Schneier on Security's Journal
 
[Most Recent Entries] [Calendar View]

Wednesday, October 3rd, 2018

    Time Event
    1:17p
    Terahertz Millimeter-Wave Scanners

    Interesting article on terahertz millimeter-wave scanners and their uses to detect terrorist bombers.

    The heart of the device is a block of electronics about the size of a 1990s tower personal computer. It comes housed in a musician's black case, akin to the one Spinal Tap might use on tour. At the front: a large, square white plate, the terahertz camera and, just above it, an ordinary closed-circuit television (CCTV) camera. Mounted on a shelf inside the case is a laptop that displays the CCTV image and the blobby terahertz image side by side.

    An operator compares the two images as people flow past, looking for unexplained dark areas that could represent firearms or suicide vests. Most images that might be mistaken for a weapon­ -- backpacks or a big patch of sweat on the back of a person's shirt­ -- are easily evaluated by observing the terahertz image alongside an unaltered video picture of the passenger.

    It is up to the operator­ -- in LA's case, presumably a transport police officer­ -- to query people when dark areas on the terahertz image suggest concealed large weapons or suicide vests. The device cannot see inside bodies, backpacks or shoes. "If you look at previous incidents on public transit systems, this technology would have detected those," Sotero says, noting LA Metro worked "closely" with the TSA for over a year to test this and other technologies. "It definitely has the backing of TSA."

    How the technology works in practice depends heavily on the operator's training. According to Evans, "A lot of tradecraft goes into understanding where the threat item is likely to be on the body." He sees the crucial role played by the operator as giving back control to security guards and allowing them to use their common sense.

    I am quoted in the article as being skeptical of the technology, particularly how its deployed.

    9:15p
    The Effects of GDPR's 72-Hour Notification Rule

    The EU's GDPR regulation requires companies to report a breach within 72 hours. Alex Stamos, former Facebook CISO now at Stanford University, points out how this can be a problem:

    Interesting impact of the GDPR 72-hour deadline: companies announcing breaches before investigations are complete.

    1) Announce & cop to max possible impacted users.
    2) Everybody is confused on actual impact, lots of rumors.
    3) A month later truth is included in official filing.

    Last week's Facebook hack is his example.

    The Twitter conversation continues as various people try to figure out if the European law allows a delay in order to work with law enforcement to catch the hackers, or if a company can report the breach privately with some assurance that it won't accidentally leak to the public.

    The other interesting impact is the foreclosing of any possible coordination with law enforcement. I once ran response for a breach of a financial institution, which wasn't disclosed for months as the company was working with the USSS to lure the attackers into a trap. It worked.

    [...]

    The assumption that anything you share with an EU DPA stays confidential in the current media environment has been disproven by my personal experience.

    This is a perennial problem: we can get information quickly, or we can get accurate information. It's hard to get both at the same time.

    << Previous Day 2018/10/03
    [Calendar]
    Next Day >>

Schneier on Security   About LJ.Rossia.org