US Cyber Defense Chief Uploaded Sensitive Files Into a Public Version of ChatGPT (politico.com) 51
An anonymous reader quotes a report from Politico: The interim head of the country's cyber defense agency uploaded sensitive contracting documents into a public version of ChatGPT last summer, triggering multiple automated security warnings that are meant to stop the theft or unintentional disclosure of government material from federal networks, according to four Department of Homeland Security officials with knowledge of the incident. The apparent misstep from Madhu Gottumukkala was especially noteworthy because the acting director of the Cybersecurity and Infrastructure Security Agency had requested special permission from CISA's Office of the Chief Information Officer to use the popular AI tool soon after arriving at the agency this May, three of the officials said. The app was blocked for other DHS employees at the time.
None of the files Gottumukkala plugged into ChatGPT were classified, according to the four officials, each of whom was granted anonymity for fear of retribution. But the material included CISA contracting documents (PDF) marked "for official use only," a government designation for information that is considered sensitive and not for public release. Cybersecurity sensors at CISA flagged the uploads this past August, said the four officials. One official specified there were multiple such warnings in the first week of August alone. Senior officials at DHS subsequently led an internal review to assess if there had been any harm to government security from the exposures, according to two of the four officials. It is not clear what the review concluded.
None of the files Gottumukkala plugged into ChatGPT were classified, according to the four officials, each of whom was granted anonymity for fear of retribution. But the material included CISA contracting documents (PDF) marked "for official use only," a government designation for information that is considered sensitive and not for public release. Cybersecurity sensors at CISA flagged the uploads this past August, said the four officials. One official specified there were multiple such warnings in the first week of August alone. Senior officials at DHS subsequently led an internal review to assess if there had been any harm to government security from the exposures, according to two of the four officials. It is not clear what the review concluded.
The AI pundits were right. (Score:5, Funny)
Re: (Score:2)
LOL. I don't have mod points right now, but for the love of the Internet, mod parent up!!!
Re:The AI pundits were right. (Score:5, Insightful)
Don't worry, he'll be replaced by an equally-unqualified sycophant.
Re: (Score:2)
Re:The AI pundits were right. (Score:5, Insightful)
Depends on how good he is at brown-nosing. If he's good enough he'll end up at the White House.
Re: (Score:2)
Re: (Score:2)
That's my stalker troll. It follows pretty much every post I make with garbage propaganda, sometimes stuff which was conclusively debunked literally years before. I think it's some kind of poorly programmed bot, now it's adding as many as 8 crap posts in a row.
Re: (Score:2)
If he's in that position, we already know he's good at brown-nosing. And getting "caught" means nothing, it is only the alleged administration moving the goalposts further down the Fascist road of Project 2025. Even if their useful idiot goes 'round the bend with Alzheimers, they won't easily give up their cash cow. They'll just AI the hell out of his alleged administration and the hallucinations will be indistinguishable from his regular behavior.
More violations than at a high school or unversity (Score:5, Informative)
Re: (Score:2)
I vote "All of the above."
Of course (Score:5, Insightful)
Because despite the fact that this man holds a Bachelors in engineering, Masters in Comp Sci, a useless MBA, and a PhD in information systems... he's a fucking retard and has no clue what the fuck he is doing. He probably never actually earned those degrees legitimately. He certainly hasn't done any work that proves his knowledge.
Re: (Score:2)
It's unfortunate that he's not one of the 10,000 PHDs being dropped from US gov't rolls.
https://yro.slashdot.org/story... [slashdot.org]
The real hazard of using any current AI (Score:5, Interesting)
I know a lawyer whose firm has just updated their formal policy on the use of AI. It used to be "Don't." Now, they're allowed to use one, but only if the firm higher ups have specifically approved it. There are none approved, and apparently none available that meet their requirements.
Interestingly, their issue isn't that AIs make up case law [calmatters.org] (they're not overworked, and aren't idiots, so they know they would have to carefully vet anything produced), but that to be useful, the query would submit to the AI engine client information they are legally required to keep confidential, and that information will be recorded and used to create future answers for other users.
