Your Response was posted! Click here to see it.
7
7
0
From: Computer World
--
Hi, my name is Steven J. Vaughan-Nichols and I had a security clearance in the 1980s. Because of that, my personal records are likely to have been revealed by the Office of Personnel Management hack.
Big deal, right? What could be so important about my 30-year-old records that it would matter to me today?
Oh, let me think. There’s my Social Security number, my birthday, my birthplace, everywhere I had lived for 10 years before I got my clearance, the full names of all my relatives — you know, everything you’d need to steal my identity.
Does that sound like I’m overstating the case? I’m not. When you get a security clearance, they want to know everything about your life.
Check for yourself. The current Questionnaire for National Security Positions form (SF-86) is 127 pages long. It asks for information on everywhere you’ve lived in the last 10 years, every job you’ve had for the last 10 years, and any visits to a healthcare professional for emotional or mental health conditions in the last seven years.
Then, of course, records checks may also be made on your spouse, roommates and immediate family members. Oh, and by the way, “immediate family” means your spouse, parents, step-parents, siblings, half- and step-siblings, children, stepchildren and cohabitants.
Except for the name of your first pet, the SF-86 pretty much covers every question you’ve ever been told you could use for your “security” question.
I understand why they ask those questions. What I don’t understand is why Congress never anted up the cash to encrypt those records or secure them in any meaningful way.
While I’m grousing about this, I’d also like to know why it appears that some OPM contractors may have been Chinese nationals — working from China.
You can’t make this stuff up. Who needs hackers, when the U.S. government will hire you to manage its top-secret goodies?
What’s that you say? It was only 4 million records? Oh no, my friend. It was at least 18 million. That’s 18 million former, current and would-be federal employees and contractors.
But, wait! It may be 32 million!
I’ve reason to believe it was at least that many. I just haven’t been able to get anyone on record with that number. But trust me, the OPM data breach is bigger and badder than anything else that’s ever happened.
Now, let’s think about the next steps. Clearly, the entire government personnel system will need to be cleaned up. There’s a bigger issue, though.
The U.S. currently has about 319 million citizens. Of those, 10% of them may have had their Social Security numbers revealed. Think about it.
Now, if China has all that information, it may not matter that much. Seriously, does Beijing care about my Social Security benefits? I doubt it.
But let’s say I held a sensitive government position and had a cousin living in Hong Kong. Then it would be a different story. In that case, I could foresee getting a call from a burner mobile phone telling me that if I’d like to keep my cousin safe, I might want to share a little information with someone.
Let’s say the hackers were run-of-the-mill crackers instead of a nation state. After all, a bright teenager could have broken into the OPM. If that’s the case, what’s to stop them from practicing identity theft on an epic level?
I’ll tell you what: nothing. The feds tried — and failed — to set a credit and identity protection plan. Eventually, they’ll get it right, but so what?
Ten percent of Americans may have had their identities permanently compromised. So, what are we going to do?
No one’s talking about that yet. But here are some real possibilities: 1) Junk our current Social Security numbers. 2) Bring back the much-hated idea of a national ID card. Or 3) Reauthorize every last person whose ID has been revealed and give them new Social Security numbers.
Any way you cut it, fixing this is going to take a minimum of tens of billions of dollars. Frankly, I wouldn’t be shocked if the bill ends up running into hundreds of billions. At the same time, no one is going to be happy with any of these solutions.
An ancient “ha-ha-but-actually-serious” computer joke goes, “To err is human, but to really foul things up, you need a computer.” That joke has never been more serious.
http://www.computerworld.com/article/2941754/data-security/opm-the-worst-hack-of-all-time.html
--
Hi, my name is Steven J. Vaughan-Nichols and I had a security clearance in the 1980s. Because of that, my personal records are likely to have been revealed by the Office of Personnel Management hack.
Big deal, right? What could be so important about my 30-year-old records that it would matter to me today?
Oh, let me think. There’s my Social Security number, my birthday, my birthplace, everywhere I had lived for 10 years before I got my clearance, the full names of all my relatives — you know, everything you’d need to steal my identity.
Does that sound like I’m overstating the case? I’m not. When you get a security clearance, they want to know everything about your life.
Check for yourself. The current Questionnaire for National Security Positions form (SF-86) is 127 pages long. It asks for information on everywhere you’ve lived in the last 10 years, every job you’ve had for the last 10 years, and any visits to a healthcare professional for emotional or mental health conditions in the last seven years.
