Incident: Hacking of Arizona Law Enforcement Agency by Lulz Security.

Published Date: 2011-06-24

Postmortem Analysis
Timeline 1. The software failure incident, which was a hack by the Lulz Security hacking collective targeting the Arizona Department of Public Safety, happened in June 2011 [6214].
System 1. Arizona Department of Public Safety's computer system [6214]
Responsible Organization 1. The Lulz Security hacking collective [6214]
Impacted Organization 1. Arizona Department of Public Safety (DPS) officers [6214]
Software Causes 1. The software cause of the failure incident was hacking by the Lulz Security hacking collective, leading to the breach of the Arizona Department of Public Safety's computer system [6214].
Non-software Causes 1. The hacking incident was motivated by political reasons related to Arizona's immigration enforcement law SB1070 and perceived racial profiling [6214].
Impacts 1. Personal information of Arizona law enforcement officers, including names, phone numbers, addresses, and passwords, was exposed [6214]. 2. Officers were inundated with calls and emails, leading to disruptions in their personal lives and potential security risks [6214]. 3. The Arizona Department of Public Safety had to take additional security measures to safeguard its computer system [6214].
Preventions 1. Implementing robust cybersecurity measures such as regular security audits, penetration testing, and network monitoring to detect and prevent unauthorized access [6214]. 2. Ensuring strong password policies and multi-factor authentication to protect sensitive information from being easily compromised [6214]. 3. Providing cybersecurity training and awareness programs for employees to recognize and report suspicious activities, phishing attempts, and social engineering tactics [6214]. 4. Keeping software systems up to date with the latest security patches and updates to address known vulnerabilities [6214]. 5. Implementing encryption for sensitive data to prevent unauthorized access even if the system is breached [6214].
Fixes 1. Enhancing cybersecurity measures and protocols to prevent future hacking incidents [6214]
References 1. The Lulz Security hacking collective's website 2. Arizona Department of Public Safety (DPS) officers contacted by The Associated Press 3. Manuel Johnson, spokesman for the FBI's Phoenix division 4. DPS spokesman Steve Harrison 5. The Arizona Republic 6. DPS officer Steven Loya 7. DPS officer Daniel Scott 8. Media outlets 9. Various individuals who contacted the DPS officers 10. The Associated Press

