Cybersecurity and the Tylenol Murders 74
HughPickens.com writes: Cindy Cohn writes at EFF that when a criminal started lacing Tylenol capsules with cyanide in 1982, Johnson & Johnson quickly sprang into action to ensure consumer safety. It increased its internal production controls, recalled the capsules, offered an exchange for tablets, and within two months started using triple-seal tamper-resistant packaging. Congress ultimately passed an anti-tampering law but the focus of the response from both the private and the public sector was on ensuring that consumers remained safe and secure, rather than on catching the perpetrator. Indeed, the person who did the tampering was never caught.
According to Cohn the story of the Tylenol murders comes to mind as Congress considers the latest cybersecurity and data breach bills. To folks who understand computer security and networks, it's plain that the key problem are our vulnerable infrastructure and weak computer security, much like the vulnerabilities in Johnson & Johnson's supply chain in the 1980s. As then, the failure to secure our networks, the services we rely upon, and our individual computers makes it easy for bad actors to step in and "poison" our information. The way forward is clear: We need better incentives for companies who store our data to keep it secure. "Yet none of the proposals now in Congress are aimed at actually increasing the safety of our data. Instead, the focus is on "information sharing," a euphemism for more surveillance of users and networks," writes Cohn. "These bills are not only wrongheaded, they seem to be a cynical ploy to use the very real problems of cybersecurity to advance a surveillance agenda, rather than to actually take steps to make people safer." Congress could step in and encourage real security for users—by creating incentives for greater security, a greater downside for companies that fail to do so and by rewarding those companies who make the effort to develop stronger security. "It's as if the answer for Americans after the Tylenol incident was not to put on tamper-evident seals, or increase the security of the supply chain, but only to require Tylenol to "share" its customer lists with the government and with the folks over at Bayer aspirin," concludes Cohn. "We wouldn't have stood for such a wrongheaded response in 1982, and we shouldn't do so now."
According to Cohn the story of the Tylenol murders comes to mind as Congress considers the latest cybersecurity and data breach bills. To folks who understand computer security and networks, it's plain that the key problem are our vulnerable infrastructure and weak computer security, much like the vulnerabilities in Johnson & Johnson's supply chain in the 1980s. As then, the failure to secure our networks, the services we rely upon, and our individual computers makes it easy for bad actors to step in and "poison" our information. The way forward is clear: We need better incentives for companies who store our data to keep it secure. "Yet none of the proposals now in Congress are aimed at actually increasing the safety of our data. Instead, the focus is on "information sharing," a euphemism for more surveillance of users and networks," writes Cohn. "These bills are not only wrongheaded, they seem to be a cynical ploy to use the very real problems of cybersecurity to advance a surveillance agenda, rather than to actually take steps to make people safer." Congress could step in and encourage real security for users—by creating incentives for greater security, a greater downside for companies that fail to do so and by rewarding those companies who make the effort to develop stronger security. "It's as if the answer for Americans after the Tylenol incident was not to put on tamper-evident seals, or increase the security of the supply chain, but only to require Tylenol to "share" its customer lists with the government and with the folks over at Bayer aspirin," concludes Cohn. "We wouldn't have stood for such a wrongheaded response in 1982, and we shouldn't do so now."
Re: (Score:1)
Plutocrats will "encourage" law-makers try every other technique first before they have to spend profits to change themselves.
Re: (Score:2)
It is worth noting, I think, that absolutely *everyone* has something to hide... Even if only from people who might abuse such knowledge.
And that even *if* the government were compltely trustworthy (and I do not allege that they are, but hypothetically,even if they were), if they can see your confidential information, then it is theoretically also possible for someone with less noble intentions to do so as well, and if they exploit it before they are caught, the damage can sometimes be utterly irreparable.
