PA Office of Open Records Blocks Google Drive Over Security, Uses Flawed ColdFusion

PA Office of Open Records: Questionable Use of "Security" to Deny Google Drive Access

When asked to submit files associated with appeals, the Pennsylvania Office of Open Records (OOR) has stated that it cannot access files on Google Drive due to “Commonwealth security protocols.” This policy raises questions, especially when considering the robustness of Google Drive’s security and the well-known vulnerabilities of Adobe ColdFusion, the platform used by the OOR. As Nathanial Byerly, Deputy Director, stated: “The OOR is not able to access any files on Google Drive due to Commonwealth security protocols.” This raises concerns about whether these protocols are genuinely about security or are being used to avoid processing appeals transparently.

Google Drive: Robust Security and Antivirus Protection

Google Drive is widely recognized for its strong security measures and comprehensive antivirus protections, making it one of the most secure cloud storage platforms available today. Here are some key security features of Google Drive:
1. End-to-End Encryption:
  - Google Drive uses Transport Layer Security (TLS) to protect data during transfer and 256-bit AES encryption to secure files at rest. This level of encryption is on par with industry standards for data protection and is widely considered highly secure.
2. Two-Factor Authentication (2FA):
  - Google Drive offers two-factor authentication, adding an extra layer of security by requiring not just a password, but also a second factor, like a code sent to a mobile device.
3. Advanced Threat Protection:
  - Google Drive uses advanced machine learning algorithms to detect and block phishing attempts and malware. Files uploaded to Google Drive are automatically scanned for viruses and malicious content, helping to prevent the spread of harmful files.
4. Regular Security Audits and Compliance:
  - Google undergoes regular security audits and is compliant with several international standards, such as ISO 27001, SOC 2/3, and GDPR. This makes Google Drive not only secure but also trustworthy in terms of data privacy and regulatory compliance.

Adobe ColdFusion: A History of Security Vulnerabilities

Adobe ColdFusion, in contrast, is notorious for its security vulnerabilities. Many cybersecurity experts consider ColdFusion a risky choice for web application development, mainly due to the following issues:

Frequent Vulnerabilities and Patching Issues:
- ColdFusion has a history of security vulnerabilities, with multiple critical patches released each year to address exploits that could lead to data breaches, remote code execution, and other serious threats. Many of these vulnerabilities arise from the way ColdFusion handles data inputs and session management.
Lack of Robust Security Features:
- Unlike modern web development platforms, ColdFusion lacks advanced security features like automatic encryption or built-in protection against SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF). These deficiencies can make ColdFusion applications easier targets for cyberattacks.
End of Support and Obsolescence:
- Older versions of ColdFusion are no longer supported by Adobe, meaning they don’t receive security updates, leaving them vulnerable to new exploits. Running unsupported versions poses a significant risk to any organization.
Cybersecurity Community Warnings:
- The cybersecurity community has consistently warned organizations about using ColdFusion due to its susceptibility to exploitation. It has been a common target for ransomware and other malicious attacks, especially when not properly maintained or updated.

Is the Commonwealth Hiding Behind Policy?

Given the robust security of Google Drive and the questionable security posture of Adobe ColdFusion, the Pennsylvania Office of Open Records’ refusal to access files on Google Drive raises concerns. The claim of “Commonwealth security protocols” seems inconsistent with the actual security landscape. Here are some critical points to consider:

Lack of Transparency: By avoiding Google Drive, which offers more secure and modern data protection standards, the OOR’s policy could be seen as an attempt to limit public access to information and avoid processing appeals efficiently.
Contradictory Practices: If the OOR is genuinely concerned about security, why is it continuing to use a platform like Adobe ColdFusion, which has a track record of significant security vulnerabilities? This contradiction suggests that the policy against Google Drive may be more about control over information flow than genuine security concerns.
A Need for Policy Re-Evaluation: The Commonwealth should reassess its security protocols to ensure they are in line with current cybersecurity best practices. Given the advantages of using secure, cloud-based platforms like Google Drive, maintaining such restrictive policies may be counterproductive to transparency and public trust.

Adobe ColdFusion and the .cfm Extension

The OOR’s submission page for appeals can be found at https://www.openrecords.pa.gov/Appeals/AppealForm.cfm. The “.cfm” extension in this URL indicates that the webpage is powered by Adobe ColdFusion. ColdFusion Markup Language (CFML) is used in web applications built on Adobe ColdFusion. Given ColdFusion’s reputation for security issues and the fact that the OOR relies on this platform, it raises additional questions about the validity of their security concerns regarding Google Drive.

Conclusion

The Pennsylvania Office of Open Records’ use of Adobe ColdFusion while citing “security” concerns about Google Drive is puzzling, if not disingenuous. The contrast in security capabilities between Google Drive and Adobe ColdFusion suggests that the OOR may be hiding behind outdated policies to avoid greater transparency and accountability. For a truly open and accountable government, these policies need to be re-evaluated to better serve the public interest.

Contact Information

For further information, please contact the Pennsylvania Office of Open Records Deputy Director:

Deputy Director
Nathanial Byerly
Office of Open Records
333 Market Street, 16th Floor
Harrisburg, PA 17101-2234

Phone: (717) 346-9903
Email: [email protected]

https://www.openrecords.pa.gov/Staff.cfm