Hacker News Reader

Comment by 1970-01-01 | Hacker News Reader

1970-01-01

When you have sensitive data that needs to be air-gapped, but not so sensitive it can't be behind a pane of glass.

You would probably (not?) be surprised by the number of government buildings actively using classified data on computers that ignore the 2 major rules: 1) never have a monitor visible from outside of the building and (2) keep your window blinds closed. I spent a decade watching people actively ignore that rule.

And here I was thinking putting my monitors at right angles to the windows was paranoid :)

Wouldn't be the first time someone's put ultra-sensitive equipment in a glass box so they could "show it off to all the executives who come through". :)

Lots of electronics in industrial environments (eg. ATEX ratings) in potentially explosive environments typically have this problem. But magnetic transfer is far lower data rate than this.

Behind pane-of-glass is not good enough, unfortunately. You typically have counter-measures in place to detect when someone is firing a laser at your exterior glass windows to exfiltrate data/IP. I assume it can/does happen.

> You typically have counter-measures in place to detect when someone is firing a laser at your exterior glass windows to exfiltrate data/IP. I assume it can/does happen.

It does, either in films or intelligence lore, but not for all intents and purposes, in regular life (regular life including corporate espionage). As for counter-measures: curtains.

I guess I don't live a "regular life", but those counter-measures exist where I've worked.

Unless you were working for an intelligence agency, if your organization was sold TSCM against laser-based surveillance, then the organization was taken for a ride by the security contractor; you weren't also sold birds of prey to protect against UAS too, were you? (Yeah, that's a thing too [1]).

It's a bit like being sold flood protection insurance if your data warehouse is in the desert. In other words, it just doesn't happen realistically, and there are a million and one other much more practical technical surveillance counter measures to spend a likely very-limited security budget on.

[1] https://guardfromabove.com/

Flood insurance in the desert may be a bad example. There is a reason Arizona has the "stupid motorist" law and it has to do with soil dynamics in rain in the desert.

Sure, the analogy is imperfect, but the point is if you just spend a sizable chunk of your physec budget to guard against a virtually-unused attack vector, you now have that much less to spend to guard against much more common threats like a break-in.

This specific entity has suffered billions in losses due to IP theft in the past.

When your unit of accounting is such that six figures is a rounding error, they can afford it. And for good reason.

I wouldn't expect you to have knowledge of their operations. The only reason I do is because I was close with the head of security. But I will make sure to pass along your expert advice next time I'm there.

No reason to get weirdly defensive. The reality is that realistically no one in the corporate espionage sector uses lasers to either exfiltrate or infiltrate data, because there are a million easier ways to do so which aren't a nightmare to implement. There has been a very, very, very tiny amount of times lasers have been employed for state espionage, let alone corporate espionage.

Did the billions in losses stop after the IP theft countermeasures were implemented?

That's a question that I can't accurately answer as I wasn't privileged with that info. I was aware of countermeasures in large part because I built the software that helped run the place.

Did all of the countermeasures help? Yes, probably quite often. Were they bullet-proof? Absolutely not, and the director of security would have told you so.

So they have anti-laser-surveillance devices but let the friend of the head of security pay social calls?

Mmm hmm, okay.

Reply on news.ycombinator.com