Re: Citizen, I notice your resistance (Score:2)
I agree that everyone has something to hide, just as everyone is a target of 'cyber' attacks. However, while I have not yet read the full bill and the linked article is a bit sparse on actual fact, sharing attack data would be tremendously helpful. If private companies are able to share STIX/IOC's (with information deemed private stripped out) that information would be very useful. While I worked for an Amazon sub, we couldn't even get attack data amoungst companies that were, essentially the same. Currentl
what did you expect? (Score:5, Insightful)
The same people that say it is OK that the NSA weakens security paradigms and that take seriously government demands for backdoors in all crypto systems and that OKs spying on everyone is not about to do a complete 180 and actually do anything to build up security. The corporations can do little for better security while the government is busy weakening and limiting all security tools. So simply making more demands on companies is useless.
Re: (Score:3)
Maybe not in the States, where you still have swipe credit cards. Which don't require a PIN code to work!
And I agree with the GP, the analogy is horribly built.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
Agreed this is a terrible terrible analogy.
One is the securing of a relatively simple process where every step of the chain can be viewed in full in real time. You are also able to seal whole sections of the process away from external factors in such a way that breaching it secretly is almost impossible and comes with huge risks to the attacker.
When it comes to data protection or just IT in general the systems are far far more complex. Every piece of code is run through a compiler which turns it into a bl
Re: (Score:2)
Which makes no sense as a comparison.
Tech literacy amongst those with Internet access was higher because Internet Access availability was lower. The OP is confusing the cause with the effect.
Cause: internet Access required technical literacy.
Effect: Only those with technical literacy were accessing the Internet.
Re: (Score:2)
Of course it was, but you're confusing the cause and the effect.
The logical buildup is crap.
I could say that cars are for the poor nowadays because in the early 1900s all cars belonged to the rich and It'd be wrong.
Re:1982 is an interesting comparison in other ways (Score:4, Interesting)
Orwellian commercial and governmental surveillance, censorship by various nations, ad-infestment of everything, etc, would simply not have been tolerated on the 1982 internet.
Yeah, right.
Meet Executive Order 12333: The Reagan rule that lets the NSA spy on Americans [washingtonpost.com]
...the executive order [EO 12333] authorizes collection of the content of communications, not just metadata, even for U.S. persons. Such persons cannot be individually targeted under 12333 without a court order. However, if the contents of a U.S. person’s communications are “incidentally” collected (an NSA term of art) in the course of a lawful overseas foreign intelligence investigation, then Section 2.3(c) of the executive order explicitly authorizes their retention. It does not require that the affected U.S. persons be suspected of wrongdoing and places no limits on the volume of communications by U.S. persons that may be collected and retained.
Now you say that that only pertains to data that is scooped up in foreign communications, but you have to realize that in modern telecommunication networks, data often transverses borders as packets are routed to phone switches that may be physically located in, say, Canada. So call from you in Nevada to your mom in Michigan may be recorded if your call is routed through a phone switch in Toronto, Canada.
Re: (Score:2)
Orwellian commercial and governmental surveillance, censorship by various nations,......
...the executive order [EO 12333] authorizes collection of the content of communications, not just metadata, even for U.S. persons. Such persons cannot be individually targeted under 12333 without a court order. However, if the contents of a U.S. person’s communications are “incidentally” collected (an NSA term of art) in the course of a lawful overseas foreign intelligence investigation, then Section 2.3(c) of the executive order explicitly authorizes their retention. It does not require that the affected U.S. persons be suspected of wrongdoing and places no limits on the volume of communications by U.S. persons that may be collected and retained.
Now you say that that only pertains to data that is scooped up in foreign communications, but you have to realize that in modern telecommunication networks, data often transverses borders as packets are routed to phone switches that may be physically located in, say, Canada. So call from you in Nevada to your mom in Michigan may be recorded if your call is routed through a phone switch in Toronto, Canada.
It is interesting that the set of agencies commonly made reference to as the TLAs
at this point have near total control over most of the routing infrastructure and could
change routes such that the data passes through an international resource.
I find it amusing that my "location services" often get my location wrong by three time zones.
One time my location was N. Virginia another time some place in MD and I believe
I have been triangulated west and south of the Golden Trumpet just west of one
of the largest hol
Re: (Score:3, Informative)
The worst aspects of today's internet: Orwellian commercial and governmental surveillance, censorship by various nations, ad-infestment of everything, etc, would simply not have been tolerated on the 1982 internet.
