Why the US federal employee record breach is worse than others

http://caseysoftware.com/blog/why-this-security-breach-is-worse-than-all-the-others-combined

by caseysoftware • 11 years ago

161 95 11 years ago

meesterdude5• 11 years ago

What a mess, but does highlight the fact that you know, when you gather a lot of information on people, you become a target. They really just do all the hard work, and make it easy for the criminals.

Obviously, a huge blunder of government, totally irresponsible and reckless that such a massive breach was even possible. And it happened in dec 2014, and they only just now found out. A team of amateurs could do better than that.

I know data security is hard, but maybe if the government spent money on proper protections of people's data instead of building data centers to spy on it's citizens, this wouldn't have happened. But it's clear that's not what their priorities are.

Really, just disgusted by this.

That said, what did they do wrong? what should they have done, that they didn't do? Getting hacked seems like an eventuality at some level. What can an organization do to protect such sensitive information, or at least reduce their exposure and the amount of data that is able to be leaked before detection?

Seems like you'd have to partition up your data at some level, maybe encrypt it at rest; but I don't know how far one has to go.

EthanHeilman3• 11 years ago

I know data security is hard, but maybe if the government spent money on proper protections of people's data instead of building data centers to spy on it's citizens, this wouldn't have happened.

The Gozer Principal: in Information Security you get to design the weapon that will be used against you [1]. Don't build a tool you are unwilling to hand to your greatest enemy.

For example what happens when foreign governments steal the domestic bulk surveillance data? I bet the NSA accidentally hoovers up all sorts of top secret information that is just accidentally sent over the wire or non-classified data that could do great damage to US interests. Or what happens when a foreign government gains access to the tools used to perform this bulk collection? They could inject fake traffic or hide traffic for strategic deception campaigns.

Collect it all is a strategically empty slogan, it represents a serious risk to US national security, but on the other hand it is a wonderful Rice Bowl [2] for the NSA.

What can an organization do to protect such sensitive information, or at least reduce their exposure and the amount of data that is able to be leaked before detection?

* Keep it offline/airgapped.

* Store the most dangerous data on paper with hashes replicated online to insure integrity.

* Delete information you don't need anymore.

* Do not have a centralized repository of data to reduce risk of catastrophic exposure.

There are always trade offs between usability, functionality and security.

[1] https://twitter.com/ethan_heilman/status/510993743156375552

[2] https://en.wikipedia.org/wiki/Iron_rice_bowl#Other_uses

meesterdude5• 11 years ago

Thank you for this. great write up, and totally on point.

* Keep it offline/airgapped.

Agreeable, but what about physical access? What about compromised individuals, or nefarious agents?

* Store the most dangerous data on paper with hashes replicated online to insure integrity.

Interesting; i guess that reduces the accessibility of the information, so it's harder for you and harder for someone else. Interesting, and in line with your comment about the Gozer Principal (is there anything more than a tweet about that?)

* Do not have a centralized repository of data to reduce risk of catastrophic exposure.

Also a great point too; and pretty contrary to how we typically design systems.

Thanks again!

munin2• 11 years ago

all of your points totally undermine the benefits of centralization and computerization. perhaps that is the point and that there are some things that should just not be digitized or made "easy to do," but security people also recognize that security is often not the end goal. creating a usable system where the reward outweighs the risk is the goal. if the reward, despite this risk/vulnerability, is still very high, then we'll probably keep doing it.

your points are what you would want to do if you wanted to make an ideally secure system, but nobody wants only an ideally secure system...

pdkl95• 11 years ago

when you gather a lot of information on people, you become a target

The uncomfortable truth for many HN readers is that this is also true for all of that user data that businesses are currently aggregating: from the data people trust an online service to manage to the modern version of "library records" we call analytics. Thee is value in all of this, or it wouldn't be worth paying to collect/store it.

Unfortunately, even if the data is collected with the best intentions, the fact that the database exists creates a target that must secured. It also creates an "attractive nuisance" for governments holding national security letters and PRISM. Those are troubling enough, but gathering data about people has another risk that is rarely addressed: moral hazard. There is always the temptation to sell that data to the highest bidder, which we have seen happen many times as businesses look to find new ways to "monetize" their users.

a3n3• 11 years ago

I suspect a lot of this data that's commercially collected, directly by services and indirectly by advertising and analytics networks, will eventually end up in the digital storage closet, forgotten and eventually discovered by criminals just rooting around. Especially after acquisitions.

zaphar• 11 years ago

For the sf-86 data it really should have been stored on an air gapped network, encrypted, with physical security. That type of data is far too valuable to leave connected to a publicly accessible network in any way.

guscost• 11 years ago

This is said with tongue in cheek, but they could have bought that CyFIR product a year earlier.

prmurphy• 11 years ago

Makes me wonder about their kind offer to centralize all our health records.

toomuchtodo• 11 years ago

I'd rather have my health records public than information that could be used to compromise my financial security, considering the US doesn't enforce squat against credit credit bureaus who provide blatantly false information.

