U.S. Courts: SolarWinds Hack May Have Affected CM/ECF Filing System

"An apparent compromise of the confidentiality of the CM/ECF system due to these discovered vulnerabilities currently is under investigation"

Yesterday, the Administrative Office (AO) of the U.S. Federal Courts issued a remarkable press release, titled Judiciary Addresses Cybersecurity Breach: Extra Safeguards to Protect Sensitive Court Records.

In mid-December, the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency issued an emergency directive regarding  "a known compromise involving SolarWinds Orion products that are currently being exploited by malicious actors." The Administrative Office of the U.S. Courts (AO) immediately notified courts of this development and in response, the Judiciary has suspended all national and local use of this IT network monitoring and management tool.

The AO is working with the Department of Homeland Security on a security audit relating to vulnerabilities in the Judiciary's Case Management/Electronic Case Files system (CM/ECF) that greatly risk compromising highly sensitive non-public documents stored on CM/ECF, particularly sealed filings. An apparent compromise of the confidentiality of the CM/ECF system due to these discovered vulnerabilities currently is under investigation. Due to the nature of the attacks, the review of this matter and its impact is ongoing.

Wow! Did hackers gain access to sealed files on CM/ECF? The U.S. Courts will have to make disclosures of all sensitive information that was at risk.

How are the courts addressing this system compromise? Highly sensitive court documents will now be filed by SneakerNet!

Under the new procedures announced today, highly sensitive court documents (HSDs) filed with federal courts will be accepted for filing in paper form or via a secure electronic device, such as a thumb drive, and stored in a secure stand-alone computer system. These sealed HSDs will not be uploaded to CM/ECF. This new practice will not change current policies regarding public access to court records, since sealed records are confidential and currently are not available to the public.

I recently criticized federal court web site for not even having SSL certificates. Now, the scope of their security failures becomes far more glaring.

Comments

[John F. Carr]

As I read the quoted text they found the security hole in an independent audit. But they most likely didn't care about security for years so who knows how much got leaked. Security leads to inconvenience. You mean I have to WALK to the secure reading room instead of using my office?

I remember when the government had the DoD promoting computer security instead of spending so much time writing malware. Almost nobody these days thinks about the consequences of putting data into a computer. (I'm typing this into a Google web browser on a computer running Google's operating system. Full of spyware. So I don't do anything here I don't want Google to know about. I have a more secure environment to use when I don't want to share.)

[mydisplayname]

"U.S. Courts: SolarWinds Hack May Have Affected CM/ECF Filing System." Why, yes, yes it did.

[DaivdBehar]

I oppose complicated, expensive, time consuming security. Trust is very efficient and rewarding to the economy.

I support the death penalty for unauthorized hackers. Trials in absentia. Death penalty delivered by drones, with maximum collateral damages to family and to neighborhoods. Absolute legal immunities for any vigilante action. Money rewards for a hacker delivered dead or alive, such as $100,000. Seize the assets of all sponsors.

The lawyer is weak and totally ineffective. I doubt 1% of hacks are ever prosecuted. The lawyer is not protecting us from crime. This is the most worthless and most toxic occupation. Crush it, to save our nation, then kill the criminals. There is a simple principle the lawyer does not understand. The deceased have a low recidivism rate.

[Toranth]

What is "unauthorized hacking"?

Some courts have determined that manually typing in a URL to access a document presented to the entire internet that the owner didn't mean to have accessible is criminal "hacking".

[James Pollock]

To people who don't know what they're talking about, "hacking" is a crime. To people who do know what they're talking about, "hacking" means really knowing how an information system actually works.
The thing is, that person is so deranged you can't tell which meaning is actually invoked in the call for death for "unauthorized hacking".

[Peter Gerdes]

Actually the sneakernet solution is what should have been the policy all along. A complex system like ECM is essentially impossible to build to be both highly secure and useable (absent putting all of Google's resources into supporting, patching and actively monitoring it).

Ssl is only relevant for stopping MITM and network interception attacks and we can't let it give us a false sense of security.

[Hank Ferrous]

Agree on sneakernet, disagree on use of google. Network and systems security is a neverending battle, as you well know, and most folks simply lack the mindset and discipline.

[James Pollock]

It is very difficult to build a system and THEN try to make it secure. You have to build a secure system from the ground up, addressing security at every stage. The tradeoffs between building for compatibility and ease of use on one hand, and designing for security and stability are readily illustrated by the difference between Windows 9x and Windows NT. In theory, both should be able to run software designed to run in the win32 environment, but in actuality, a lot of software had compatibility problems under Win NT because it wasn't designed for security.
the original security model for PC's was physical security, you limited physical access to the device to control access to the data on it. This misled a lot of application developers to develop software that assumed their program would have complete access to the computer it was running on (which worked just fine in 95) but then the software would try to access something that Windows NT considered off-limits and the application would fail.
I can remember many calls to technical support where I would report that a piece of software was failing and they'd respond, "Tell your network administrator that you have to run this software as 'Administrator'". Thing is, I am my network administrator and I'm not letting users log on as Administrator. That's kind of the point of running a secure operating system.

[BMS]

What’s especially outrageous is that the Judiciary has been overcharging for online access for years and siphoning the proceeds for its own internal use — fancy new computers for judges, etc. The fees from PACER are, by statute, supposed to go to developing ECF/PACER — e.g. maybe an improved security system.

[James Pollock]

The sneakernet fees are exorbitant, too.