This is nonsense. In 1982, the Internet was almost entirely government funded and run, and there were rather severe restrictions on what it could be used for, and what type of speech was allowed. For instance, any sort of commercial speech was restricted, it was difficult to be anonymous or even pseudonymous, and people could lose their connections, with little recourse, for being offensive. As usual, the "good 'ole days" where not as good as you falsely remember.
Inexact Comparisons (Score:5, Insightful)
There is a value in 'information sharing', it just depends on the information being shared. Sharing the sorts of data associated with an intrusion, so that others can check their networks for similar activity or vulnerabilities? That's a good thing. The comparison here would be having Tylenol's makers share the information on how their supply chain was possibly compromised in the first place, so that we don't wind up having them fix the problem, only for other companies to get hit with the same thing because the details were kept secret.
That's what's important - the information about the vulnerabilities and exploits, not the customer data. This is why we have to be especially wary about nebulous proposals that hand over truckloads of unnecessary data, since there are certainly agencies in the government that would love to have free access to it in order to entirely unrelated things like go on witch-hunts.
At the same time, we have to keep in mind that most companies won't share information about attacks unless they're required to do so. Imagine if Tylenol had just ignored clear signs of a break-in at their plant, and ignored the possibility that thousands or millions of capsules could have been poisoned, and decided to just pretend nothing ever happened, only for it to come to light years later, because that was roughly what has happened in many past instances of major retailers getting hacked.
Re: (Score:2)
There is a value in 'information sharing', it just depends on the information being shared. Sharing the sorts of data associated with an intrusion, so that others can check their networks for similar activity or vulnerabilities? That's a good thing. The comparison here would be having Tylenol's makers share the information on how their supply chain was possibly compromised in the first place, so that we don't wind up having them fix the problem, only for other companies to get hit with the same thing because the details were kept secret.
Except it wasn't. The poisoning turned out to happen inside a home, and the public was never in any danger. So, we ended up with a huge cost increase on every single product, dangerous or not, along with multiple layers of "safety" straps,coatings, etc. which are incrediblyannoying to remove and do very little to improve the alleged tamper-proofness of the product itself. Really: do you think some creep could manage to drop poison pills into hundreds of nsaid bottles in CVS stores (assuming no tamper-pr
Oversimplified (Score:2)
It's a oversimplification to say the creators of software and hardware that make up networks and services must be held accountable for security. There is an inherent state that many of the bugs that get exploited are unknowable until somone stumbles upon them. Either the software's creator or the bad-actor finds it first and that's where the trouble lies.
I think the larger issue is the design of the internet is way too open and without any accountability.
Re: (Score:3)
>> It's a oversimplification to say the creators of software and hardware that make up networks and services must be held accountable for security.
No it isn't. I blame Microsoft. The widows architecture and development culture around windows both encourage/require allowing apps to extend/modify parts of the operating system itself (example: the registry and the windows/system32 directories). Microsoft have been notirious in encapsulating executable stuff in things that should be data-only, such as doc
Re: (Score:2)
>> They can't win.
Sure they can but it might mean they have to end backwards compatability to do it, which would be fine if they were serious about security afterwards.
End doing shit like having a registry and allowing apps to create files everywhere in the OS, and having things such as USB keys ever being able to auto-execute. Get rid of useless crap like UAC that just gives the illusion of security by being annoying to users, and instead use a better (I'd suggest linux-like) security model and packa
Re: (Score:2)
Blame the widows, not the orphans!
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
There is an inherent state that many of the bugs that get exploited are unknowable
I'd agree if 99% of exploits weren't one of a basic set of vulnerabilities. "I never though someone would get a Privilege escalation though a buffer overflow from an improperly sanitized input." The threats aren't "bugs" A "bug" is bad code that allows a threat a vector of attack.
Computer security is saying that you secure doors and windows on a house only after each of them has been broken in, and only in the minimum way to prevent the previous attack from working. "Oh, they got in with a credit-card j
Re: (Score:1)
Computer security is saying that you secure doors and windows on a house only after each of them has been broken in, and only in the minimum way to prevent the previous attack from working.