GabrielF00• 11 years ago

FWIW, I recently had to get the records of a medical test that was performed when I was a teenager. All I had to do was fax the hospital a form with my date of birth, approximate year the test was done, and a signature, and they sent the records to me in the mail. Absolutely terrifying.

yenda• 11 years ago

yet really practical isn't it ?

radicalbyte• 11 years ago

I've been working in the industry for 6 months, and so far I've learnt that having a data-of-birth, post-code and surname is all you ever need.

..and that for twins, having the same post-code can be fatal..

spacko• 11 years ago

... names of neighbors and close friends.

Why for christs sake do they even collect this data in the first place? This is not a database on felons or potential terrorists ... why does the government care about the neighbours of their employees???

modeless3• 11 years ago

This is a database of potential Snowdens. The "intelligence community" is a strange, puritanical, paranoid sort of place. It wouldn't be so bad if it hadn't grown so preposterously large.

jbuzbee7• 11 years ago

Note that this is far larger than the "intelligence community". This would include everyone from janitors who empty the trash in secure facilities to accountants, to mechanical engineers who design pumps for nuclear facilities, to web designers who write database front-ends, etc, etc, etc. And to say all of these folks are "puritanical, paranoid" is a very limited viewpoint.

hollerith• 11 years ago

why does the government care about the neighbours of their employees???

I think that's so they can ask the neighbours questions.

jbuzbee7• 11 years ago

I've been through this multiple times. Basically they just come out to your neighborhood and ask your neighbors if they've noticed anything suspicious going on. Strange behavior, odd visitors, unexplained affluence, etc. Takes all of 5 minutes. If it were my job to vet people, I suppose I'd be doing the same sanity-checks to make sure I wasn't dealing with an unstable person: drug addict, wife-beater, etc.

gohrt2• 11 years ago

And then would you retain the details forever?

rayiner• 11 years ago

It's for security-sensitive positions. They ask questions to your neighbors about you to see if you're hiding anything.

Heck, just to apply to the bar I had to list eight character references plus a contact at every employer I've had in 13 years. It's pretty standard practice for trust-sensitive jobs to ferret out people who have something to hide or are lying on their application.

viraptor• 11 years ago

Different country, similar use case (clearance) - guy I worked with says a great way to get a proper fake identity is to assume one of a dead child from years ago when documentation wasn't as precise as it is now. (gives you a real, registered birth certificate) That's where family/neighbors information comes in - agency asks them and they say "sure, I remember, he died so young"...

jbuzbee7• 11 years ago

Well if this includes the entire SF-86 database, then I guess it includes me. And I realize there's nothing I can do about it, so I guess I'm not sweating. Life goes on. If it really was the Chinese behind it, then the data likely won't ever end up dumped on pastebin or wherever.

The SF-86 form gets very, very personal, so I can imagine that some folks will be panicked, but reading my form would be a yawner. Maybe I need to get out more :-)

caseysoftware4• 11 years ago

Can you say the same thing about the people they researched to validate your information?

Zigurd2• 11 years ago

If it really was the Chinese behind it, then the data likely won't ever end up dumped on pastebin

What if the calculation of both maximum effect and maximum deniability is exactly that: Create a shadowy, possibly composite hacker persona (a "Satoshi Nakamoto"), release a bunch of signatures and generate publicity, and then roll out the database, verifiable by the previously released signatures.

termain• 11 years ago

Is it the entire SF-86 database, including contractors? Or just government employees?

caseysoftware4• 11 years ago

OP here.

Everybody

The first sentence of the article I linked to: "The Chinese breach of the Office of Personnel Management network was wider than first acknowledged, and officials said Friday that a database holding sensitive security clearance information on millions of federal employees and contractors also was compromised."

leroy_masochist• 11 years ago

It's really bad. I was a Russian major and spent my junior year there. I subsequently went on to jobs in the military / IC that required an SCI clearance as well as a couple of additional SAP screenings.

I carefully listed the Russians I knew under penalty of perjury. I've lost touch with most of them. I wasn't trying to turn them into agents, and they were patriotic Russians who liked me despite, not because of, me being American. The fact that they might be getting FSB attention now is sickening.

The fucking government, man. It really blows your mind sometimes.

jacquesm6• 11 years ago

What on earth were you thinking?

