OPM Hackers Said to Have Access to 19.7 Million Background Clearance Forms | James Comey, FBI chief, says his own info was hacked in OPM breach; it was 'enormous' - Thursday July 9th, 2015 at 3:53 PM

» Feds: Over 21 million affected by OPM hack - CBS News
09/07/15 16:55 from opm hack - Google News
CBS News Feds: Over 21 million affected by OPM hack CBS News They did, however, say that the separate incidents were perpetrated by "the same actor moving between different networks." The "adversary" responsible for t...

» OPM says second hack affected more than 21M Americans - USA TODAY
09/07/15 16:44 from opm hack - Google News
USA TODAY OPM says second hack affected more than 21M Americans USA TODAY However, that number did not include the victims of a second separate, but related, hack into the background check forms of people applying for jobs that required ...

» OPM hack: 21 million people's personal information stolen, federal agency says - The Guardian
09/07/15 16:41 from opm hack - Google News
The Guardian OPM hack : 21 million people's personal information stolen, federal agency says The Guardian Sensitive information including social security numbers concerning more than 21 million people was stolen last month when the O...

» OPM hack hit over 25 million people - The Hill
09/07/15 16:40 from opm hack - Google News
The Hill OPM hack hit over 25 million people The Hill The total includes 21.5 million people whose senstive data was taken in a breach of the OPM's security clearance database, as well as 4.2 million government workers whose personne...

» The Massive OPM Hack Actually Hit 25 Million People - Wired
09/07/15 16:28 from opm hack - Google News
The Massive OPM Hack Actually Hit 25 Million People Wired The massive hack that struck the US Office of Personnel Management affected some 25 million people, about 21 million of whom had information stolen about them from a backgrounds i...

» More Than 25 Million Affected by OPM Hack - Roll Call (blog)
09/07/15 16:09 from opm hack - Google News
Roll Call (blog) More Than 25 Million Affected by OPM Hack Roll Call (blog) In a statement released Thursday, OPM indicated that if an individual underwent a background investigation in the year 2000 and afterwards, it is “highly likely”...

» OPM: 21.5 Million People Affected By Background Check Breach - NBCNews.com
09/07/15 15:37 from opm hack - Google News
NBCNews.com OPM : 21.5 Million People Affected By Background Check Breach NBCNews.com The investigation into the hacks concluded that the second breach, which targeted background investigation records kept by OPM , included Social Securi...

» OPM Announces More Than 21 Million Affected by Second Data Breach - National Journal
09/07/15 15:34 from opm hack - Google News
National Journal OPM Announces More Than 21 Million Affected by Second Data Breach National Journal OPM says 1.1 million compromised files included fingerprints. Beyond the fingerprints and Social Security numbers, some of the files in t...

» 22 Million Affected by OPM Hack, Officials Say - ABC News
09/07/15 15:30 from opm hack - Google News
ABC News 22 Million Affected by OPM Hack , Officials Say ABC News The U.S. agency burglarized by suspected Chinese hackers has completed its long-awaited damage assessment: In total, more than 22 million people inside and outside governm...

» US Sharply Escalates Number of Files Exposed in OPM Hack - Wall Street Journal
09/07/15 15:28 from opm hack - Google News
Wall Street Journal US Sharply Escalates Number of Files Exposed in OPM Hack Wall Street Journal The news raises the stakes for the hack and its impact. Previously, OPM officials had said 4.2 million personnel files had been potentially ...

» Hack of security clearance system affected 21.5 million people, federal ... - Washington Post (blog)
09/07/15 15:21 from opm hack - Google News
Hack of security clearance system affected 21.5 million people, federal ... Washington Post (blog) That is in addition to a separate hack – also last year — of OPM's personnel database that affected 4.2 million people. That number wa...

James Comey, FBI chief, says his own info was hacked in OPM breach; it was 'enormous'

Thursday July 9th, 2015 at 3:53 PM

1 Share

The White House is expected to announce that the cyberhack into the Office of Personnel Management allowed a government adversary to obtain data on “millions and millions” of government background records, some that date back to two decades, Federal Bureau of Investigation Director James Comey told lawmakers Wednesday.

That adversary, likely Chinese hackers, were also able to gather a “huge amount of data” during the “enormous breach,” Mr. Comey said during a U.S. Senate Select Committee on Intelligence hearing.OPM has said 18 million or more Social Security numbers may have been exposed.

The data breach uncovered the information from everyone who applied for federal employment using a Standard Form 86, known as an SF-86, over the span of two decades — including Mr. Comey’s SF-86 forms that detail answers to questions such as bankruptcy, drug use and exposure to foreigners.