But, that is exactly what we actually do.
If you were to use state-of-the-art methods to break into one of Johnson and Johnson's manufacturing facilities, I doubt the locks on the doors would keep you out. By state of the art, I mean any technology of any kind available to anybody anywhere, including tanks, aircraft, and so on.
The reason that Johnson and Johnson doesn't have to defend against tank platoons is that governments already provide protection against these kinds of attacks. The same is not true o
Let's examine your interesting comparison (Score:2)
Regarding the inevitable use of the internet for data collection: yeah, someone was first, but a metric fuck ton more suspects.Governments, corporations, recruiters, employers, prospective suitors, suspicious spouses, etc.
Market forces at work (Score:4, Insightful)
It's pretty simple. There were alternatives to Tylenol and they knew if they didn't act it would cost them billions. There is no alternative to the internet so people are pretty much stuck with the standards in use. The losses are socalized enough that there isn't much reason for most people to change. If people personally stood to lose tens of thousands of dollars they might take things seriously.
Re: (Score:2)
There were plenty of drugs with acetaminophen back then. Excedrin did with a combination of asprin and caffeine. There were others but obviously Tylanol was the most popular.
Exactly the same thing in going on with the (Score:3)
"Patriot [sic] act" and the "USA Freedom [sic] act". I am so disgusted that congress acting to circumvent the Supreme Court through technicalities, while changing nothing at all is being called "surveillance reform [sic]". If you ever hoped that Obama's background as a professor of constitutional meant that he would protect the bill of rights like I did, you just got shat on.
Yes, I understand that having the entire world under surveillance all the time is very convenient for law enforcement and keeps us "safer [sic]" than having any right to privacy would. It's just a shame that no one in the government cares.
Also, do you know how many terrorists they caught with the metadata program? They caught ONE taxi driver who wanted to send a couple thousand to Hamas. That's it. Well, now you know what your freedom used to be worth! Less than one taxi driver's donation.
Apples and Oranges (Score:3, Insightful)
From TFA:
For example, Johnson & Johnson developed new product protection methods and ironclad pledges to do better in protecting their consumers in the future. Working with FDA officials, they introduced a new tamper-proof packaging, which included foil seals and other features that made it obvious to a consumer if foul play had transpired. These packaging protections soon became the industry standard for all over-the-counter medications. The company also introduced price reductions and a new version of their pills — called the “caplet” — a tablet coated with slick, easy-to-swallow gelatin but far harder to tamper with than the older capsules which could be easily opened, laced with a contaminant, and then placed back in the older non-tamper-proof bottle.
Packaging for over the counter drugs became safer because Johnson & Johnson invested a 100 million dollars to protect their customers with tamper-resistant seals on their packaging and harder to contaminate pills, which showed the rest of the industry how do it as well. Congress passed the law mandating that the rest of the industry follow suit only after Tylenol successfully did it first. In addition, and this is important, the FDA worked with Johnson & Johnson for the common goal of protecting consumers.
With computer security, though, you have the US government that is openly hostile to allowing users to completely secure their systems. For one thing, you have the law enforcement and intelligence branches of the government that lobby Congress for more surveillance laws, and also actively subvert standards for encryption, OS security, and security applications as well as weaponizing exploits of software vulnerabilities. And even when there are companies leading way on how to provide secure applications and services, you have the government stepping in forcing it to compromise its security. Lavabit is just one public example of the government's zeal to snoop overriding consumer's need for secure communication.
Another thing is you have the software industry lobbying Congress against passing laws which would apply product liability rules to software applications. Software companies have been thwarting efforts to hold them accountable for ages. All software has bugs, but a lot of bugs are just howlers that might not have got through to release if companies were held a little responsible for the harm they can cause.
Nope, the Tylenol case and the case for secure computers and networks are not the same. In the Tylenol case, the gov and drug industry had a common goal to protect the consumer. In the case of computer security, the gov and software industry have their own goals, but they're not to protect the common user.
