Meanwhile, In the “Government Transparency” Department . . .

| August 21, 2014

. . . we have the following two “inconvenient truths”:

We all remember just how “wonderfully” the rollout of the Federal ObamaCare website went. Because of this debacle – and fears concerning system security because of the poor initial implementation of that website – the AP made a FOIA request for documentation regarding the website’s system security plan.

The Administration is flatly refusing to release any information about the subject. They are allegedly doing so for two reasons. First, because the release of system security plan might help attackers circumvent it. And second, because “releasing this information would potentially cause an unwarranted risk to consumers’ private information.”

Sheesh – what a load of crap. First, any competent IT professional will tell you that this is merely an example of what’s called “security through obscurity.” They will also tell you that “security through obscurity” is merely the illusion of security; a competent attacker can figure out what you’ve done in a reasonable amount of time.

Second: the allegation that releasing the system security plan “would potentially cause an unwarranted risk to consumers’ private information” is absurd. The plan doesn’t contain a damn bit of PII.   So releasing the plan doesn’t risk disclosing squat concerning “consumers’ private information.”

What a release of the plan would do is allow 3rd-party review and validation of the plan. It would also show if the job was done “just as competently” as the initial website implementation – and thus would risk further embarrassing the Administration.   My money’s on that being the real reason behind the refusal.

And then, we have this. It seems that on 15 April 2009, the Administration decided to get a handle on FOIA requests throughout the Federal government. On that date, Gregory Craig – Counsel to the President – wrote a memo reminding all Federal agencies of the need to consult with the White House if any document was requested that had “White House equities”. The requirement to consult with the White House involved all types of requests – including FOIA, Congressional, subpoena, and GAO.

You can see an extract of the memo here.

Gee. What a wonderful way to prevent the public from finding out what you’re really doing. The late LBJ and Richard Nixon must be smiling in their graves. They’d have heartily approved this!

Transparent? Yeah, right. Just about as transparent as a freaking stone wall.

But this should be no surprise. I mean, when the person in charge of making nonprofit group determinations tells a subordinate in e-mail they think conservatives are ”crazies” and “assholes” you can be fairly sure that they aren’t really interested in either operating openly or fairly. And when the Attorney General won’t investigate such incidents, you know that a distain for open government goes pretty far “up the chain”.

Like maybe to the very top.

Category: "Your Tax Dollars At Work", Crime, Legal

15 Comments
Inline Feedbacks
View all comments
ArmyATC

No surprise there. Early in this administration it became clear that the only transparency in the Obama White House would be the transparent lies that bunch told.

Isnala

Only thing transparent about the Obama White House is the windows, and even then the curtains are closed most of the time.

Sparks

Typical Obama run government ass covering. They don’t want the truth of any of their debacles uncovered. Fast and Furious, Obamacare, the IRS targeting conservative groups and subsequent “loss” of all emails, Benghazi, you name it, they’ll cover it up and/or lie through their teeth about it. Why? Because the ass holes who voted them in, the leftist, die hard liberals and the ill-informed voters could care less what Obama does or doesn’t do. I remember the platform he ran on of being, “the most transparent administration in history” (paraphrased). The ones who elected him twice, could care less about truth and transparency and Obama knew that when he hung it out there as a “must have” in America. As long as their guy is in the Oval Office, they are good to go. He can do no wrong in his own estimation as well as in theirs.

Pinto Nag

‘Power corrupts, and absolute power…’

You know the rest.

Pinto Nag

Feel free to explain the fine points in your argument, Hondo, because I fail to see the difference between the original quote and what Caro said.

Pinto Nag

So as not to ‘jack the bandwidth, I’ll leave this link for you to read at your leisure, Hondo. It seems to pertain to your answer, to some extent.

http://www.studymode.com/essays/Morality-And-Power-34072.html

David

If you think the Ford administration was considered open and honest, you obviously have forgotten all the hooraw over Nixon’s pardon. There was talk of impeachment over that. Reaction to that effectively locked Carter in. (Dave’s Law: After 2 to 3 terms of either party, the electorate would elect the Devil Incarnate if from the other party.)

Richard

Ignorance is curable, stupid is forever.

gitarcarver

It should be remembered that these types of denials may be a part of the administration’s job program. After wall, we need to hire people that are “FOIA Denial Officers.”

http://raisedonhoecakes.com/ROH/2014/08/21/apply-for-a-position-in-the-most-transparent-administration-ever/

(And I am not making this up.)

Richard

FWIW, I used a commonly available technique to record me logging into Healthcare.gov. I can see my user ID and password in the capture.

FWIW, my PII data is in the request formdata. It is encrypted but for this particular technique that should pose no obstacle.

I used a very basic attack requiring minimal browser and moderate OS and network familiarity. This method does not require mad computer skilz.

I invite anyone to try to capture their own login. If you see your user ID and password in the clear then you win a kewpie doll. Or something.

A hint, if you use wireshark you have to see your PII in the clear. Just knowing where it is doesn’t count. I suppose that you could just use Fiddler or HTTPWatch but that seems to miss the spirit of the thing. Try for a technique that isn’t quite so obvious to the user.

A technique to collect a few dozen user IDs and passwords is left as an exercise for the reader.

BTW, don’t post your information or method or the collection technique. The fact that it is easy does not justify making it easier for the script kiddies or whatever they are calling computer hooligans these days. Maybe the government will fix it before EVERYONE knows how to do it.

If anyone thinks that it is unethical to do this sort of thing, consider that the criminal types started doing this the day the app was released. Mr. Putin may be the only Russian in his entire country who doesn’t know how to do this. If we show how easy it is, maybe someone will do something.

Mayhem

Ya know sometimes it feels like that living under this current administration is similar to perpetually traveling on the Assinine Pacific RailRoad. Whoo Whoo! All Aboard! Next stop Idiotstown, Moronsville, Cluelessburg with connections to Incompetentapolis and Dumbasston.