To expand a bit on that: any job that requires you to list the names of random people that you've had contact with in the past should be avoided like the bloody plague, there is nothing that those people have done to warrant you putting their name into some form and subsequent database with unknown consequences for the people you decide to list.

They're not sheep to be offered up on the altar of your ambition to rise up in the ranks, absolutely nothing good could ever come for them. So if the penalty is perjury just walk, that way you don't perjure yourself.

jonwachob912• 11 years ago

Only they weren't random people, they were people he knew. And if you knew anything about getting a Clearance in the States a lot of it is based on how truthful you are on your SF-86 - List you use to be addicted to methamphetamine and you might still get a clearance, lie about that one time you smoked pot and you lose any hope of getting a clearance. It's done to smoke out any "snowdens" and "mannings" who are trying to get a clearance for things other than wanting a job. (Not that manning or snowden joined to leak intelligence, but many have tried and many have been rejected).

jbuzbee7• 11 years ago

The form actually asks uses terms like close, personal relationship so it not just listing random people. And to put the shoe on the other foot, what if it were your job to vet a person working on plans for a new nuclear reactor. Don't you think you'd like to know if the person had a college roommate from [insert hostile country here] and continues to maintain the relationship with visits, phone calls, etc? Maybe relevant, maybe not, but you'd be negligent not to check it out.

blackguardx• 11 years ago

This comment is over the top. The vast majority of people wouldn't think twice about listing foreign nationals they have had contact with. Maybe It shouldn't be like that, but it isn't like he turned their names over to the gestapo.

jdavis703• 11 years ago

This is pretty standard for even the most trivial of national security related background checks. They want to know that your associates are also legitimate.

6d0debc071• 11 years ago

On the other hand: If all the decent people refuse to work for broadly 'evil' organisations, the organisations are going to stay that way without there being anyone within them who might resist bad things.

bediger40002• 11 years ago

I agree. I've had Secret clearances at two different companies (aerospace/defence contractors). One of my lessons is that anyone who gets a clearance draws a lot of people into the process with them. It's a bad and creepy side effect, and even though this mostly involved college friends getting grilled by Federal Agents, I wouldn't do it again.

In fact, I'll go so far as to say that "clearances" are a symptom of the pathology of the security state. Lots and lots of highly cleared people have gone wrong (Pollard, Ames, Hansen, I'm sure there's more), so the process isn't really all that helpful. For a corporation, having "cleared" employees does two things:

1. It raises a huge barrier to entry for competitors. A smaller company just can't afford the specialized record keeping and record keepers, so only lumbering dinosaurs have cleared employees.

2. It means that the corporation can say, just like my kids, "I didn't do it!" as an excuse. An employee goes bad? The corporation didn't do it, because the Defense Investigative Security Clearance Organization cleared that traitor. It's yet another excuse to not have a relationship with employees, just like drug tests. Managers can just fill out forms, they don't have to know or like or have meaningful conversations with employees.

caseysoftware4• 11 years ago

OP here.

You don't list "random people" of any kind.

You list relatives, roommates, long term relationships, places you've lived, schools you've attended, and jobs you've had and then people who can confirm and validate those. Further - in regard to foreign nationals - you have to list and describe ongoing relationships and any foreign officials you've met.

This not "I was standing next to this guy at Starbucks" and closer to "I lived with, worked with, or dated with this person for X months."

a3n3• 11 years ago

I participated in a conversation a few years ago, where one person said "I've quit gmail, so I'm not worried about them collecting my data." Another person said "Yeah, but you correspond with a lot people who use gmail. So they're collecting your data anyway."

peterkelly• 11 years ago

I truly hope this will make all NSA employees that have worked on mass surveillance infrastructure come to understand the importance of privacy, and reconsider their participation in the similarly intrusive but far more large-scale crimes that their own organisation is guilty of.

gohrt2• 11 years ago

It would be fascinating if foriegn intelligence agents were to use this information against NSA agents in some way.

bediger40002• 11 years ago

How would we know if this happens? Any trials for espionage at that level are bound to have a lot of evidence under seal.

bsilvereagle• 11 years ago

It would be fascinating for American citizens to be attacked (cyber or otherwise) because they work for the federal government and another branch of that government messed up and allowed this database to be breached?

jacquesm6• 11 years ago

The more likely way in which this will be used is by targeting those abroad who have been in contact with the US intelligence community. A bit like what they accused wikileaks of doing with the cablegate release.

tombrossman• 11 years ago

First thing to pop in to my head after reading your comment is this Upton Sinclair quote: "It is difficult to get a man to understand something, when his salary depends on his not understanding it."

