Posted on 06/25/2015 3:00:24 PM PDT by markomalley
The total number of people affected by the cybersecurity attacks on Office of Personnel Management databases and the entire universe of information exposed to hackers remains unknown – one of the few concrete takeaways from a congressional hearing on Thursday, this week’s third public discussion on the massive security breach.
Hackers could have obtained a vast array of personal information, not just about federal employees, but about their friends and family members as a result of a breach related to security clearance information provided on the SF-86 questionnaire. That’s because applicants have to give federal investigators contact information for reference checks, a point that Sen. Joni Ernst, R-Iowa, raised during Thursday’s hearing. But OPM still is conducting a forensic analysis of who and what was affected in the background check breach, which was separate but related to the intrusion involving the personally identifiable information of 4.2 million current and former federal employees. The agency detected the attacks in April 2015 during cybersecurity upgrades, and informed the public in June.
On Monday, CNN reported that hackers may have stolen the personal data of as many as 18 million people from OPM records related to the security clearance breach -- a number that OPM Director Katherine Archuleta would not verify. But her testimony on Thursday indicated it could be less than 18 million, or, incredibly, even more.
“It is my understanding that the 18 million refers to a preliminary, unverified and approximate number of unique Social Security numbers in the background investigative data,” Archuleta said. “It is not a number that I feel comfortable at this time represents the total number of affected individuals. There may be an overlap between the individuals affected in the background investigation incident and the personnel file incident. We’re also trying to determine the individuals who haven’t had their Social Security numbers compromised but may have had other information exposed. I cannot yet provide a more definitive response on the number of individuals affected by the background investigation intrusion, and it may well increase from these initial reports,” she said on Thursday.
A June 24 Daily Beast report said that “a senior U.S. official confirmed that foreign hackers compromised the intimate personal details of an untold number of government workers. Likely included in the hackers’ haul: information about workers’ sexual partners, drug and alcohol abuse, debts, gambling compulsions, marital troubles, and any criminal activity.” On Thursday, Sen. Benjamin Sasse, R-Neb., asked Archuleta about the possibility that hackers were now privy to the sexual histories of applicants for top security positions in government.
“As those of us who’ve been through top secret background investigations know, they ask lots of questions about sexual history, relationships, associations, anything that could lead an individual to be coerced or blackmailed,” Sasse said. “Can you help us understand why this information would have been stored on OPM’s networks to begin with?”
Archuleta said that “it’s part of the background information that we do for the clearances, at very high levels for classified positions,” but that OPM is still trying to “understand how that data was saved” and whether intruders were able to access that information. “I actually don’t know what is stored in which files,” she told Sasse.
Lawmakers repeatedly asked whether Archuleta should remain in her post. The Office of Management and Budget’s Tony Scott, the government’s chief information officer, said Archuleta and OPM CIO Donna Seymour had his “full support,” and that the work the agency is doing now to ramp up its cybersecurity could serve as a model for what other agencies should do. He defended Archuleta and Seymour more than once during the hearing Thursday. “I think we need to be careful about distinguishing firestarters from firefighters in this particular case,” he said, indicating that he believed Archuleta and Seymour were in the firefighting camp.
OPM Inspector General Patrick McFarland, however, said he did not have confidence in the agency’s management when asked directly by Senate Homeland Security and Governmental Affairs Committee Chairman Ron Johnson, R-Wis. “I believe that the interest and intent is there,” McFarland said about management’s capabilities to prevent cyberattacks. “But based on what we’ve found, no.”
The IG this week released a “flash audit” criticizing OPM for its management of a $93 million IT modernization overhaul. McFarland said OPM hasn’t created a business plan for the project, and doesn’t have a dedicated single source of funding, which impedes transparency and raises questions over whether OPM can come up with all the money it needs to pay for the upgrades. He called the funding situation for the project “all over the board” and “sporadic.”
Archuleta said that all of the agency’s decisions on the IT overhaul were being “tracked” and “justified,” and that OPM is “working very closely with OMB.” Still, McFarland said his warnings about cybersecurity and IT project management had been ignored over the years, and that he didn’t “feel that their systems are secure at this point.”
Thursday’s hearing covered similar ground as the other congressional hearings held earlier this week, and unsurprisingly featured a few tense exchanges between lawmakers and witnesses, including one between Sen. John McCain, R-Ariz., and Archuleta.
McCain pointed out that the OPM director told one congressional committee this week that she did not believe anyone was personally to blame for the security breaches, but another panel that she held everyone at OPM responsible for the failure. “In other words, everybody’s responsible, so nobody’s responsible,” McCain quipped. The Republican grilled her over when the agency would inform the public about the extent of the potential privacy violations related to the security clearance breach, and how many people were affected.