Then, of course, records checks may also be made on your spouse, roommates and immediate family members. Oh, and by the way, “immediate family” means your spouse, parents, step-parents, siblings, half- and step-siblings, children, stepchildren and cohabitants.
Except for the name of your first pet, the SF-86 pretty much covers every question you’ve ever been told you could use for your “security” question.
I understand why they ask those questions. What I don’t understand is why Congress never anted up the cash to encrypt those records or secure them in any meaningful way.
While I’m grousing about this, I’d also like to know why it appears that some OPM contractors may have been Chinese nationals — working from China.
You can’t make this stuff up. Who needs hackers, when the U.S. government will hire you to manage its top-secret goodies?
What’s that you say? It was only 4 million records? Oh no, my friend. It was at least 18 million. That’s 18 million former, current and would-be federal employees and contractors.
But, wait! It may be 32 million!
I’ve reason to believe it was at least that many. I just haven’t been able to get anyone on record with that number. But trust me, the OPM data breach is bigger and badder than anything else that’s ever happened.
Now, let’s think about the next steps. Clearly, the entire government personnel system will need to be cleaned up. There’s a bigger issue, though.
The U.S. currently has about 319 million citizens. Of those, 10% of them may have had their Social Security numbers revealed. Think about it.
Now, if China has all that information, it may not matter that much. Seriously, does Beijing care about my Social Security benefits? I doubt it.
But let’s say I held a sensitive government position and had a cousin living in Hong Kong. Then it would be a different story. In that case, I could foresee getting a call from a burner mobile phone telling me that if I’d like to keep my cousin safe, I might want to share a little information with someone.
Let’s say the hackers were run-of-the-mill crackers instead of a nation state. After all, a bright teenager could have broken into the OPM. If that’s the case, what’s to stop them from practicing identity theft on an epic level?
I’ll tell you what: nothing. The feds tried — and failed — to set a credit and identity protection plan. Eventually, they’ll get it right, but so what?
Ten percent of Americans may have had their identities permanently compromised. So, what are we going to do?
No one’s talking about that yet. But here are some real possibilities: 1) Junk our current Social Security numbers. 2) Bring back the much-hated idea of a national ID card. Or 3) Reauthorize every last person whose ID has been revealed and give them new Social Security numbers.
Any way you cut it, fixing this is going to take a minimum of tens of billions of dollars. Frankly, I wouldn’t be shocked if the bill ends up running into hundreds of billions. At the same time, no one is going to be happy with any of these solutions.
An ancient “ha-ha-but-actually-serious” computer joke goes, “To err is human, but to really foul things up, you need a computer.” That joke has never been more serious.
http://www.computerworld.com/article/2941754/data-security/opm-the-worst-hack-of-all-time.html
Security
Hacking
Posted >1 y ago
Responses: 8
3
3
0
Welcome to the club. I had a TS/SCI clearance until I retired. I don't know if it was related to the OPM hack, but this year someone filed my taxes for me and received a sizable refund electronically (possibly to an overseas bank). According to the IRS, an investigation is underway and I might or might not get the refund I was due in about 9 months.
(3)
(0)
3
3
0
I'm still waiting to hear from OPM that my data was compromised. I've had a security clearance for just over 20 years now.
(3)
(0)
3
3
0
And yet, there's was hardly a mention of it on the news. The hacking agency had access to everything for a great length of time before anyone noticed!!!
(3)
(0)
2
2
0
Weeks later, services for cyber theft victims still a work in progress ...
http://www.washingtonpost.com/blogs/federal-eye/wp/2015/07/16/weeks-later-services-for-cyber-theft-victims-still-a-work-in-progress/?tid=hpModule_14fd66a0-9199-11e2-bdea-e32ad90da239&hpid=z12
http://www.washingtonpost.com/blogs/federal-eye/wp/2015/07/16/weeks-later-services-for-cyber-theft-victims-still-a-work-in-progress/?tid=hpModule_14fd66a0-9199-11e2-bdea-e32ad90da239&hpid=z12
Weeks later, services for cyber theft victims still a work in progress
The new acting chief of the Office of Personnel Management can't provide information on when notifications and remediation services for data breach victims will be ready.
(2)
(0)
1
1
0
OPM officials hindering scrutiny of hacked computer systems, watchdog says ...
