Japanese Gov't Accidentally Shares Internal Email Over Google Groups

itwbennett writes "An official at Japan's Ministry of the Environment created a Google Group to share email and documents related to Japan's negotiations during a meeting held in Geneva in January, but used the default privacy settings, which left the exchanges wide open. According to Japan's Yomiuri Shimbun newspaper, over 6,000 items, including private contact information of government officials, was publicly accessible. Michihiru Oi, a ministry official, said the ministry has its own system for creating groups and sharing documents, but it doesn't always function well outside of Japan, sometimes leading to 'poor connections' and a 'bad working environment.'"

They should always operate this way

[ebno-10db]

This mistake should be the standard way of working for all governments.

Security backfire?

[Urban Garlic]

So the article and summary hint at a common problem -- "the ministry has its own system for ... sharing documents", which "doesn't always function well outside of Japan". I've seen this in more than one enterprise, where the IT guys meet the need of users to securely move data around by buying or building a secure solution, and they pay very careful attention to the security, but less attention to the usability. Users will go for ease-of-use every time, and aren't thinking about security, so mistakes like this happen.

The obvious solution is to make the secure system easy to use, but usability itself is hard to get right, secure usability is very hard.

Oh Japan..

[paysonwelch]

The scary thing is that they were using Google a private US company to share private international secrets. This is just sloppy in my opinion. I mean.. come on how seriously are they trying to protect this sensitive information if they are uploading it to third party servers which probably never delete data and just deep freeze it?

You still risk jail time if you look at the files.

[140Mandak262Jamuna]

The way most official secrets acts are written, it has some boilerplate language with a whole bunch of "whereas" and "notwithstandings" and eventually boil down to making it a crime to access government secrets, no matter how trivial or non-existent the protections were nor how clueless and braindead the officials were. Usually it has no due-diligence requirements on the part of the government to protect the secret data. It is usually a crime to look at what the government considers secret even if it was done accidentally, inadvertently.

Laws are actually drafted by government officials and they insert enough language to protect their tails.