Today the US moved closer to a federal consumer data breach notification requirement (healthcare has had a federal requirement since 2009 — see Eisenhower v Riverside for why healthcare is different from consumer).

PC World says a presentation to the Federal Trade Commission sets the stage for a Personal Data Notification & Protection Act (PDNPA).

U.S. President Barack Obama is expected to call Monday for new federal legislation requiring hacked private companies to report quickly the compromise of consumer data.

Every state in America has had a different approach to breach deadlines, typically led by California (starting in 2003 with SB1386 consumer breach notification), and more recently led by healthcare. This seems like an approach that has given the Feds time to reflect on what is working before they propose a single standard.

In 2008 California moved to a more aggressive 5-day notification requirement for healthcare breaches after a crackdown on UCLA executive management missteps in the infamous Farah Fawcett breaches (under Gov Schwarzenegger).

California this month (AB1755, effective January 2015, approved by the Governor September 2014) relaxed its healthcare breach rules from 5 to 15 days after reviewing 5 years of pushback on interpretations and fines.

For example, in April 2010, the CDPH issued a notice assessing the maximum $250,000 penalty against a hospital for failure to timely report a breach incident involving the theft of a laptop on January 11, 2010. The hospital had reported the incident to the CDPH on February 19, 2010, and notified affected patients on February 26, 2010. According to the CDPH, the hospital had “confirmed” the breach on February 1, 2010, when it completed its forensic analysis of the information on the laptop, and was therefore required to report the incident to affected patients and the CDPH no later than February 8, 2010—five (5) business days after “detecting” the breach. Thus, by reporting the incident on February 19, 2010, the hospital had failed to report the incident for eleven (11) days following the five (5) business day deadline. However, the hospital disputed the $250,000 penalty and later executed a settlement agreement with the CDPH under which it agreed to pay a total of $1,100 for failure to timely report the incident to the CDPH and affected patients. Although neither the CDPH nor the hospital commented on the settlement agreement, the CDPH reportedly acknowledged that the original $250,000 penalty was an error discovered during the appeal process, and that the correct calculation of the penalty amount should have been $100 per day multiplied by the number of days the hospital failed to report the incident to the CDPH for a total of $1,100.

It is obvious too long a timeline hurts consumers. Too short a timeline has been proven to force mistakes with covered entities rushing to conclusion then sinking time into recovering unjust fines and repairing reputation.

Another risk with too short timelines (and complaint you will hear from investigation companies) is that early-notification reduces good/secret investigations (e.g. criminals will erase tracks). This is a valid criticism, however it does not clearly outweigh benefits to victims of early notification.

First, a law-enforcement delay caveat is meant to address this concern. AB1755 allows a report to be submitted 15 days after the end of a law-enforcement imposed delay period, similar to caveats found in prior requirements to assist important investigations.

Second, we have not seen huge improvements in attribution/accuracy after extended investigation time, mostly because politics start to settle in. I am reminded of when Walmart in 2009 admitted to a 2005 breach. Apparently they used the time to prove they did not have to report credit card theft.

Third, value relative to the objective of protecting data from breach. Consider the 30-day Mandiant 2012 report for South Carolina Department of Revenue. It ultimately was unable to figure out who attacked (although they still hinted at China). It is doubtful any more time would have resolved that question. The AP has reported Mandiant charged $500K or higher and it also is doubtful many will find such high costs justified. Compare their investigation rate with the cost of improving victim protection:

Last month, officials said the Department of Revenue completed installing the new multi-password system, which cost about $12,000, and began the process of encrypting all sensitive data, a process that could take 90 days.

I submit to you that a reasonably short and focused investigation time saves money and protects consumers early. Delay for private investigation brings little benefit to those impacted. Fundamentally who attacked tends to be less important that how a breach happened; determining how takes a lot less time to investigate. As an investigator I always want to get to the who, yet I recognize this is not in the best interest of those suffering. So we see diminishing value in waiting, increased value in notification. Best to apply fast pressure and 30 days seems reasonable enough to allow investigations to reach conclusive and beneficial results.