It's a bit like wishing slaughterhouse workers would start to consider the animal's feelings and spend more time thinking about them.

I hope so too, just like I hope I get to fly around in a UFO because that would be pretty cool. Not really expecting that to happen though.

borski• 11 years ago

They collect the info in order to obtain anything a foreign operative could use to blackmail you. The kicker? OPM also stores the results of the Polygraphs. Were they accessed? I don't know.

GizaDog• 11 years ago

Im sure there was a USB backdoor open somewhere. So who's fault is it if the US can't protect its own data? Blame others! That seems to be the way they operate!

protomyth• 11 years ago

Perhaps if the press had actually reported on the Department of Interior's antics[1][2] surrounding Cobell v. Salazar[3][4], we could have brought to public a discussion of our governments handling of sensitive data. A whole department was removed from the internet[5], should have been a wake up call for data handling. I don't remember it being covered in the tech press of the time.

1) http://www.internetnews.com/bus-news/article.php/1562181/Cou...

2) http://www.indianz.com/News/show.asp?ID=pol01/1262001-1

3) https://en.wikipedia.org/wiki/Cobell_v._Salazar

4) http://fcnl.org/issues/nativeam/chronology_of_the_department...

5) This also for a time included all Native American colleges including those that were buying their own line and charted by the tribe and not the BIA. It left students without access to distance learning classes and research beyond small libraries. It was hellish on students.

slyrus• 11 years ago

"These days it's all secrecy and no privacy"

gmuslera• 11 years ago

NSA security breach was several orders worse. Instead of getting all the sensitive information of 4 million US citizens with some ties with their government, it got sensitive information of 4 billion world citizens, and keep getting it because the backdoors, mass information collection, network interception and so on is still running. The elephant in the room is not just big, but pretty smelly too.

sandycheeks• 11 years ago

I have been watching this unfold wondering if any of the data compromised was part of the Personnel Reliability Program.

https://en.wikipedia.org/wiki/Personnel_Reliability_Program

Has anything been said about this?

DennisP• 11 years ago

I'm wondering whether this information could make it easier to accomplish significant social engineering hacks.

Animats• 11 years ago

This is a huge breach, and it will have repercussions for a generation. Nobody thought of the Office of Personnel Management as security critical. Previously, OPM has been criticized for not being computerized enough. OPM exists as a unit to centralize personnel records across agencies, all of which once had their own systems. Their retirement operation is still paper-based and located in a mine in Pennsylvania.[1]

Apparently, they succeeded in centralizing security clearance data. Then, of course, it had to be made available to all the security agencies. Remember the demands after 9/11 for "tearing down the walls" between the law enforcement and security communities? That means lots of people able to access databases in other agencies. Of course, people will want to access the data from the field on their mobile device.

[1] http://www.washingtonpost.com/sf/national/2014/03/22/sinkhol...

mpyne2• 11 years ago

Not just that, but how do these disparate government agencies verify that so-and-so checking into the local agency office is actually cleared for SECRET or TS or whatever?

They have to look it up somehow. That lookup will likely involve a computer database, and the pathway to reach that database will likely involve the Internet.

Practically all the rest of this sad story follows immediately, because the whole strategy of how the government handles computerized records in general is all screwed up.

Even after this I'm not sure it will get better... the trend in government is for inexorable centralization of related information. At the same time there's incredible demand to have those work-related systems available online and all the time, so that people can work while on duty travel, or from home.

Obviously there are technical things that can be done to mostly have our cake and eat it too (VPNs, redacted mirrors/views of the sensitive central database to be made available across the public Internet, etc.). But no one gets promoted in the government for doing that, and much of the talent is at Google or Facebook or Silicon Valley anyways :P.

alfiedotwtf• 11 years ago

Nobody thought of the Office of Personnel Management as security critical

This was the actual plotline of Skyfall.

a3n3• 11 years ago

Remember the demands after 9/11 for "tearing down the walls" between the law enforcement and security communities?

Maybe the solution is to have a smaller law enforcement and security community. Fewer components, better MTBF.

jbuzbee7• 11 years ago

OK - Anyone for a funny story regarding filling out an SF-86?