Re: (Score:2)
real firms have private models
Re: (Score:2)
I suspect there's more to their requirements than just that, but that was the biggest concern, apparently.
Re: (Score:3)
My point remains valid, most transnational corporations have their own private AIs.
AI isn't the problem, all the classism and corruption are our real problems.
All the unethical upper class people are wrecking everything for everybody and soon they'll destroy this civilization as they have many others. Greed is often our downfall.
Re: (Score:3)
Re: (Score:2)
How is this any different from lawyers using Microsoft Office 365, or similar?
THIS ALL DAY. Any software which makes AI recommendations is simply not safe to use with confidential information. And even if you don't suspect malice on the publisher's part (as one reasonably does with Microsoft because they have constructed the world's worst spyware and a license agreement to match which says they can exfiltrate any of your data for basically any purpose, on a whim, without permission) you have to be concerned about incompetence.
Microsoft has had multiple breakins to Azure where THEY HA
Re: (Score:2)
They've had a policy (the same, I'm sure) on that for much, much, much longer.
Other than that, it really isn't.
(A lot of lawyers don't use Office at all, because there are other word processors that got into the business of legal templates way back, and lawyers, like most users, don't like change, and the templates they have aren't for Office.)
Re:Yup (Score:5, Informative)
Re:Yup (Score:5, Insightful)
DEI hires will do that.
He is a Republican.
DJT hires will do that.
(FTFY)
Re: (Score:3, Insightful)
Is DEI not about hiring a person based on something besides merit? I don’t think this person was qualified and hired simply for being a yes man. Making him a DEI hire.
This insult only works one way?
Re: (Score:2)
He wasn’t white.
Re: (Score:2)
On the other hand, Boeing has made a whole sub-specialty of screwing up contracts, and then getting paid to fix what they botched, sometimes making other mistakes in the process that they will need to fix later.
The high up the ladder, the less qualified! (Score:2)
Re: (Score:1)
“Remove all IP based filtering on the RDP connections on the firewall, it's too difficult to update that stupid field.”,
IP filtering on RDP saved me, and a business system I look after, when CVE-2019-0708 (BlueKeep) arrived. I love filtering by IP.
That guy who wanted it removed seems like a knobhead.
Trump gives a speech on the topic... (Score:5, Funny)
Re: (Score:3)
You don't understand, that information must be kept from the ENEMY! Unfortunately DHS considers US taxpayers 'the enemy'.
Stupid person does stupid things (Score:2)
What else is new?
Interestingly, copy & paste is now considered the most problematic data leakage vector by many security experts.
No FOUO markings (Score:2)
What is this bullshit. The article canâ(TM)t even get the source material correct.
Data (Score:2)
It's an increasing trend that people "just don't care" about data security.
Whether that's simple things like copyright, or things like GDPR, or things like trusting third parties on the other side of the world that knowingly misuse data while operating in foreign legal jurisdictions.
It's a laziness, not a protest from them. They just don't care about people's data because they've grown up in a world where nobody seems to care about their data.
You see it in new-hires all the time. Just copy-pasting shite o
So (Score:2)
He
1) Asked for and received special permission
2) Did not upload anything classified to a non-classified system
3) Did upload materials not for public distribution but did not distribute them publicly, simply used an unclassified system to handle unclassified data.. It is not like he posted it on reddit. I don't see what would be different than if he'd pasted the text into Google Docs or Word 365 to make some edits.
I don't really like it, I don't think it was great judgment but I also don't see what exactly w
Re: (Score:2)
> I don't see what would be different than if he'd pasted the text into Google Docs or Word 365 to make some edits.
Government employees are prohibited from using those public cloud services for OUO as well. There are separate instances of some of these services like Office 365 which can be used for OUO, but they are kept separate for defense in depth, given these services can have bugs that allowed people to access documents they should be allowed to.
Furthermore, it is worse because the TOS for ChatGPT
ChatGPT is good at summarizing (Score:2)
Silly billy they are supposed to go into secure (Score:2)