Internationally Singapore has the shortest deadline I know of with just 48-hours. If anyone thinks keeping track of all the US state requirements has been confusing, working globally gets really interesting.

Update, Jan 13:

Brian Krebs blogs his concerns about the announcement:

Leaving aside the weighty question of federal preemption, I’d like to see a discussion here and elsewhere about a requirement which mandates that companies disclose how they got breached. Naturally, we wouldn’t expect companies to disclose publicly the specific technologies they’re using in a public breach document. Additionally, forensics firms called in to investigate aren’t always able to precisely pinpoint the cause or source of the breach.

First, federal preemption of state laws sounds worse than it probably is. Covered entities of course want more local control at first, to weigh in heavily on politicians and set the rule. Yet look at how AB1755 in California unfolded. The medical lobby tried to get the notification moved from 5 days to 60 days and ended up on 15. A Federal 30 day rule, even where preemptive, isn’t completely out of the blue.

Second, disclosure of “how” a breach happened is a separate issue. The payment industry is the most advanced in this area of regulation; they have a council that releases detailed methods privately in bulletins. The FBI also has private methods to notify entities of what to change. Even so, generic bulletins are often sufficient to be actionable. That is why I mentioned the South Carolina report earlier. Here you can see useful details are public despite their applicability:

Obama also today is expected to make a case in front of the NCCIC for better collaboration between private and government sectors (Press Release). This will be the forum for this separate issue. It reminds me of the 1980s debate about control of the Internet led by Rep Glickman and decided by President Reagan. The outcome was a new NIST and the awful CFAA. Let’s see if we can do better this time.

Letters From the Whitehouse:

• Updated Department of Homeland Security Cybersecurity Authority and Information Sharing (7 pages, 185 kb) and its Section by Section Analysis (3 pages, 162 kb)
• Updated Data Breach Notification (9 pages, 250 kb) and its Section by Section Analysis (5 pages, 242 kb)

Recently I wrote here about the ill-fated American operation “IGLOOWHITE” from the Vietnam War that cost billions of dollars to try and use information gathering from many small sensors to locate enemies.

It’s in fact an old pursuit as you can see from this news image of the Japanese Emperor inspecting his big 1936 investment in anti-aircraft data collection technology.

Even earlier, Popular Science this month in 1918 published a story called “How Far Off Is That German Gun? How sixty-three German guns were located by sound waves alone in a single day.”

Somewhere in-between the Vietnam War and WWI narratives, we should expect the Defense Department to soon start exhibiting how they are using the latest location technology (artificial intelligence) to hit enemy targets.

The velocity of information between a sensor picking signs of enemy movement and the counter-attack machinery…is the stuff of constant research probably as old as war itself.

Popular Mechanics for its share also ran a cover story with acoustic locator devices, such as a pre-radar contraption that was highlighted as the future way to find airplanes.

The cover style looks to be from the 1940s although I have only found the image so far, not the exact text.

That odd-looking floral arrangement meant for war was known as a Perrin acoustic locator (named for French Nobel prizewinner Jean-Baptiste Perrin) and it used four large clusters of 36 small hexagonal horns (six groups of six).

Such a complicated setup might have seemed like an improvement to some. Here are German soldiers in 1917 using a single personal field acoustic and sight locator to enhance the “flash bang” of enemy artillery, just for comparison.

Obviously use of many small sensors gave way to the common big dish design we see everywhere today. Igloo White perhaps could be seen as a Perrin data locator of its day?

They are a perfect example of how simply multiplying/increasing the number of small sensors into a single processing unit is not necessarily the right approach versus designing a very large sensor fit for purpose.

Update September 2020: “AI-Accelerated Attack: Army Destroys Enemy Tank Targets in Seconds”

…”need for speed” in the context of the well known Processing, Exploitation and Dissemination (PED) process which gathers information, distills and organizes it before sending carefully determined data to decision makers. The entire process, long underway for processing things like drone video feeds for years, has now been condensed into a matter of seconds, in part due to AI platforms like FIRESTORM. Advanced algorithms can, for instance, autonomously sort through and observe hours of live video feeds, identify moments of potential significance to human controllers and properly send or transmit the often time-sensitive information.

