Congress IT staffers, Imran Awan and his wife, Hina Alvi, were indicted for fraud on August 17, 2017, in the DNC scandal. Federal authorities suspect that sensitive U.S. Government data, possibly classified information, may have been compromised or even sold to hostile foreign governments. Awan’s lawyer, Chris Gowen, stated that his client had no “classified clearance for anything.” Therein lies the problem. How can a computer IT staffer without appropriate clearances have access to sensitive and classified data?
Separately, in the massive lottery fraud case, Eddie Tipton, a computer specialist and a former information security director at the Multi-State Lottery Association (MUSL), masterminded a scheme to rig lottery games. Over time, Tipton made more than $2 million from this scam. He secretly installed malicious software that allowed him to pick winning numbers and hit jackpots in Colorado, Kansas, Oklahoma and Wisconsin. How could this insider illicitly benefit from the blatant breach of his fiduciary responsibility?
As hacks and cyber security continue to grow as a concern across globally connected digital networks, it is important to consider the weak links lurking inside the nodes (companies, various entities) attached to the networks. These weak links include IT employees, third party contractors and computer specialists who have unchecked access to the sensitive information of such companies and entities.
The saga of the IT staffing/Awan family fraud started as a scandal involving the alleged theft of computer equipment from Congress. It has since evolved into a national security probe by the FBI. Federal authorities are investigating whether sensitive U.S. government data was stolen from congressional offices and sold to foreign agencies.
For more than a decade, Awan, his wife and his brothers Abid and Jamal worked as shared IT administrators for nearly 30 members of the U.S. Congress. They did not have security clearances, yet they had administrative access to sensitive information, emails and computer files of members of Congress and their staffers, including three members of the House Intelligence Committee and five members of the House Foreign Affairs Committee.
The Awan family billed Congress almost $5 million between 2004 and 2016. While still working as IT staffers for Congress, in November 2009, the family started a full-time car dealership in Virginia, with Abid Awan responsible for day-to-day operations. The dealership was called Cars International A, LLC, otherwise also referred to as “CIA.” Despite the earnings from IT services to Congress, Abid Awan declared bankruptcy in December 2010 by claiming losses of $1 million in the automobile business.
By February 2016, Capitol Hill Police began an investigation and quietly alerted the concerned members of Congress that there might be a problem. The authorities blocked the Awans from accessing the House computer network, and most Congress members stopped using their services thereafter.
The Awans allegedly removed hundreds of thousands of dollars of equipment from congressional offices, including computers and servers. Simultaneously they were running a procurement scheme in which they supplied equipment and overcharged the House administrative office. It is also alleged that the Awans obtained unauthorized access to the House of Representatives’ computer databases.
This case underscores a breakdown in the hiring and vetting process. The Awan family had a history of debt and bankruptcy. Abid’s records include multiple offenses for driving under the influence. His rap sheet included a DWI a month before he was hired as an IT staffer. The Awans had access to the IT systems of thirty-one members of Congress, including some with sensitive positions on the House Intelligence Committee and the House Foreign Affairs Committee. These IT staffers had unrestricted entry to the house computer network and in-turn to sensitive classified information, without the necessary security clearance.
Former lottery computer programmer Eddie Tipton, right, is taken into custody after his sentencing hearing, Tuesday, Aug. 22, 2017, at the Polk County Courthouse in Des Moines, Iowa. Judge Brad McCall sentenced Tipton to up to 25 years in prison for rigging a computer program to enable him to pick winning numbers in several lottery games over six years. (AP Photo/Charlie Neibergall)
For a decade, Eddie Tipton, the mastermind of the lottery scam, worked at the central Iowa office of MUSL, a government-benefit, and a non-profit organization. MUSL is operated by the 33 member lotteries, including multi-jurisdictional lottery games, such as Mega Millions and Powerball.
Tipton worked with a team of technicians entrusted to develop and maintain computer programs which are used to generate random numbers for the most popular lottery games in the U.S. He secretly added two extra routines to the computer code, thus enabling him to pick the winning numbers. As a trusted employee, he was promoted to the head of information security in 2013. Ironically, who would have known his new role placed him in charge of protecting the very computer systems that he had been rigging.
Over the years, Tipton provided the illicit winning numbers to others, who used them to win jackpots, and in turn received kick back as a share of the winnings. Investigators linked Tipton, his brother, Tommy, and a longtime friend, Robert Rhodes, to suspicious jackpot winnings in four states.
In December 2010, the jackpot-winning ticket for the Hot Lotto jackpot was purchased near MUSL headquarters. On behalf of a Belize trust, an attorney from New York state attempted to claim the jackpot of $14.3 million. However, later the trust decided not to pursue the claim to hide the identity of the primary purchaser. The Iowa lottery officials became suspicious of this mysterious attempt to claim the mega lotto prize. Based on the convenience store's video footage, the authorities determined that Tipton was the primary purchaser of the winning ticket, and in January 2015, he was arrested. In March 2015, his friend, Robert Rhodes, from Texas, was also arrested.
On August 22, 2017, Tipton was sentenced to 25 years in prison. He told the judge, “I certainly regret my actions. It’s difficult saying that with all the people behind me that I’ve hurt. I regret it, and I’m sorry.” District Judge Bradley McCall sentenced Tipton to the maximum penalty and stated that he is a “very intelligent and gifted man” who chose an illegal path largely out of greed.
These cases highlight a serious security breach issue. In the dynamic and growing digital world, massive amounts of data are being created, stored and processed globally by a multitude of entities: private corporations, government and non-governmental agencies and individuals. The computer professionals with administrative access to such data are a weak link in the system.
Brad Ulrich from Quandary Peak Research states, “It is often challenging for senior management to fully vet the IT professionals. Technical audits by external independent entities can give management the comfort of knowing that policies and systems are being followed.”
IT professionals and computer programmers, who hold the key to the digital vault, require stringent vetting, security clearance, and ongoing forensic monitoring. Institutions with sensitive digital information such as law enforcement, various branches of the government and financial institutions must implement robust compliance and governance procedures to mitigate risks and breach related to employee opportunism.
In this new data driven world, we need to guard against the digital gate-keepers who choose to abuse the fiduciary trust.