Archuleta: “When I know that the number is accurate, then that is the time.”
McCain: “But you can’t tell us when?”
Archuleta: “When they bring me an accurate number, and I have confidence in that number.”
McCain: “Ms. Archuleta, I must say, I’ve seen a lot of performances. Yours ranks as one of the most interesting.”
If they have OPM, DOD and similar records, you can bet the have IRS, Social Security, Human Services, Homeland Security and DOL records, too. Which means everybody.
Sex lives? John Roberts, paging John Roberts.
I’m guessing that the reason no congressional hearings over this utter disaster have been scheduled is because too many of the management witnesses would look like The President and The First Lady.
What a mess
Any data on government computers is or will be, public.
There is no incentive to protect citizens.
If you do something untoward, do it under a pseudonym. It won’t stop a private or government investigator, but should stop hackers tying the identities together.
He never had to put in for a top secret, so it wouldn’t apply here.
But I could (sadly) envision this stuff just being outed in one big “embarrass America” cyber attack.
On Monday, CNN reported that hackers may have stolen the personal data of as many as 18 million people from OPM records related to the security clearance breach -- a number that OPM Director Katherine Archuleta would not verify. But her testimony on Thursday indicated it could be less than 18 million, or, incredibly, even more.
Witness protection files were hacked, according to Hugh Hewitt on today’s conversation with Mark Steyn.
Nails it right down, there.
They stopped asking lifestyle questions in the clearance process about 15 years ago.
Not sure what they’re talking about finding.
The TPP and TPA were under massive layers of security, such that it was almost impossible to get details about it.
The databases of almost all federal employees past and present for decades, and the lists of everyone with security clearance for the past few decades, has had all of their personal work history / financial / association information stolen. Because an administration saw no problem with Chinese nationals in China having ROOT level access to these databases.
This isn’t a matter of IT security per se; it is a reflection of what the government considers its priorities and what it doesn’t.
You have to report any compromising events, from drug use to affairs to any traffic offense over $150-$300 (I don’t remember which, but a speeding ticket I had where the idiot flagged the highway as a school zone exceeded that threshold).
Even if they don’t ask if you are homosexual or a swinger on the form, you are required as a condition of the clearance to REPORT it on the form. If they find out about it later, you lose the clearance, your job, your ability to get another clearance or sensitive position later.
I’ve seen people walked for having a drunk driving offense and not reporting it.
So you end up with a lot of personally incriminating and embarrassing information in the file, so that people can pass the background reviews every few years.
There was a court case recently reported from a leaked SF86 form about a guy who had an affair, but admitted it and that he had told his wife. The employer wanted to revoke the clearance, but the judge said he reported it, he isn’t doing it now, he keeps his job and clearance.
I’m sure there are hundreds of thousands of similar things in just as many files.
What the Chinese could do with this info:
* Blackmail almost anyone they want for information gathering purposes.
* Use the information to shape the actions and responses of anyone in a decision making position, whether an ambassador or a general. If we get into a physical war with China, they could pressure a military leader into making a different decision on the battlefield. If there is a trade negotiation, it becomes “give us these concessions or we ruin your life”.
* China now holds our financial system hostage. “If you threaten to default on the debt, or raise interest rates too high, we’ll use software and create fake credit cards in the identities of your 4 million aparatchiks and military personnel. Your financial system crashes, if you don’t do what we want.”
Amen to that.
No layer of security can defeat an individual with root access.
This is what did Sony in.
There should be a trusted federal employee, perhaps CIA level, to shadow every system admin action.
I've been granted tremendous access to personal data. It's common.
Then there's test systems.
Without thought, recent copies of systems are made available for testing to a wide group of people. However these systems have recent personal data also.
Theft is inevitable.
Security clearances (for DoD) are adjudicated using the guidelines in DoD 5200.2-R Appendix 8. (Other agencies have similar guidelines)
Investigators try to determine the answers to all of the issues in the above reference. It is perfectly reasonable to assume that the results of those investigations are held, particularly as investigations move from periodic investigations to "continuous monitoring." Here are a portion of the guidelines:
ADJUDICATIVE GUIDELINES
ALLEGIENCE TO THE UNITED STATES
An individual must be of unquestioned allegiance to the United States. The willingness to safeguard classified information is in doubt if there is any reason to suspect an individual's allegiance to the United States.
Conditions that could raise a security concern and may be disqualifying include:
- involvement in any act of sabotage, espionage, treason, terrorism, sedition, or other act whose aim is to overthrow the Government of the United States or alter the form of government by unconstitutional means;
- association or sympathy with persons who are attempting to commit, or who are committing, any of the above acts;
- association or sympathy with persons or organizations that advocate the overthrow of the United States Government, or any State or subdivision, by force or violence or by other unconstitutional means;
- involvement in activities which unlawfully advocate or practice the commission of acts of force or violence to prevent others from exercising their rights under the Constitution or laws of the United States or of any State.
