So - while I might agree that secretive domestic organizations like MI5 should not exist and sunlight is good for government, I feel for the families of the folks that might catch a bullet because of this.
I'll say the same thing that no one with access to a microphone said during the 2013 NSA data leaks:
What makes you think that the Bad Guys didn't already have access to this information? The folks that should have detected this clearly didn't. [0] Given that the Good Guys didn't learn about this until it was made public, neither they nor we have any idea of knowing how many Bad Guys have been siphoning off this data and for how long.
[0] In this specific incident, Okta appears to be claiming that there has been no breach despite claims that it is the source of the information. Back in 2013 -given that the NSA would often claim something that would be quickly countered by the publication of yet another leaked document- it was pretty clear that the NSA had little idea of what data had been released to the press.
Of course it’s possible some bad guys had this. But probably not all of them.
EDIT: I would also not equate these leaks to the NSA leaks in terms of resources and sophistication required to know about the NSA programs vs potential public access on the open internet with this one. Resources and intelligence required seems quite a higher bar, but that’s just me being an armchair quarterback.
...what exactly do you imagine the Bad Guys would do with the information that they've likely been siphoning off of the systems of ICE and -in the past- the NSA? Do you imagine that they'd be exclusively distributing it via Sneakernet? Just like the Good Guys, the Bad Guys also have access to IT guys who know how to set up a login portal... and the well-resourced ones are totally capable of setting up things akin to SIPRNet.
I’m not making a good guy / bad guy judgment here FWIW. I do, however, find it less likely a smaller scale non-state operation would bother hacking a government agency or buying info on the open market. Sounds like it’s a higher priority than I thought.
Makes sense for larger orgs at higher levels - but I admit my mental model didn’t think about parallel private attempts to exploit, sell, use and otherwise secure comms. It was a blind spot. Seemed too leaky and obvious given the incentives to leak information - but I clearly don’t understand bad guys very well.
As sophisticated as your average low-rent startup IT guy, sure. "Can you set up an HTTP server with Basic Authentication and a TLS certificate?" is the bar here.
> I do, however, find it less likely a smaller scale non-state operation would bother hacking a government agency...
And yet, here we have someone who's not even profiting from the information who has obtained it.
> ... It was a blind spot.
Yes. Definitely. Whenever you find yourself thinking that only "sophisticated actors" and/or "well-funded actors" are motivated to and/or capable of poking around in Internet-facing services to see what they can find and/or do to them, remember all of the times that friggin teenagers and folks who meet some definitions of homeless have yanked dreadfully sensitive data out of said services.
I don't think we know the particulars of how this data was snagged, but so many of what businesses describe as "sophisticated attacks" by "persistent threat actors" are the meatspace equivalent of either walking through a doorway and making copies of everything sitting in plain sight in the room within, or unlocking a door with a well-labeled key that was sitting right next to that door, entering the room, and then firing up the universal copy machine.
Bonus chatter:
If Homeland Security agents who could be murdered, kidnapped, or both if their covers were blown could have their covers blown by data entrusted to friggin Okta, then Homeland Security wanted to have those agents killed and/or kidnapped. Don't believe this? Consider what would have to be done to make it possible for folks in a serious Federal Witness Protection program to earn a paycheck and pay taxes without alerting folks who would be rather interested in kidnapping and/or killing them and their families.
If the conspiracy goes deeper than a layer or two I get skeptical. Moving forward, it would be a good idea to have a bunch of fake identities in Active Directory - but I can hear the internal conversations about seat costs already :)
Making lame excuses for "the good guys" reinforces that these people are doing good. They arent.
Your excuse will be used against you as soon as it's convenient to them.
Anyway - I just wanted to point out that these things can have consequences in the real world for people that aren’t necessarily the evil people you paint a picture of in your head. This isn’t a “oh just a few bad apples” thing - on the contrary that agency is quite rotten and should be disbanded.
Not a value judgment. Just sayin’ that this dump is 53+ certified undercover legal names out in the open.
Know that you don’t have to bend the knee to work for the government. You still have your oath, your union, and the knowledge that this ends in two years. Many have left, but not all. Those who stayed don’t necessarily agree or like what is happening.