Re:Army National Guard announces data breach
by fixermark on Sunday July 12, 2015 @08:09AM
(#9873229)
Two things to be aware of:
1) This was an external press release. It's possible communication to the actual Guard had more detail. Or not; it's the military, and they'll tell you what you "need to know."
2) While they don't guarantee the data wasn't leaked, I read that as more in the sense that "The non-DoD-accredited datacenter is outside of our auditing trail" than in the sense that it's actually likely the data was leaked. If you take my state's drivers' license database and uploaded it to AWS, the state can't "guarantee" the data wasn't used unlawfully either, but you can be certain that Amazon has a lot to lose if some failure of their infrastructure gives China access to a list of passport-authorizing documents.
Which could be anything. For example, an AWS server somewhere. Or, how about a VPS hosted by GoDaddy? A lame attempt at humor. Yet, what do we really know?
> by a contract employee,
Which could be anybody, right?
> we do not believe the data will be used unlawfully
We don't guarantee...we do not "believe".
More detail would have been useful. If my data was with the Guard I would not know what any of the above meant other than my data was made available to a contractor who uploaded it to a random server somewhere and, at the moment, it could be floating in space for anyone to grab.
Brilliant.