“I’m sure the adversary has my SF-86 now,” Mr. Comey said. “My SF-86 lists every place I’ve ever lived since I was 18, every foreign travel I’ve ever taken, all of my family, their addresses. So it’s not just my identity that’s affected. I’ve got siblings. I’ve got five kids. All of that is in there.”

That extensive SF-86 delves into the personal records, relationships and foreign exchanges that a government employee has made over the course of his or her life. So the numbers of cyberhack victims are expected to “quickly grow far beyond the number of federal employees, which is millions,”Mr. Comey said.

“It is a huge deal,” he said.

Since the data breach became public, several senior White House officials “have been in touch” withOPM Director Katherine Archuleta and other top managers, said White House Press Secretary Josh Earnest.

OPM personnel are now in the process of instituting additional network security precautions, which include restricting remote access for network administrators and restricting network administration functions remotely. Those precautions include deploying anti-malware across to protect and prevent the deployment or execution of tools that could compromise the network, according to the statement.

Obama administration officials became aware of the stealthy data breach in April and immediately launched an investigation into the breach along with the FBI and Department of Homeland Security. By May, administration officials had realized that an adversary of the U.S. government had obtained the background records of about 4 million federal employees.

Read the whole story

· ·

OPM Breach Was Enormous, FBI Director Says

Thursday July 9th, 2015 at 3:51 PM

1 Share

WASHINGTON—Federal Bureau of Investigation Director James Comey said Wednesday the White House soon will announce that “millions and millions” of government background investigation records—dating back 20 years—were stolen by hackers who broke into the Office of Personnel Management’s network.

Mr. Comey, describing the theft as an “enormous breach” during testimony before the Senate Intelligence Committee, said his own personal information was stolen as part of the intrusion, which Director of National Intelligence James Clapper has said likely was carried out by Chinese hackers. Chinese officials have said they weren’t involved.

“It is a very, very big number,” he said of the number of Americans whose data was stolen. “It is a huge deal.”

OPM officials did not respond to requests for comment.

Mr. Comey said the theft covered background investigation records over more than 20 years, and he said that those impacted include references listed by applicants, family members, and others whose personal information was contained on each background investigation form.

OPM has acknowledged that hackers had access to packets of information called the Standard Form 86, or SF-86, which is more than 100 pages long and lists numerous personal answers to questions touching on past drug use, bankruptcy records and contacts with foreigners.

The personnel agency has not so far identified how many people could have been impacted by the breach, though they said it could have included 18 million or more Social Security numbers.

The FBI is one of several agencies investigating the breach.

Also Wednesday, Department of Homeland Security Secretary Jeh Johnson said in a speech that U.S. officials “are simply not prepared at this point to identify who” carried out the attack. But he also said, speaking generally, that officials often consider a “proportionate” response to cyberattacks carried out by other countries.

“I don’t know that we necessarily need to put the label ‘act of war’ on something in order to respond proportionately to it,” he said. “But I do believe proportional responses are appropriate.”

Write to Damian Paletta at damian.paletta@wsj.com

Read the whole story

· ·

OPM Hackers Said to Have Access to 19.7 Million Background Clearance Forms

Thursday July 9th, 2015 at 3:48 PM

1 Share

WASHINGTON—Hackers who broke into the U.S. Office of Personnel Management’s computer network had access to 19.7 million background investigation forms, people familiar with the matter said, potentially stealing decades of security-clearance applications.

Hackers had access to an even greater number of Social Security numbers, these people said, because personal data from spouses and children are listed on the Standard Form 86 that many federal employees and contractors must complete before they can be hired for sensitive government jobs. Those forms are held often in an unencrypted fashion on OPM’s computer networks.

OPM Director Katherine Archuleta had previously acknowledged there were as many as 18 million background clearance forms being stored at OPM, but said several weeks ago it was unclear how many had been accessed. These forms contain records of past drug use, mental health and contacts with people overseas that could prove useful for a foreign intelligence agency.

The news raises the stakes for the hack and its impact. Previously, OPM officials had said 4.2 million personnel files had been potentially compromised. These largely contain less sensitive information, such as performance reviews, although they also include social security numbers. Hackers broke into OPM’s network sometime in 2014 though the breach wasn’t discovered until April of this year.

Multiple U.S. officials have said they believe the breach was carried out by Chinese hackers, though Chinese officials have denied involvement. White House and OPM officials didn't return multiple requests for comment on Thursday.

Write to Damian Paletta at damian.paletta@wsj.com and Danny Yadron at danny.yadron@wsj.com

Lessons from the OPM Hack

Thursday July 9th, 2015 at 3:26 PM

Net Politics

1 Share

 A U.S. Senate Intelligence Committee staff member enters the committee's offices with a secure case on Capitol Hill in Washington, D.C. on July 31, 2014. (Jonathan Ernst/Reuters).