As part of the clearance process, your co-workers are interviewed regarding your work-habits, perceived integrity, etc. We had one woman, "Mary", in the office who was a bit of a busy-body, listening in on phone calls, other people's conversations, etc. One day she overheard another young woman, co-worker "Jane" talking on the phone regarding meeting her boyfriend John at the airport. In order to embarrass him, Jane and a friend were going to dress up like hookers, hang all over him etc. Only Mary didn't hear the whole story and became convinced that Jane was really involved in prostitution and was going to meet a John at the airport. So when investigators were working on Jane's clearance, Mary flat-out told them that Jane was a practicing prostitute on the side. I'm sure these investigators hear it all, but I can only guess that this was a memorable interview. Of course when the investigator confronted Jane with the accusation that she was a hooker, she flipped out. Mary and Jane's relationship was never quite the same after than..

devonkim• 11 years ago

A lot of investigators are completely incompetent and the job has one of the lowest pay of any cleared jobs out there. My investigator didn't realize I was male until he had interviewed a friend of mine and corrected him.

logn• 11 years ago

I don't get why this is a big deal. If the people don't have anything to hide, they shouldn't be worried. That they're so concerned is highly suspicious and indicative of loose morals. China is just protecting its national security and has a right to do so.

growupkids2• 11 years ago

I think you're missing the point, and would mind if we all went through your financial, medical and personal records. These records are made available to OPM under what are supposed to be strict privacy controls, because it's very very personal information. Everything from divorces, psychological counseling, drug history, you name it. You open up every secret in your life to scrutiny to demonstrate that despite all that you can be trusted. None of that is anyone's business, and it supposed to be protected and only available to a small number of people for a period of time to determine if you can be trusted.

Everyone has things in their lives they'd rather not have made public because it's nobodies business, and this compromise just betrayed the trust all those people put in the US government.

scintill76• 11 years ago

Grandparent post may have been parodying the "nothing to hide = nothing to fear" argument that's used to support ubiquitous surveillance etc.

Zigurd2• 11 years ago

The sheer number of people with clearances who are now at risk of blackmail and other untoward influence has everyone saying how terrible it is. OK. Obviously.

But what about the obvious fix: Pull clearances from everyone who does not need one. I mean really NEED. There are hundreds of thousands of schlubs with clearances only because the paperwork they have access to is classified higher than FOUO. And that classification is the product of self-importance and ass-coverage.

bsder• 11 years ago

And this, boys and girls, is why you DELETE valuable, sensitive information when you don't need it anymore.

But, deleting information might result in an error of commission which would have your signature on it rather than an error of omission which has no one readily blameable. So, no one in the organization will ever sign off on it.

andreyf• 11 years ago

Or you could archive it on an air gapped network and delete it from all systems connected to the internet. Seems like a relatively simple procedure that I imagine is in use all the time with sensitive data...

tdicola• 11 years ago

Doesn't this breach pretty much invalidate anyone who has ever had a security clearance? A bad actor who got ahold of the data could find people in sensitive positions and blackmail them with the sensitive information in their security clearance history. How can anyone be trusted going forward?

blazespin2• 11 years ago

If you have something you can be blackmailed over you can't get security clearance. The info, however, does facilitate identity theft and KBA type auth. It'd be easier to pose as someone who does have clearance, which undermines the system.

blazespin2• 11 years ago

This probably sounds very awful but part of me really really really hopes that the vulnerability at the source of this was caused by one of the NSA programs to undermine security. Maybe then the sheeple will wake the freak up.

justinsingh• 11 years ago

Fragile data such as this needs to not only be prevented from being stolen, but also needs to be of no use to a hacker even if it is stolen. Only then can we truly be robust to error.

mkramlich• 11 years ago

The flip-side of this story? Imagine what the NSA is doing. Imagine how much information the NSA is slurping up, on everybody, 24x7. Now... assuming their databases are an even more attractive target to hackers/criminals. Now assume that the folks who design/build/maintain/operate the NSA's are just as human as you and I, and therefore, are still prone to making just that one "oopsie" kind of mistake in their defenses. When that happens? All that data they slurp up falls into the hands of the hackers, criminals, people who mean you harm, etc.

Only part of the danger of what the NSA is doing due to the "what if government turns evil" scenario.

The other danger is the "what if hackers/scumbags/criminals get hold of it" scenario.

Only one of those scenarios has to happen, in order for it to hurt you. And the NSA has the very biggest pot of gold at rainbow's end, PII/fraud/blackmail-wise, of any of these systems to date. Contemplate that. Fear that. Take political action. Make day-to-day choices based on that.

janesvilleseo• 11 years ago

I sure this will put me on some list, but you are right. They have a ton of information. It's probably just a matter of time before they get hacked. The question is by whom and for what purpose. It would be interesting if it was done as an act of civil disobedience.

stox• 11 years ago

There was only one truly secure system, but then the Big Bang happened.

DonGateley• 11 years ago

Has any of this purloined information appeared anywhere or is there any evidence yet of it being used?

Why the US federal employee record breach is worse than others

Related Stories