the) private sector," White House spokeswoman Dana Perino said. The electrical attack never actually happened. The recorded demonstration, called the "Aurora Generator Test," was conducted in March by government researchers investigating a dangerous vulnerability in computers at U.S. utility companies known as supervisory control and data acquisition systems. The programming flaw was quietly fixed, and equipment makers urged utilities to take protective measures. The technology industry has debated for years the timing of announcements that products may be vulnerable to attacks or break-ins. Disclosures made too quickly _ before protective measures can be put in place _ can increase risks by tipping off attackers. But warnings issued too slowly can leave utilities and customers unprotected. The video was produced just days before the annual meeting of an organization of researchers, governments officials and equipment manufacturers. At invitation-only meetings at the conference, the Homeland Security Department described the threat and even aired the video showing the generator tearing itself apart, participants said. Realizing its mistake afterward, the government warned researchers not to discuss the threat and reminded them the video was intended for "Official Use Only." There was no evidence any U.S. utility companies have suffered damage from hackers or terrorists using this technique, U.S. officials said. But these officials cautioned that affected systems are not monitored the same way that many modern corporate computer networks are, so there would be little forensic evidence to study after such a break-in. President Bush's top telecommunications advisers concluded years ago that an organization such as a foreign intelligence service or a well-funded terror group "could conduct a structured attack on the electric power grid electronically, with a high degree of anonymity, and without having to set foot in the target nation." The Idaho National Laboratory _ which produced the new video _ has described the risk ominously as "the invisible threat." [Non-text portions of this message have been removed] -------------------------- Want to discuss this topic? Head on over to our discussion list, [EMAIL PROTECTED] -------------------------- Brooks Isoldi, editor [EMAIL PROTECTED] http://www.intellnet.org Post message: [email protected] Subscribe: [EMAIL PROTECTED] Unsubscribe: [EMAIL PROTECTED] *** FAIR USE NOTICE. This message contains copyrighted material whose use has not been specifically authorized by the copyright owner. OSINT, as a part of The Intelligence Network, is making it available without profit to OSINT YahooGroups members who have expressed a prior interest in receiving the included information in their efforts to advance the understanding of intelligence and law enforcement organizations, their activities, methods, techniques, human rights, civil liberties, social justice and other intelligence related issues, for non-profit research and educational purposes only. We believe that this constitutes a 'fair use' of the copyrighted material as provided for in section 107 of the U.S. Copyright Law. If you wish to use this copyrighted material for purposes of your own that go beyond 'fair use,' you must obtain permission from the copyright owner. For more information go to: http://www.law.cornell.edu/uscode/17/107.shtml Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/osint/ <*> Your email settings: Individual Email | Traditional <*> To change settings online go to: http://groups.yahoo.com/group/osint/join (Yahoo! ID required) <*> To change settings via email: mailto:[EMAIL PROTECTED] mailto:[EMAIL PROTECTED] <*> To unsubscribe from this group, send an email to: [EMAIL PROTECTED] <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/