“In the early days we were doing PED away from the front lines, now it’s happening at the tactical edge. Now we need writers to change the algorithms,” Flynn explained.

“Three years ago it was books and think tanks talking about AI. We did it today,” said Army Secretary Ryan McCarthy.

Three years ago? Not sure why he uses that time frame. FIRESTORM promises to be an interesting new twist on IGLOOWHITE from around 50 years ago, and we would be wise to heed the “fire, ready, aim” severe mistakes made.

The US Air Force (USAF) at the end of 1967 started to air-drop around 20,000 micro sensors into a country bordering Vietnam to be monitored by an IBM mainframe, in order to help direct US airstrikes. The project was an expensive disaster that became a foundation for US domestic military surveillance of non-whites.

It had little impact (e.g. “sensors couldn’t tell the difference between a gun and a shovel”) while costing American lives. All it did prove was the fact that drones flying above a mesh of sensors could launch airstrikes on a moment’s notice…for a low low price of just $1 billion/year in the 1970s, as the following documentary puts plainly:

When you stop to think about it if you have $30M orbiting reconnaissance aircraft to transmit signals, and $20M command post to call in four $10M fighters to assault a convoy of five $5000 trucks with $2000 worth of rice, it’s easy to see that’s not cost-effective. This is a self-inflicted wound… a losing proposition…

Initial Plans

The North Vietnamese had built a network of roads through neighboring neutral countries Laos and Cambodia to supply forces in South Vietnam. This “Truong Son Road” (called “Ho Chi Minh Trail” by Americans) was concealed by the natural foliage of thick jungle.

Plans were concocted by Americans to appear respectful of Laos and Cambodia, while still bombing them, by secretly dropping hidden sensors that would guide targeted strikes and Army Special Forces teams “over the fence”

The idea of constructing an anti-infiltration barrier across the DMZ and the Laotian panhandle was first proposed in January 1966 by Roger Fisher of Harvard Law School in one of his periodic memos to McNaughton.

A book called The Closed World explains in detail what these Harvard Law School plans turned into:

Sensor Technical Details (Data Integrity Failure)

There were several iterations of the sensors. The USAF archives refer to these categories:

• ADSID I and III, (Normal) and (Short): (Air Delivered Seismic Intrusion Detector) – transmitted vibration from geophone (personnel or vehicles in motion)
• HELOSID (Helicopter Delivered Seismic Intrusion Detector)
• ACOUSID II and III: (Acoustic and Seismic Intrusion Detector) – transmitted sound from microphone

We’re talking here about $2K radios inside a dart-shaped canister with a 2 week battery (later expanded to 45 days by changing from continuous to polling), and a 20% failure rate on deployment.

Ten years ago Air Force Magazine described the wide set of problems with false positives from these wireless sensors in a jungle. This honest analysis is a far cry from how the USAF originally fluffed up the technology to be as easy as “drugstore pinball” and give North Vietnamese “nowhere to hide”:

The challenge for the seismic sensors (and for the analysts) was not so much in detecting the people and the trucks as it was in separating out the false alarms generated by wind, thunder, rain, earth tremors, and animals—especially frogs.

There were other kinds of sensors as well. One of them was the “people sniffer,” which chemically sensed sweat and urine.

[…]

“We wire the Ho Chi Minh Trail like a drugstore pinball machine, and we plug it in every night,” an Air Force officer told Armed Forces Journal in 1971. “Before, the enemy had two things going for him. The sun went down every night, and he had trees to hide under. Now he has nothing.”

Here are the sort of acoustic details captured in working group studies hoping to isolate signals of frogs and shovels from soldiers and trucks:

Sensor Deployment

Either a F-4 Phantom jet, a OV-10 Bronco plane, or a CH-3 Jolly Green Giant helicopter was used for air drops. Given the large quantity of sensors, frequency of drops, size of budget and talent of engineering, their placement wasn’t as sophisticated as one might imagine.