The Office of Personnel Management’s inspector general has accused the agency’s information technology office of trying to thwart scrutiny of how well OPM protected the security clearance and federal employee personnel files that were hacked and how well it responded to those breaches.
Inspector general Patrick E. McFarland said that OPM’s Office of the Chief Information Officer, or OCIO, has “hindered and interfered with” his office’s oversight and “has created an environment of mistrust by providing my office with incorrect and/or misleading information.”
In a memo to acting OPM director Beth Cobert, McFarland said that while his independent office traditionally has had a positive relationship with the OCIO, recent events make him “question whether the OCIO is acting in good faith.”
In particular, the memo said that the IG delayed a planned audit of a contractor when officials pointed out that another audit recently had been done, even though they knew by then that the contractor already had been breached — a breach that has been described as providing the key to unlocking the OPM personnel files. The CIO’s office also “failed to timely notify” the IG of the hack of the personnel records, which “impeded our ability to coordinate with other law enforcement organizations and conduct audit oversight activity,” it said.
Management also tried to keep IG investigators out of meetings with the FBI and others on the security-clearance files breach, and did not fully inform the IG of a major IT project for nearly a year after planning and implementation began, it said.
http://www.washingtonpost.com/blogs/federal-eye/wp/2015/08/06/opm-officials-hindering-scrutiny-of-hacked-computer-systems-auditor-says/?tid=hpModule_308f7142-9199-11e2-bdea-e32ad90da239&hpid=z14
The Office of Personnel Management’s inspector general has accused the agency’s information technology office of trying to thwart scrutiny of how well OPM protected the security clearance and federal employee personnel files that were hacked and how well it responded to those breaches.
Inspector general Patrick E. McFarland said that OPM’s Office of the Chief Information Officer, or OCIO, has “hindered and interfered with” his office’s oversight and “has created an environment of mistrust by providing my office with incorrect and/or misleading information.”
In a memo to acting OPM director Beth Cobert, McFarland said that while his independent office traditionally has had a positive relationship with the OCIO, recent events make him “question whether the OCIO is acting in good faith.”
In particular, the memo said that the IG delayed a planned audit of a contractor when officials pointed out that another audit recently had been done, even though they knew by then that the contractor already had been breached — a breach that has been described as providing the key to unlocking the OPM personnel files. The CIO’s office also “failed to timely notify” the IG of the hack of the personnel records, which “impeded our ability to coordinate with other law enforcement organizations and conduct audit oversight activity,” it said.
Management also tried to keep IG investigators out of meetings with the FBI and others on the security-clearance files breach, and did not fully inform the IG of a major IT project for nearly a year after planning and implementation began, it said.
http://www.washingtonpost.com/blogs/federal-eye/wp/2015/08/06/opm-officials-hindering-scrutiny-of-hacked-computer-systems-auditor-says/?tid=hpModule_308f7142-9199-11e2-bdea-e32ad90da239&hpid=z14
OPM officials hindering scrutiny of hacked computer systems, watchdog says
OPM’s inspector general says agency’s information technology office tried to thwart scrutiny of OPM security practices, response.
(1)
(0)
TSgt Keith Wright
Greetings, there is one thing I know for sure is that when computer hacking occurs we really don’t know who is hacking who. Do an investigation on Robert D Steele, The Dead Cow Cult, H.O.P.E. (Hackers of America) and any known associations with these people and groups. Then check on residential addresses that seemingly have more then one IP address, also check hard drive IP addresses like more then 5 at one address and then cross check those IP address’s and see where it comes up identical to the same IP address’s. Start in the Sacramento CA area, Elk Grove CA and surrounding areas. This area may have some tunneling going as well.
(0)
(0)
1
1
0
I'm curious as to why people on this site choose to reveal their clearance levels?
(1)
(0)
1
1
0
"Any way you cut it, fixing this is going to take a minimum of tens of billions of dollars. Frankly, I wouldn’t be shocked if the bill ends up running into hundreds of billions."
What makes you think they're going to fix it? Why start caring about vets and the military now? They only love us when they can take from us.
What makes you think they're going to fix it? Why start caring about vets and the military now? They only love us when they can take from us.
(1)
(0)
0
0
0
We must completely secure all military and govenrment related networks. We owe it to all military and civilians to protect their data.
(0)
(0)
Read This Next
Continue with Facebook 
Continue with Google