Hacker News Reader

Comment by grogenaut | Hacker News Reader

I worked on a barely do-not-distribute. Someone's spouse took a project member's laptop as hostage for alimony. Within 45 minutes of discovery and a phone call to the army equivalent of the FBI, agents were at the spouse's work and home searching for the laptop.

Lucky for the spouse they thought it was the personal laptop (it was not marked) so they weren't prosecuted.

This laptop could be much worse, or just fine.

View on HN

Reminds me of this old "Professor Pwnage" video. https://www.youtube.com/watch?v=u4gVkprDej0

Do you have any information on how this ended?

The professor was bluffing [0].

Apparently it was deemed a random theft [1].

[0]: https://www.engadget.com/2005-04-25-laptop-thief-not-scared-...

[1]: https://www.berkeley.edu/news/media/releases/2005/09/15_lapt...

What is a “barely do-not-distribute?”

Put the quotes around DND... It was mostly unimportant mostly already public do not distribute data but you can't be sure what was actually on the laptop. NOFORN would be a good exact version.

This was also years ago, and for obvious reasons I don't want to be more exact.

It's usually the second lowest security level, just above "Public" and below "Secret".

We used to just call that "confidential".

We still do, but it's rarely used in my experience.

Third lowest; NOFORN is above public

NOFORN is not a level but an orthogonal restriction.

Information could be Secret and NOFORN or Secret and Five-Eyes, for instance.

Do you all say NOFORN the way I think you say NOFORN? (No forn)

"No foreign nationals"

And yes, "no-forn"

Never heard it called that. What I have heard is something along the lines of "confidential but unclassified" which seems more descriptive to me.

This would never be used by USG. Confidential -> Classified

The classification scheme is broadly cut up into Confidential, Secret, Top Secret, and Codeword. There are many modifiers to that such as Five-Eyes, Cosmic (NATO), and Restricted-Data (Nuclear Weapon Design).

There are a menagerie of controls that don't rise to classification, like NOFORN, Law Enforcement Sensitive, For official use only, etc.

Code word compartments cut horizontally across the Confidential/Secret/Top Secret hierarchy. I’ve seen stuff that was classified Confidential, but also in a code word protected compartment. I had a TS/SCI/SI/CT/NATO/ATOMAL clearance when I worked for the Defense Information Systems Agency in the Pentagon. Many times over the past 25+ years I have had to correct people who think the compartmented stuff is classified at a level “above Top Secret”, when in fact the compartments just cut horizontally across the hierarchy.

Below Confidential exist other “unclassified” states, like “For Official Use Only” and “No Foreign” (a.k.a., NOFORN). Then, regardless of the classification, you should also have to prove “Need to Know”.

I don't dispute that, I was trying to present a somewhat simplified view of this in a succinct comment.

To me, the most interesting aspects of classification were that the title, content, and classification level itself don't necessarily share levels.

CUI -- Controlled, Unclassified Information (formerly FOUO - For Official Use Only)

As others have pointed out, Confidential is classified, the lowest classification level.

Those were the terms we used at an investment bank but I imagine different institutions use different classifications.

Metaphorically speaking. I.e. not quite DnD, but likely would want to be contained

security policy for documents

Reply on news.ycombinator.com