Note: San Diego now has a line again like the other cities, although flatter, and the warning at the top of Greg’s lab page has been edited to say “Update: Apologies for the delay. Current data has been restored.”

Greg’s lab provides real-time “California radiation monitoring map”. I just noticed an update with a warning at the top of the main page:

Update: Data for some locations is currently being withheld by the EPA for review. Fresh data for the locations in question will begin to appear once the data is re-cleared for public release.

The access to raw data in some locations is currently unavailable for those who want to monitor time-critical information for radiation. San Jose monitoring stops on March 24th. Here is a graph for San Diego, which stops on March 23rd.

The page has two notes, one of which gives the following prediction:

Please be aware that, while there is evidence that traces of fallout from the damaged Fukushima Daiichi nuclear plant in Japan are arriving on U.S. shores, the contribution of these substances at the levels detected to your daily radiation dose is practically nil. The Department of Energy and the EPA continue to monitor the situation carefully, and there is no expectation that harmful amounts of fallout will reach the United States.

That being said, the line only runs for a few days and then stops on the same day that Japan’s nuclear catastrophe was put in a different light by European scientists monitoring data in California.

Austrian scientists have released what appears to be the first clear, independent data concerning radiation levels in the immediate aftermath of the Fukushima radiation leak.

By releasing data from two monitoring stations of the Comprehensive Test Ban Treaty Organization (CTBTO) from Japan and California, researchers from the Central Institute for Meteorology and Geodynamics in Vienna have calculated backwards to estimate the true levels of radiation from Fukushima.

[…]

…Gerhard Wotawa, the lead Austrian researcher, noted that because of the high volume of particles released only during the first four days of the leak, he speculated that further data would reveal an even higher total amount.

“The releases of the volatile radionucleotides, like iodine and cesium, are very likely in the same order of magnitude as happened during the Chernobyl accident,” he told Deutsche Welle, adding that CTBTO member states, like Austria, only received data 72 hours after it was gathered via e-mail and private websites.

Other scientists disagree with this prediction but not definitively. They all say there is a need to review more data. Meanwhile, Japan is reporting more serious leaks detected.

Earlier, officials from the plant’s operator said there was possible damage at reactor number three at the complex, meaning more radioactive contamination may have leaked into the environment.

“It is possible that the pressure vessel containing the fuel rods in the reactor is damaged,” a spokesman from Tokyo Electric Power Co (TEPCO) told the AFP news agency.

So why has the EPA withheld data after the scientists announce a need for more transparency? Are they trying to tune out noise or hide a weak signal to avoid more speculation about the direction it might be headed? Some are starting to use the graphs as a reason to be concerned. Maybe the EPA has found the graphs are too low and should show an increase — a warning? I have a feeling it’s not the latter.

I have to say this reminds me of a 2009 story about how the EPA handled data on arsenic, lead, mercury and boron pollution from coal power.

People who live near sites used to store ash or sludge from coal-fired power plants have a one in 50 chance of developing cancer, according to a just released government report kept from the public for seven years by the Bush Administration.

The data on harm was released after the 2008 Tennessee coal ash spill ignited greater public concern. Will the public demand real-time radiation monitoring be restored, or at least that the EPA better explain the reasons for withholding data?

Updated to add: Humorous view of data analysis from the Daily Show

Waves of heavy rains have been hitting the Sierra Mountains for weeks and recently caused a land slide in an area called Ferguson Slide (didn’t see that coming) on the Merced River near Yosemite National Park. The slide knocked down power lines, which gave authorities a reason to turn away visitors for most of this week. News10 from Sacramento has this report.

Interesting to see that the disaster plan for a National Park, of all places, is so frail that it is just an electrical pole (on a slide) away from shutdown. I can see why they might want to turn away 10,000 people a day who are there to consume energy rather than expend it, but what about the more independent and capable outdoor enthusiasts?

Seems to me a golden opportunity lost for the park to engage visitors who would really appreciate it without power and be willing to pitch in to keep it open. Some of those visitors might also help build a more resilient infrastructure including clean and local energy.

The LA Times points out an extremely high cost of line repairs.

“Mother Nature has flexed her strength with this series of storms,” said Nicole Liebelt, a spokeswoman for Pacific Gas and Electric Co. Crew members had to be brought in by helicopter to the remote area to work on the problem, she added. Company officials said they hope to have power restored by late Friday.

That has to have run past hundreds of thousands, added to the lost revenue from visitors turned away…what if it the same investment was put towards business continuity so the park was designed to operate without power for a week or even a month?

It looks like Luigi Auriemma did only a quick check of SCADA systems before he came up with a giant list of flaws. He has decided to post his initial findings to Bugtraq:

The following are almost all the vulnerabilities I found for a quick experiment some months ago in certain well known server-side SCADA softwares still vulnerable in this moment.

He points out in his post that he did not know anything about SCADA systems before the tests. Obviously that did not stop him from quickly finding many weaknesses.

Full-disclosure advisories and proof-of-concepts:
Siemens Tecnomatix FactoryLink:
http://aluigi.org/adv/factorylink_1-adv.txt
http://aluigi.org/adv/factorylink_2-adv.txt
http://aluigi.org/adv/factorylink_3-adv.txt
http://aluigi.org/adv/factorylink_4-adv.txt
http://aluigi.org/adv/factorylink_5-adv.txt
[…]

Open up factorylink_2-adv.txt and you will see the vulnerability levels can be very high — remote exploit.

CSService is a Windows service listening on port 7580.

All the file operations used by the service (opcodes 6, 8 and 10) allow to specify arbitrary files and directories (absolute paths) and it’s possible for an attacker to download any remote file on the server. Obviously it’s possible also to specify directory traversal paths.

First, to be fair, SCADA systems are often intended to live in a different world than other systems — single-user, single-role, etc. There may be a defense-in-depth or compensating control design to be considered that encapsulates a SCADA system. Langner talks about this some in his interview on Stuxnet. An unprotected CSService thus may have been built that way by design, to do one thing and do it well.

Second, I have found that critical infrastructure management can be dominated by a culture of data analysis. Staff are often told to punch holes into closed systems and environments to mine details needed for calculations. It can feel more like a financial firm trying to make real-time investment decisions than an engineering operation. Closed environments are under pressure to be opened in order for spreadsheets to run.

Third, the financially-focused managers boast about their speculation and risk-management skills. Yet they seem to rely more on faith than data analysis when it comes to risk relative to security controls. They raise defense-in-depth as a theory sufficient on its own instead of as a measured and managed practice to deploy controls more thoroughly. That usually means when you find a vulnerability like factorylink_2-adv someone will always emphasize my first point above and say “I believe that’s handled elsewhere.”

Putting the three above points together, the worlds of IT and SCADA are not nearly as separate and distinct as many want to believe. They must be managed to reflect this convergence or there is a risk of leaving gaps for attackers to exploit. Even worse, the depth of defense can go unmeasured and leave basic systems unprotected in environments exposed to high-risk multi-user threats.

That’s why Auriemma’s list should be taken seriously. Vendors need to secure their products, or at the very least test them for hostile scenarios and provide security warnings/guidance. The demand, however, really has to come from SCADA application consumers. I suspect that these full-disclosure vulnerability announcements will help improve the industry’s risk calculations — prove the value of paying for better security from the SCADA vendors. On the other hand, if management still does not get it, then regulations will probably have to tighten.