Here you can see a member of 21st Special Operations Squad (SOS) based in Nakhon Phanom (under the Dust Devils call sign) at low altitude sending a sensor by hand.

Initially MC-130E Blackbird were used to orbit and monitor the sensors. The 554th Reconnaissance Squad (under the Vampires call sign) by 1970 started orbiting a QU-22B “drone” to pick up signals from the sensors and relay them back to Infiltration Surveillance Center (ISC) at the Nakhon Phanom Royal Thai Air Force Base.

Despite being engineered with complex electrical equipment to enable remote control. reliability failures meant every flight carried a pilot on board (A QU-22 reunion site interviews them).

The high-tech QU-22 drone program was cancelled after just two years with a number of crashes including two inside Laos.

Command Center

Back at the ISC, computers made by IBM were connected to a giant wall-sized display of the area under surveillance, as well as touchscreen monitors (images from US Air Force Historical Research Agency):

Military Surveillance “Toys” Deployed in America

Despite President Nixon’s backing, the expense of Igloo White coupled with many American casualties sat on top of a failure to produce results to justify continuing the program, especially after North Vietnamese simple changed tactics. The program was cancelled by 1973 just as Nixon was infamously announcing he would criminalize being non-white.

Nixon had believed so strongly in the new surveillance technology that he had the same sensors deployed to his lawns and…of course the border with Mexico.

Needless to say, even domestically the systems failed spectacularly as documented in 1971 and reported again in 1972:

That kind of outcome didn’t seem to dissuade some from thinking there is a bright future for military surveillance technology along America’s borders.

In 1989 the Air War College reported that military surveillance failure under Nixon on the border with Mexico meant President Reagan actually had a useful foundation for military role in the criminalization of non-whites.

Reagan pushed so hard on invasive of domestic military surveillance the Posse Comitatus Act of 1878 was modified “to allow all branches of the Armed Forces to provide equipment, training, and assistance to the U.S. Coast Guard, U.S. Customs, and to other Drug Enforcement agencies”. Today it is widely known and becoming uncontroversial that the “war on drugs” was intentionally racist — criminalizing non-whites.

Conclusion

The true lesson from Igloo White was that an expensive technological military replacement (even domestically) for human intelligence gathering systems may have been very fast yet also very expensive and never really proven accurate. It will forever be known in history as a “self-inflicted wound” by Nixon that Reagan doubled-down on.

Air Force Magazine, while admitting the USAF vastly overstated the success of their work, also emphasized analysis of data can be mishandled by everyone involved:

…7th Air Force’s “numbers game” was refuted by the CIA’s own “highly reliable sources,” referring to its agents in the enemy ranks. The CIA and the Defense Intelligence Agency developed a formula that arbitrarily discounted 75 percent of the pilot claims. […] Then, as now, the bomb damage assessment process was flawed on both ends: Operations tended to claim too much; Intelligence tended to validate too little.

It was the “fire, ready, aim” foreshadowing of today’s drone programs (e.g. Operation Haymaker) where the vast majority of targets are later reported to be innocent civilians.

* “Bugging the Battlefield” by National Archives and Records Administration, 1969:

For a perspective from the Laotian side, see “The Rocket”:

Update April 2021: Jim Bolen (former Special Forces operative in Laos and Cambodia on SOG operations to the Ho Chi Minh and Sihanouk Trails during the Vietnam War — recon team leader on over 40 SOG missions and extracted under fire from over 30) gives a new interview where he describes “Reconnaissance Missions to the Ho Chi Minh Trail” and argues that electronic sensors were infallible technology and instead it was LBJ who wasn’t listening.

…we had planted electronic seismic sensors along the Trail coming out of North Vietnam. These sensors were monitored 24 hours a day 365 days a year by C-130 Blackbirds. The seismic sensors would pick up vibrations from truck or tank movements along the Trail.

Update October 2021: Declassification of secret missions gives us the opposite of Jim Bolen, “MACV-SOG: A Conversation with John Stryker Meyer“, which includes a gold nugget of modest wisdom from a Green Beret who served on the ground at the time that the bombing campaigns in Laos were “completely useless“.