Re: (Score:2)
So if the companies aren't even trying (which they aren't......increased liability can help with that, though), there's no way they'll succeed.
It is not the govt's job to keep our data safe.. (Score:3)
..never was, never will be.
If we the people want our data safe, we have no choice but to keep ever vigilant about defending against laws that allow the government access to data we don't wish be open.
Thank you Dr Paul.
why do people get this wrong? (Score:2, Informative)
Re:why do people get this wrong? (Score:4, Interesting)
Re: (Score:3)
Nope. The guy they caught wrote a ransom note demanding $$$ to stop poisoning the bottles. He got caught and sent away for extortion. AFAIK they never did charge anyone with the actual murder.
Indeed. And, he lived in New York whilst the poisoned capsules were found in and around the Chicago area.
Johnson and Johnson's handling of the total recall[tm] was wildly applauded at the time, perhaps in contrast to the number of stars we are currently awarding to the nationwide surveillance alliance.
Re: (Score:2)
Wikipedia says I'm right and OP is wrong.
Re: (Score:2)
So the original (incorrect) post is modded at +3, while both mine and the guy saying I'm right are at +2. Thanks, moderators, for fact checking.
Wikipedia says I'm right and OP is wrong.
If it were not for your relatively low UID number, I'd say "you must be new here".
Facts and logic are fungible and elastic among Slashdotters when they negatively impact stubbornly-held (but incorrect nonetheless) worldviews, politics, (anti-)religious beliefs, and ideologies.
To a large extent Slashdot negative moderation serves the same purpose as sticking one's fingers in one's ears and going "lalalala I can't hear you!".
Strat
Re: (Score:2)
You don't say.
Re: (Score:2)
I guess I get the 3rd competing story for how it most likely happened..
A man poisoned his cronically ill wife and placed more poisoned pills on store shelves to produce the doubt he didn't murder his wife.
Who actually did the poisoning was not proven due to the number of cases.
"As the tampered-with bottles came from different factories, and the seven deaths had all occurred in the Chicago area, the possibility of sabotage during production was ruled out. Instead, the culprit was believed to have acquired bo
Back in the day (off topic) (Score:3)
I ran into him some 20 years later. He told me he didn't know why he didn't like me and apologized for being an ass. I told him I put the Tylenol bottle on his desk, he said "shit Jim, I knew that as soon as I saw it".
Re: (Score:2)
Your parents named you "shit Jim"?
Re: (Score:2)
/ Dad doesn't read
Re: (Score:1)
Is that so off-topic, after all? Imagine if you did the same thing today. The coworker, or someone else in the office, reports the Tylenol bottle as being suspicious. Everyone gets locked down in the office, the police are called, a hazmat crew comes out and looks around. Security camera footage from your office is confiscated. The Tylenol bottle is fingerprinted and swabbed for DNA. And if they find anything that ties you to that bottle, you're off to prison for a few years for making terroristic threats,
...as a kid when it happened... (Score:1)
This is all second hand info, of course, but as a kid I knew a worker at the 'pill' factory.
That chemical is used to clean the pill dies. The theory produced was that it was an
industrial accident (yes, the makers confirmed that that chemical is used to clean the
dies, but downplayed its significance - do the research!). It was my first experience of
a major corporation ducking responsibility and I was taught a good lesson from it.
Because of the egregious way in which people died from the accident, the compa
Re: (Score:3)
Cohn should stick to what he knows (Score:2)
Because the list of things she knows clearly does not include the concept of "community based threat intelligence". The sharing of threat intel, especially among industry peers (financial services, healthcare, etc.) can be a very powerful tool. If the security people at Acme Widgets and Cogswel Cogs alert me that their seeing a specific attack coming from a particular IP address, we here at Spacely Sprockets can proactively take steps to defend against that attack.
FTFA:
"Opening debate of the bill on Wedne
Be careful about what you wish for (Score:2)
"trusted computing", locked bootloaders, ... controversial stuff like this are all improvements in security that are easy to mandate, are pushed by big companies and closely match the Tylenol example (where tamper resistance was the solution).
The same, but not the same as the author thinks (Score:2)