(UPDATED) PMO: Do you think it's easy to secure a mailing list?

I also received the same email, in addition to one on Kosovo’s independence, both from PMO’s office.

Serbia’s Southern province of Kosovo declared independence in February 2008. Harper’s government recognized it’s independence. Does this lead to slowly accepting sovereignty for Quebec? Here’s why Canada must follow International Law, the UN Chart, UNSC Resolution 1244 and the Final Helsinki Act of 1975.

concerned citizen

Mike G: Sadly, I *am* that geeky. I have no excuse, and will now retire for the evening, head bowed in shame.

MYL: Actually, neither was swiped, but from what I can see, the PMO email list was set up so that anyone could send to the general address – even without being subscribed to the list. Usually, one-way lists like that only accept messages from a specific address, and everything else is either automatically discarded, or held for moderation.

It’s not clear whether this list required a (spoofed, in this case) pmo-cpm.gc.ca from: line to accept an email for distribution, but in this case, thanks to the de facto anon remailer provided by willyoubetricked.ca, whoever sent it out was able to do so from an apparently whitelisted domain. There’s something rather poetically just about that, considering that someone was using the same remailer to send fake email from “Stephane Dion” earlier this year.

Well, actually, what happened was that whoever filled in the sendmail form at willyoubetricked.ca just put “pm@pm.gc.ca” as his or her address, and as the recipient, the general distribution list for the PMO media list. A properly set up listserv would have rejected the email as coming from a non-regular address — since as far as I know, it doesn’t actually exist except as a receptacle for general delivery at PMO. It actually *is* fairly trivial, if only because it is so very avoidable with even the most cursory security checks in place.

I just read Stephen Taylor’s blog post. He is unamused, as am I.

The government needs to act at two levels, IMO. Federal “gc.ca” email / web security needs a major tightening up to prevent this jackassery in the first place, and the justice system needs to go to work on the jackass in question. And the Tories deserve a slap if a “public” submission from a partisan website of theirs was “permitted” to control a PMO gc.ca email server.

MYL – I would assume that most mailing lists are, in fact, secure from outside messages; really, that’s pretty basic, as far as list admin protocol. I’m on dozens of lists – as I’m sure most of us are – and have run my own as well; it’s the standard setup. Nobody runs open mailing lists for this very reason. The fact that the media list was left gaping like this is, quite simply, absurd. Whoever originally set up the list screwed up, and what’s amazing is that it has taken this long for anyone to notice.

As for web-based mailers, the only way to secure them from this kind of abuse would be to require some sort of user authentication before allowing someone to send something out, which I suspect the admins at notaleader.com and – until tonight – willyoubetricked.ca – thought would discourage users from using it to alert their friends to the latest outrage perpetrated by Stephane Dion. (I’ve never really seen the point of them myself, and have never administered one, so I’m not sure if there’s an easy workaround to avoid these sorts of blowouts.)

Considering all the “effort” that the Harper gov’t has made in trying to re-brand every single website in Tory blue (hmmm…I wonder how much that vanity is costing us…), it would not surprise me if security holes were left. Afterall, one only has to glance at the CPC website to see “quality” at work.

Wasn’t it only a few months ago that personal information could be obtained from a recently revamped government website?

Austin

MYL – I’m sorry, I know I’m disappointingly sanguine about all this; it’s just that this particular hole is so very easy to fix that I can’t imagine it hasn’t been done already. It’s literally one parameter in the standard setup for a mailing list. It would take five minutes to change it, and then we can all sleep soundly.

Sorry…it was passports in December 2007.

Austin

MYL – might I suggest you should direct your ire toward the appropriate, responsible persons and authorities?

If there is incompetence here it has nothing to do with Kady. I’m certain she has more pressing things to do.

[And when I say "pressing" anyone who even had the thought of shirts for Monday morning pass through their mind must surely be paid up Harper supporters and contributors?]

Hi! I just got back from Stephen Taylor’s blog, and boy, are my sides splitting! Lotsa talk about ‘they’ being desperate enough to do anything, which, besides this bit o’ e-mail mischief, includes (please everyone, make sure you’re seated) KNOCKING DOWN CONSERVATIVE CAMPAIGN SIGNS!
And yet, not even one post with a suggestion along the lines of “Lighten up, it’s only a joke.” I nominate Kody. Seconder?

MYL, I hear you. Thankfully it was an obvious spoof, eh? But what if the prankster had been more malicious and sent out a regular-looking Press Release saying something like “PM Denounces Wall Street Bailout Strategy, Announces ‘The End of Capitalism’”? Or god knows what.

Thank you, Prankster, for helping to preserve credit, world peace, etc.

Meanwhile, would somebody please select whichever PMO staffer was responsible for setting up the listserv and frog-march them twice around Langevin?

On the bright side, it was a PMO mailing list to the media, not, say, CSIS.

On the scary side, what if it was a mailing suggesting that the PMO was supporting the UN Human Rights Council in calling Israels shelling of Beit Hazoun a war crime, and would be withdrawing our dimplomats and closing our embassies there until reparations had been made.

Steve Wart: “You modern media bloggers do know that mail headers aren’t evidence of anything, right?”

Well, if you’re talking prosecution, the server logs are the evidence.

Anyway, I’d hardly want to call in the CSE geeks on this matter. It’s in-the-clear email. By it’s very nature, it’s insecure. If it was secure, we wouldn’t have phishing scams.

A lot of this problem arises from the new regime outsourcing IT to their partisan buddies. Follow the money as always.

Anyway, there are other networks that the government uses for secure communications, but if I told you about them, I’d have to kill you. :)