FOREIGN INFLUENCE
A security risk may exist when an individual's immediate family, including cohabitants, and other persons to whom he or she may be bound by affection, influence, or obligation are: (1) not citizens of the United States or (2) may be subject to duress. These situations could create the potential for foreign influence that could result in the compromise of classified information. Contacts with citizens of other countries or financial interests in other countries are also relevant to security determinations if they make an individual potentially vulnerable to coercion, exploitation, or pressure.
Conditions that could raise a security concern and may be disqualifying include:
- an immediate family member, or a person to whom the individual has close ties of affection or obligation, is a citizen of, or resident or present in, a foreign country;
- sharing living quarters with a person or persons, regardless of their citizenship status, if the potential for adverse foreign influence or duress exists;
- relatives, cohabitants, or associates who are connected with any foreign government;
- failing to report, where required, associations with foreign nationals;
- unauthorized association with a suspected or known collaborator or employee of a foreign intelligence service;
- conduct which may make the individual vulnerable to coercion, exploitation, or pressure by a foreign government;
- indications that representatives or nationals from a foreign country are acting to increase the vulnerability of the individual to possible future exploitation, coercion or pressure;
- a substantial financial interest in a country, or in any foreign-owned or operated business that could make the individual vulnerable to foreign influence.
FOREIGN PREFERENCE
When an individual acts m such a way as to indicate a preference for a foreign country over the United States, then he or she may be prone to provide information or make decisions that are harmful to the interests of the United States.
Conditions that could raise a security concern and may be disqualifying include:
- the exercise of dual citizenship;
- possession and/or use of a foreign passport;
- military service or a willingness to bear arms for a foreign country;
- accepting educational, medical, or other benefits, such as retirement and social welfare, from a foreign country;
- residence in a foreign country to meet citizenship requirements;
- using foreign citizenship to protect financial or business interests in another country;
- seeking or holding political office in the foreign country;
- voting in foreign elections; and
- performing or attempting to perform duties, or otherwise acting, so as to serve the interests of another government in preference to the interests of the United States
SEXUAL BEHAVIOR
Sexual behavior is a security concern if it involves a criminal offense, indicates a personality or emotional disorder, subjects the individual to undue influence or coercion, or reflects lack of judgment or discretion. 1 (Sexual orientation or preference may not be used as a basis for or a disqualifying factor in determining a person's eligibility for a security clearance.)
Conditions that could raise a security concern and may be disqualifying include:
- sexual behavior of a criminal nature, whether or not the individual has been prosecuted;
- compulsive or addictive sexual behavior when the person is unable to stop a pattern of self-destructive or high-risk behavior or that which is symptomatic of a personality disorder;
- sexual behavior that causes an individual to be vulnerable to undue influence or coercion;
- sexual behavior of a public nature and/or that which reflects lack of discretion or judgment.
The other areas covered (you can see the character of things looked at by analogy from the above):
Generally the difference between types of investigations are based upon how hard the investigator looks for something...for example, for a National Agency Check, they'll just pull computer inquiries and that'll be it. For a Single-Scope Background Investigation, they'll do that plus pull records (to include medical records) plus conduct a whole bunch of interviews in an effort to validate or refute everything that was claimed on the investigation form.
Read the rest of the guidelines here.
This could prove entertaining. If someone like Wikileaks said they had sordid information about some politicians, it might ruin them politically, even if it wasn’t true.
That is, the credibility of the government is approaching zero, so even hackers, real or imaginary, have more credibility in the public’s eyes.
I don’t understand why it’s called a “hack”.
When one company or nation purchases another aren’t personnel files included?
>>”It is not a number that I feel comfortable at this time represents the total number of affected individuals. There may be an overlap between the individuals affected in the background investigation incident and the personnel file incident. We’re also trying to determine the individuals who haven’t had their Social Security numbers compromised but may have had other information exposed. I cannot yet provide a more definitive response on the number of individuals affected by the background investigation intrusion”
You know those computers that they took the information from? They can be used to tally these numbers. It’s amazing what you can do with computers these days. You should look into it.
So why aren’t any of the leftwing perverts ruined by this? 0vomit has a pretty well-documented and damning trail of perversion. There is plenty of innuendo about Hillary. We know for a fact that Bill is a perv.
Pick a lib, any lib. I’d give odds that you could find things much worse than the speeding tickets and parking violations they tout as damning evidence against conservatives.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.