Embed Notice

HTML Code

<blockquote style="position: relative; padding-left: 55px;"><section><a href="https://infosec.exchange/users/josephcox/statuses/114026581444355973">Joseph Cox (josephcox@infosec.exchange)'s status on Wednesday, 19-Feb-2025 05:15:18 JST</a><a href="https://infosec.exchange/@josephcox" title="josephcox@infosec.exchange"><img src="https://gnusocial.jp/avatar/163273-48-20230825063445.webp" width="48" height="48" alt="Joseph Cox" style="position: absolute; left: 0; top: 0;">Joseph Cox</a></section><article><p>New from 404 Media: a Musk ally has demanded administrative access to Notify.gov, a system that lets the government text the public. The access would give them large swathes of the publics' personal data too. A worker has resigned in protest rather than give access <a href="https://www.404media.co/musk-ally-demands-admin-access-to-system-that-lets-government-text-the-public/" rel="nofollow">https://www.404media.co/musk-ally-demands-admin-access-to-system-that-lets-government-text-the-public/</a></p></article><footer><a rel="bookmark" href="https://gnusocial.jp/conversation/4588818#notice-8983368">In conversation</a><time datetime="2025-02-19T05:15:18+09:00" title="Wednesday, 19-Feb-2025 05:15:18 JST">about 3 days ago</time> <span>from <span><a href="https://infosec.exchange/@josephcox/114026581444355973" rel="external" title="Sent from infosec.exchange via ActivityPub">infosec.exchange</a></span></span><a href="https://infosec.exchange/@josephcox/114026581444355973">permalink</a><h4>Attachments</h4><ol><li><article><header><div>Domain not in remote thumbnail source whitelist: beta.notify.gov</div><h5><a href="https://beta.notify.gov/">Notify.gov</a></h5><div></div></header><div>Notify.gov lets you send text messages to your users. Try it now if you work in federal, state, or local government.</div><footer></footer></article></li><li><label><a rel="external" href="https://gnusocial.jp/attachment/4160818">ner, Thor : dd, has required us to provide admin/root attesds ta all components of the Notify. gov system. ¥
be able to view all personally identifiable information (Pil) moving through the Notify system, including phone num
47s of the public. This information exists in our Ul, cloud gov-managed resources, and AWS resources. 5 woul
pd Store this data without anybody else receiving a notification. B=
id be able to fully manage the access of others, including granting the same access to others or removing It from existing
access would, of course. grant the same ability to view and download Pil. —
ot received a justification for this request, which makes it difficult to suggest alternative approaches that would accomplish Thomas 2a
[being protective of Pil for members of the public. We have made clear to Thomas that this level of permission wae d allow access to
ested altematives, such as read-only access, Thomas has continued to request full admin) root access. =
z eve that is fevel of access for somebody outside of the product team is not contemplated by the system's authority tor operas
b ftom operty update the SSPP to 3dd this sort of access using our established ATO processes, we have been instricied to ski
ace je system in non-compliance until the access is remediated. ee
eve that | can operate a program and system without the ability to manage access to Pll. As a result, | have submitted my resignat
il be my last ——
E ——</a></label><br><a href="https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/026/578/810/043/080/original/e6f6b6d7e4e67313.png" rel="external">https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/026/578/810/043/080/original/e6f6b6d7e4e67313.png</a></li><li><article><header><div>Domain not in remote thumbnail source whitelist: www.404media.co</div><h5><a href="https://www.404media.co/musk-ally-demands-admin-access-to-system-that-lets-government-text-the-public/">Musk Ally Demands Admin Access to System That Lets Government Text the Public</a></h5><div> from <span>@jason_koebler</span></div></header><div>A worker resigned in protest rather than giving Thomas Shedd access to Notify.gov, which they said would allow him to see "all personally identifiable information moving through the Notiy system, including phone numbers," 404 Media has learned.</div><footer></footer></article></li></ol></footer></blockquote>

Corresponding Notice

Embed this notice
Joseph Cox (josephcox@infosec.exchange)'s status on Wednesday, 19-Feb-2025 05:15:18 JST Joseph Cox
New from 404 Media: a Musk ally has demanded administrative access to Notify.gov, a system that lets the government text the public. The access would give them large swathes of the publics' personal data too. A worker has resigned in protest rather than give access https://www.404media.co/musk-ally-demands-admin-access-to-system-that-lets-government-text-the-public/
In conversationabout 3 days ago from infosec.exchangepermalink
Attachments
1. Domain not in remote thumbnail source whitelist: beta.notify.gov
  Notify.gov
  Notify.gov lets you send text messages to your users. Try it now if you work in federal, state, or local government.
2. ner, Thor : dd, has required us to provide admin/root attesds ta all components of the Notify. gov system. ¥ be able to view all personally identifiable information (Pil) moving through the Notify system, including phone num 47s of the public. This information exists in our Ul, cloud gov-managed resources, and AWS resources. 5 woul pd Store this data without anybody else receiving a notification. B= id be able to fully manage the access of others, including granting the same access to others or removing It from existing access would, of course. grant the same ability to view and download Pil. — ot received a justification for this request, which makes it difficult to suggest alternative approaches that would accomplish Thomas 2a [being protective of Pil for members of the public. We have made clear to Thomas that this level of permission wae d allow access to ested altematives, such as read-only access, Thomas has continued to request full admin) root access. = z eve that is fevel of access for somebody outside of the product team is not contemplated by the system's authority tor operas b ftom operty update the SSPP to 3dd this sort of access using our established ATO processes, we have been instricied to ski ace je system in non-compliance until the access is remediated. ee eve that | can operate a program and system without the ability to manage access to Pll. As a result, | have submitted my resignat il be my last —— E ——
  https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/026/578/810/043/080/original/e6f6b6d7e4e67313.png
3. Domain not in remote thumbnail source whitelist: www.404media.co
  Musk Ally Demands Admin Access to System That Lets Government Text the Public
  from @jason_koebler
  A worker resigned in protest rather than giving Thomas Shedd access to Notify.gov, which they said would allow him to see "all personally identifiable information moving through the Notiy system, including phone numbers," 404 Media has learned.