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - The Lulz Security hacking collective, which claimed to have hacked into the computer files of an Arizona law enforcement agency, had previously taken credit for hacking into Sony Corp. where more than 100 million user accounts were compromised [6214]. (b) The software failure incident having happened again at multiple_organization: - The Lulz Security hacking collective, in addition to targeting the Arizona law enforcement agency, had also defaced the PBS website and cyber-attacked the CIA website and the U.S Senate computer system [6214].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be attributed to the hacking incident where the Lulz Security hacking collective successfully breached the computer files of an Arizona law enforcement agency. The breach resulted in the release of sensitive information such as intelligence bulletins, training manuals, personal email correspondence, names, phone numbers, addresses, and passwords belonging to Arizona law enforcement [6214]. (b) The software failure incident related to the operation phase is evident from the aftermath of the breach. DPS officers reported being inundated with calls and emails, with their personal information being exposed on the internet. Officers like Steven Loya and Daniel Scott had to deal with constant ringing of their phones, strangers contacting them, and the need to change their phone numbers due to the breach [6214].
Boundary (Internal/External) within_system (a) The software failure incident reported in the article is primarily within_system. The failure was due to the hacking activities of the Lulz Security hacking collective, which successfully breached the computer files of an Arizona law enforcement agency. The hackers accessed and released sensitive information such as intelligence bulletins, training manuals, personal email correspondence, names, phone numbers, addresses, and passwords belonging to Arizona law enforcement officers [6214]. The breach originated from within the system, indicating a failure in the agency's cybersecurity measures.
Nature (Human/Non-human) non-human_actions (a) The software failure incident in this case was primarily due to non-human actions, specifically a hack carried out by the Lulz Security hacking collective. They claimed to have hacked into the computer files of an Arizona law enforcement agency, leading to the release of sensitive information such as intelligence bulletins, training manuals, personal email correspondence, names, phone numbers, addresses, and passwords belonging to Arizona law enforcement officers [6214]. The breach of the computer system and the subsequent leaking of classified documents and personal details were all actions initiated by the hackers without direct human involvement in causing the failure.
Dimension (Hardware/Software) software (a) The software failure incident reported in the article is primarily related to a hack carried out by the Lulz Security hacking collective on the computer files of an Arizona law enforcement agency. This incident is not attributed to hardware failure but rather to a security breach orchestrated by the hackers [6214]. (b) The software failure incident is directly linked to software issues, specifically the breach of the Arizona law enforcement agency's computer system by the Lulz Security group. The breach resulted in the release of private intelligence bulletins, training manuals, personal email correspondence, names, phone numbers, addresses, and passwords belonging to Arizona law enforcement personnel. This breach was a result of vulnerabilities in the software system that allowed unauthorized access to sensitive information [6214].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in this case is malicious. The incident involved a hacking collective known as Lulz Security (LulzSec) successfully hacking into the computer files of an Arizona law enforcement agency. They claimed to have released private intelligence bulletins, training manuals, personal email correspondence, names, phone numbers, addresses, and passwords belonging to Arizona law enforcement officers. The hackers specifically targeted the Arizona Department of Public Safety due to their opposition to the state's immigration enforcement law. The incident resulted in officers being inundated with calls, personal information being exposed, and the need for additional security measures to protect the compromised computer system [6214].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident was related to poor_decisions. The Lulz Security hacking collective specifically targeted the Arizona Department of Public Safety due to the state's tough immigration enforcement law known as SB1070 and the racial profiling anti-immigrant police state in Arizona. They claimed to have hacked into the computer files of the law enforcement agency, releasing private intelligence bulletins, training manuals, personal email correspondence, names, phone numbers, addresses, and passwords belonging to Arizona law enforcement [6214].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident in this case can be attributed to development incompetence as it was caused by the hacking activities of the Lulz Security group. The group successfully hacked into the computer files of an Arizona law enforcement agency, leading to the release of sensitive information such as intelligence bulletins, training manuals, personal email correspondence, names, phone numbers, addresses, and passwords belonging to Arizona law enforcement officers [6214]. (b) The software failure incident can also be categorized as accidental, as the breach and release of sensitive information were not intentional actions by the law enforcement agency but rather a result of the hacking activities of the Lulz Security group. The agency was not deliberately seeking to expose their data but became victims of a cyber attack [6214].
Duration temporary The software failure incident reported in the article is temporary. The incident involved the hacking of the Arizona Department of Public Safety's computer files by the Lulz Security hacking collective. The breach resulted in the release of private intelligence bulletins, training manuals, personal email correspondence, names, phone numbers, addresses, and passwords belonging to Arizona law enforcement officers [6214]. The incident caused DPS officers to be inundated with calls, prompting some to change their phone numbers to mitigate the impact of the breach. Additionally, the Maricopa County Sheriff's Office took unspecified countermeasures to protect its computer system, and the FBI's Phoenix division was aware of the situation but couldn't comment on whether they were investigating it [6214].
Behaviour crash (a) crash: The software failure incident in the article can be categorized as a crash. The Arizona Department of Public Safety's computer system was breached by the Lulz Security hacking collective, leading to a situation where DPS officers were inundated with calls, had their personal information exposed, and were experiencing disruptions in their communication devices like phones and emails. This disruption in the system's functioning and the loss of control over the officers' personal information align with the characteristics of a crash [6214].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property (d) property: People's material goods, money, or data was impacted due to the software failure The software failure incident involving the hacking of the Arizona law enforcement agency by the Lulz Security hacking collective resulted in the release of "hundreds of private intelligence bulletins, training manuals, personal email correspondence, names, phone numbers, addresses, and passwords belonging to Arizona law enforcement" [6214]. This breach of sensitive information directly impacted the property of individuals whose personal data was exposed, potentially leading to financial or identity theft risks. Additionally, officers mentioned receiving numerous calls and emails, indicating a disruption in their personal communication channels, which could be considered an impact on their property in terms of privacy and security.
Domain government (a) The failed system was related to the government industry as it targeted the Arizona Department of Public Safety and law enforcement agencies in Arizona [6214].

Sources

Back to List