Brandon Valeriano is a Senior Lecturer at the University of Glasgow, and recently published Cyber War versus Cyber Realities on Oxford University Press. Stephen Coulthart is a Senior Lecturer in the National Security Studies Institute at the University of Texas at El Paso.

It has almost been a month since the Office of Personnel Management (OPM) infiltration was made public and shockwaves of the hack reverberates in Washington, D.C. and beyond. In response, officials have shut down the E-QIP background investigation system. Security and privacy professionals seem united in their demands that OPM director Katherine Archuleta be held accountable for the security lapses in the organization. Commenter after commenter diagnoses the problems in our systems, institutions, and infrastructure, demanding accountability and change. While we continue to extract negatives from the story of the OPM hack, three lessons emerge that might give us hope for a secure future.

Lesson #1: Security is not assured in digital systems 

The incident should remind us that every networked system is vulnerable. Cyber espionage is a reality and a problem every institution will have to deal with. The events of the last few months only make this clear as the U.S. government officials admitted the State Department was hacked, which then led to an intrusion that even included some of Obama’s personal emails. The Syrian Liberation Army hacked the mil.gov website and public relations portal. Of course, to top it off, records for 4 million (or possibly many more) federal workers were stolen from the OPM, likely by the Chinese. Included in this massive amount of information is the background form that every employee who seeks secret clearance must fill out and includes some of the most intimate details about one’s personal life.

Searching for someone to blame is not really the answer. Rethinking what is available and networked is since the Internet was never designed with security in mind. Yet we continue to trust it with our deepest and darkest secrets. Once the vulnerabilities and the weaknesses of our systems are made clear, we can move forward with fixing the problems and altering the nature of how we share information. The simple conclusion is that we have entered an era of cyber espionage, not necessarily cyber war.

Lesson #2: U.S. human intelligence will need to adapt to the digital age

Some have gone so far as to call the OPM hack a greater national intelligence failure than the Snowden affair. Make no mistake, the hack was large and comprehensive, but we also must move beyond the spy fantasies that pervade analysis of the OPM hack. The typical story is that this information could be used as a stepping stone to siphon off state secrets. Using cheap and available data mining tools similar to the NSAs’, the opposition could use the information to build a profile of individuals susceptible to blackmail, such as a federal employee with a history of extra-marital affairs and ties with the Chinese nationals, information all in the SF86 form were  stolen. Once identified, these targets could be subject to honeytraps, a threat that MI5 has previously warned about in other contexts.

Whatever the Chinese do with the data, not all is lost. As Knake writes “I don’t think we are giving the CIA enough credit here, but if it’s true, the harm can be mitigated since we know what data was lost.” For example, while it may now be very difficult to establish cover for an agent already working in intelligence system, this does not prevent the intelligence community from hiring new agents or converting current government employees who have not requested security clearance into assets in the future. The U.S. has not lost all of its HUMINT capabilities because of the hack and information leak, but it will need to adapt to take into account OPM-style attacks in the future.

Lesson #3: The main vulnerability to security systems remains external to U.S. government networks

The perpetrators hacked the OPM by stealing the credentials of an outside contractor. There are things being done to increase security in U.S. government systems, yet vulnerability will remain through external contractors with access, like Edward Snowden. This is why it is important do more than monitor systems constantly, we must hunt those who already have access and are using it maliciously, or those that might do in the future, as Richard Bejtlich advises.

The deeper need is to rethink how we store critical information. That the director of the OPM described their systems as a “hackers dream” in November 2014 should give us pause and rethink our reaction to this latest violation and the need for basic cyber hygiene. There is a collectiveincompetence in the digital security management of the United States that needs to be rooted out. Merely hiring a new computer security manager for the OPM will not fix the deeper problem of failing to understand the security needs of our infrastructure.

At the strategic level, the exploit of OPM’s four million records means very little. It has not and will not change how the United States conducts the business of foreign policy, but the entire intelligence community needs reevaluate how it might conduct its mission. It is important to keep the real issue of cyber espionage in mind as we debate the future of conflict. Our current focus on war in an era ofdramatic peace can be counterproductive if we do not first focus on the defense and protecting our networks from exploitation. These continued attacks reinforce the point that our security starts with reforming how we protect information.

CFR seeks to foster civil and informed discussion of foreign policy issues. Opinions expressed on CFR blogs are solely those of the author or commenter, not of CFR, which takes no institutional positions. All comments must abide by CFR's guidelines and will be moderated prior to posting.

Read the whole story

· · · · ·

Congress all but powerless to block Iran deal - Burgess Everett