China's HUMINT operations against defense contractors in full swing

https://news.clearancejobs.com/2017/06/23/chinas-humint-operations-against-us-defense-contractors-uncovered/

by burgessct • 9 years ago

83 40 9 years ago

news.clearancejobs.com

Yep. We're getting more and more briefings, and training in avoiding social engineering, and opening ourselves up to making terrible mistakes with classified information.

tuxxy2• 9 years ago

Mind sharing some of the tips/practices for those of us interested in keeping our OPSEC and PERSEC up to par?

DaiPlusPlus• 9 years ago

Nothing new - I imagine - this internal NATO video from the 1960s seems just as relevant today: https://www.youtube.com/watch?v=0loanNljuZQ for example

andai• 9 years ago

You missed the opportunity to say "keeping our OPSEC and PERSEC up to spec" :)

jgome2• 9 years ago

Of course you are, the whole security industry is based on spreading fear, uncertainty, and doubt... And that makes it very profitable.

ghaff• 9 years ago

So are you suggesting that there's nothing to worry about and that everyone should carry on as if the threat environment hasn't changed?

bitexploder4• 9 years ago

Some folks in our industry do use exploitative sales tactics, but that is not fair blanket statement. Services like preventing phishing, for example, are a big deal and I don't think I have to convince anyone it is a real threat. Most of us just use honesty about actual risks, not FUD. Just making people aware of security as a concern, from HR to developers can have a big impact and mitigate real risks.

mark_l_watson• 9 years ago

I am all in favor of more training for avoiding social engineering attacks, stronger encryption and security for all devices and networks, and generally making digital systems as robust as possible - and then keep investing resources in these hardening activities.

The really sad thing is that so many people, including my congressional representative who I contacted on this subject, just don't get it: securing our systems is on par with fighting terrorism and conventional defense capabilities, and should receive the same resource allocations.

It goes without saying, but I will say it anyway: encryption backdoors will severely weaken efforts for economic growth and for defense.

Buge• 9 years ago

How is this relevant to the article? The article never talks about social engineering, computer security, encryption backdoors, or terrorism.

crb002• 9 years ago

Clearance Jobs is a subsidiary of DICE in Urbandale. Chad Thompson their devops guru is good people.

alasdair_• 9 years ago

From the domain name, I assumed it was a joke, like "SALE! Crappy jobs no one else wants - now on clearance!

walshemj2• 9 years ago

That's indeed :-)

chiph• 9 years ago

The classic motives for spying go by the acronym MICE - Money, Ideology, Compromise, and Ego.

https://en.wikipedia.org/wiki/Motives_for_spying

Money - honestly, the spy agencies never really paid all that well. John Walker got a couple thousand a month from the KGB. If you're spying for cash, frankly you'd be better off getting a second job.

Ideology - This is probably where younger people who didn't grow up in the Cold War era are vulnerable. "But they're our friends now, right?" Nation-states have interests, not friends.

Compromise - Make sure you're not in a position to get blackmailed. If you do get blackmailed, work with the security people.

Ego - Maybe a period of introspection could help?

civilitty• 9 years ago

Money is mostly used to compromise civilians who are in debt as that pressure makes them more vulnerable, especially if it's debt to organized crime. A common tactic is to give desperate people a medium chunk of cash to do something minor that the handler can still spin as treason afterwards, which then hooks the informant and allows the handler to pay him relatively small amounts until they are burned. Money doesn't work as well because the people in a position to command large bribes usually have emotional connections that money can't overcome (but M+ICE sometimes can).

I don't know many details about the CIA's black budget but I'd imagine it can be used to quickly gather hundreds of thousands or millions of dollars for especially promising informants.

bitexploder4• 9 years ago

Your credit is checked when you get a clearance. The higher level clearances have stricter requirements. It doesn't prevent people from being bribable, but it seems like a sound defense measure.

arthur_trudeau• 9 years ago

Defense contractors are more prominent, but I would be astonished if they were not heavily targeting generic US tech firms as well, especially those involved with key infrastructure components and services.

This becomes a lot easier when a fifth or more of their employees are Chinese nationals.

gruez• 9 years ago

fifth or more of their employees are Chinese nationals.

Chinese nationals, or ethnic Chinese?

angry_octet4• 9 years ago

The obvious consequence of the hack of the Office of Personnel Management. All the details of all clearance holders, including the background investigation into their personal lives, finances, psych evaluations, etc.

Overall a bigger disaster than the Snowden leaks, but it was too embarassing to explain. No one got punished for letting it happen.

3pt141592• 9 years ago

I hate how this shit is even in computers at all, much less networked ones. Can we not just revert to using paper and folders and filing cabinets for stuff like this until hacking computers isn't so trivial?

kasey_junk4• 9 years ago

Are you suggesting that one of the largest HR depts. in the world revert to paper & filing cabinets? Can you imagine the massive cost of that? The efficiency loss? It would be staggering.

Governmental record keeping of this sort is literally one of the first uses for computers.

angry_octet4• 9 years ago

That would interfere with the insider threat detection program! Big data! AI!

There was a story a while back that the Russians had reverted to typewriters and paper files.

Paul-ish• 9 years ago

Kind of ironic. My understanding is that personal information is collected (in part) to weed out people who would have histories that make them susceptible to blackmail.

angry_octet4• 9 years ago

People who deploy to war zones (for 12 months), or get sent on rotations to Boringtown, Iowa, get sad, divorced, gambling habits, alcoholism. The military pretends that everyone has good Christian marital relations; getting divorced can be a career killer, and getting caught cheating also. It's a mess.

It turns out that none of those problems is a very good indicator of insider threat. Hardly anyone gets blackmailed, all the big ones were volunteers. But the paranoia gripping the military at the moment will cause crazy damage. Kind of like a bear being bitten by fire ants, slashing itself all over.

engi_nerd• 9 years ago

Aside from the obvious huge national security implications, this hack has been a pain in the ass on a personal level (the wife and I literally have a "days since someone tried to use our identity for fraudulent purposes" counter, it rarely gets above 30 days). We are both victims of the OPM hack.

vorg• 9 years ago

From where I dwell (China), this link comes back with

  Error 403 Access to this resource is denied
  Access to this resource is denied
  Guru Meditation:
  XID: 24445124
  Varnish cache server

Is this only available from certain places, e.g. the U.S.? If so, given the international nature of Hacker News and the .com domain, perhaps this should be labeled China's HUMINT operations against defense contractors in full swing (USA only).

China's HUMINT operations against defense contractors in full swing

Related Stories