• AnIndefiniteArticle@sh.itjust.works
      link
      fedilink
      arrow-up
      3
      ·
      2 days ago

      No!

      Not the victim’s fault. If anything it’s contradictory design goals of the two purposes of a badge.

      The primary purpose of a badge is for identification and authorization to enter a facility. When within the facility, the badge should be visible and prominently displayed so that security can identify you. When outside the facility, the badge should be tucked into your shirt and hidden so that federal employees can’t be tracked or easily identified.

      Badges are also used for auth in an IT setting. Laptop badge-reading dongles or slots are designed to be used at the facility. This means that the image of your face and agency logo and colored stripe corresponding to employee level (e.g. purple for intern) stick out and stay visible. You can still use your ID to prove you are in an appropriate location without removing it from your computer and thereby logging out of everything you were working on.

      Badge technology is designed around the assumption that you are working at a secure facility and should have the badge easily visible. People use their laptops at conferences or while visiting universities, and are easily identified as NASA center employees at a distance by their badge sticking out of their laptop. In spite of the fact that their badge is supposed to remain hidden when not in a secure facility, the devices are designed to display them proudly as if they were in a facility where that’s appropriate.

      Does that mean that no one should ever use their work computers when not physically at work? That’s the new guidance. Maybe that’s also a way to crack down on remote work and ensure people come in to an appropriate facility.

      Another solution that could work is to cover the dongle with a napkin so it isn’t visible when it doesn’t need to be. Maybe have a stealth-mode dongle for people who need to use their tech while on the go. Then the stealth-mode dongle wouldn’t be appropriate to use at a secure facility. Maybe have the stealthy ID guard be removable, against regulations to use at a facility (enforced by not letting you connect directly to a federal internet connection with the guard on), yet required to connect to the VPN for work outside of the facility without broadcasting your identity to everyone in the vicinity.

      Competing desires to be easily identified while in a secure facility, and to be able to operate with stealth while in public.

      This is a solvable problem, but it hasn’t been a problem in the past for someone to have their NASA badge and logo on display at a coffee shop.