Dozens of US government online whistleblower sites not secured by HTTPS

ACLU decries it as "serious cybersecurity lapses by numerous federal agencies."

by David Kravets - Apr 17, 2015 3:16am CST

cool revolution

Whistleblowers beware: At least 29 US government agencies' websites that allow the online reporting of abuse, waste, and fraud are not encrypted with HTTPS, according to a survey by the American Civil Liberties Union unveiled Thursday.
"When individuals use these official whistleblowing channels to report waste, fraud, or abuse, the information they submit is transmitted insecurely over the Internet, where it can be intercepted by others. This not only puts the identity of whistleblowers at risk, but also the confidentiality of the information they provide to inspectors general," the rights group said in a letter to Tony Scott, chief information officer for the Office of Management & Budget.
The affected agencies range from the Department of Agriculture and the General Services Administration to the Department of Homeland Security and the Department of Treasury.
The ACLU added in its letter:

That these sites do not use HTTPS to protect the submission of sensitive information (and likely have never used it) raises serious questions regarding the technical competence of the respective inspectors general and their ability to adequately protect sensitive information from cyber threats. Moreover, many of these agencies have a Chief Information Security Officer, whose staff should have discovered and fixed this basic, yet critical, oversight. The responsible agencies should start moving these sites to HTTPS immediately.

The US government has given itself a two-year timeline to deploy Hypertext Transfer Protocol Secure "on all publicly accessible Federal websites and Web services." Internet giants like Google, Facebook, Yahoo and Twitter protect their sites with HTTPS by default.
Even Netflix is moving to HTTPS to help ensure that what movie watchers are viewing stays secret. "We now believe we can deploy HTTPS at a cost that, whilst significant, is well justified by the privacy returns for our users," Netflix Director of Streaming Standards Mark Watson said Wednesday.
The ACLU urged the government to move faster toward adopting HTTPS and suggested that federal agencies deploy an anonymous platform such as Secure Drop. The rights group also noted that some US government agency websites, including the Army, block Web surfers from using Tor.
"This practice should be changed. We recommend that you issue clear guidance prohibiting agencies from blocking access to visitors who are attempting to preserve their privacy and anonymity by using Tor," the ACLU letter said. The ACLU's letter to the government was signed by Michael Macleod-Ball, the acting director of the ACLU's lobbying arm, and Christopher Soghoian, the group's principal technologist.

http://arstechnica.com/tech-policy/2015/04/dozens-of-us-government-online-whistleblower-sites-not-secured-by-https/