More Than 22 Million People's Data Compromised By OPM Hack 67
OutOnARock writes with news that the Office of Personnel Management data breach reported earlier this month was actually far worse than earlier estimates had it; in all, it seems that more than 22 million people (not all of them government employees) had personal information compromised by the breach. From Yahoo News's coverage: That number is more than five times larger than what the Office of Personnel Management announced a month ago when first acknowledging a major breach had occurred. At the time, OPM only disclosed that the personnel records of 4.2 million current and former federal employees had been compromised.
Re: (Score:1)
Re:so what (Score:4, Insightful)
You don't need to be in love to get married. There's no requirement to prove love. Long term cohabitiating couples, homo or hetero don't need government validation of their relationships.
This is about recognition for benefits and property rights, though the latter was often done by homosexual couples through LLCs for joint property.
Re: (Score:2)
People are sheep.
Torches and Pitchforks! (Score:1)
Peasants you know what to do!
Anybody have secret information about the USA? (Score:1)
Money? Forget money.
This is about the Chinese using blackmail against government employees with security clearances. They're on a war-footing.
If only there were some person responsible for making sure the USA were protected against these sorts of threats.
Re: (Score:2)
Answer: Yes.
It was a phishing exploit that captured credentials of a valid user. It wasn't a technical compromise. It was social engineering facilitated by technology.
You can't protect that with better code.
I should've stayed unemployed... (Score:4, Informative)
My two-hour background investigation interview lasted four hours because the bureaucrats in Washington couldn't understand how one person can have multiple jobs. After being out of work for two years (2009-2010), underemployed for six months (working 20 hours per month) and filing for Chapter Seven bankruptcy in 2011, don't you think a person would work a regular Monday-Friday job and a weekend job to get his finances in better shape? Meh...
Enjoy my case file, hackers! I hope your head explodes from my employment misery!
the internet is an open book (Score:3)
One out of three US citizens (Score:1)
I believe that brings the total number of people compromised in the past few years up to about, oh, a hundred million.
Re: (Score:2)
Not the Mil TLD side (Score:1)
Only the Civ Gov side.
So, only one of the five spy agencies you know about.
Re: (Score:2)
Eh?
1) The IC comprises 17 agencies. That's not a secret. Anymore, at least.
2) Some of those agencies use OPM for background investigations, and some don't. I can tell you that the distinction is not strictly military/"civilian" though.
3) Some (not a small number) of the people that work at those agencies have pre-existing background investigations from prior employment, be it military, civilian, or contractor. It's not an impossible task to use data mining to map past background investigations to curren
Re: (Score:1)
Super Secure NSA protects america! (Score:1, Insightful)
22 million government workers get hacked probably because some anus site got SQL injected.
The NSA spends no time auditing it's own systems to protect American citizens, and All of it's time spying on Americans and "terrorists"
If the NSA's mission is to truely defend America, how come sensitive government systems are still prone to SQL injection?
Let this all sink in.
Re: (Score:3)
I think that is the problem the NSA's mission isn't defense its offense largely. We don't really have a cyber (ugh I can't believe I just wrote that word) defensive force. We probably should but we leave that to 'domestic' agencies like the FBI and other groups we rolled up into Homeland Security.
Remember the "Department of Defense" (although there were some other reorganizations and mergers) was essentially created by renaming the "War Department" because its politically more palatable to have a "defense
Re: (Score:2)
22 million government workers get hacked probably because some anus site got SQL injected.
The NSA spends no time auditing it's own systems to protect American citizens, and All of it's time spying on Americans and "terrorists"
If the NSA's mission is to truely defend America, how come sensitive government systems are still prone to SQL injection?
Let this all sink in.
If the NSA actually protected US citizens from being hacked how would the other 4 eyes of the 5 eyes treaty spy on Americans?? Don't be stupid, part of the NSAs job is to make SURE that you can be hacked by the other 4 eyes (CSIS, ASIS, NZSIS and GCHQ).
Names and actual idenities of spies (Score:2, Interesting)
This database should contain all the personal details on spies. If this was stolen by China, why haven't we heard about every spy being pulled out of China and Russia? They are friend-enemies after all.
Any chance this hack done by the NSA to help get more funding and show the Americans how much they are needed to keep us safe? The NSA would know all the details of how the OPM works. Easy target.
Go into a big Chinese bank. What do you see? Most of the computers used for operations are still running XP.
Re: (Score:2)
Paranoia getting the better of you?
First off, it would take a particularly stupid intelligence agency to keep its personnel records on OPM computers where just anyone could see them.
Secondly, unless you're absoutely sure who has the information, you don't confirm it for the world by a quick (over-)reaction.
And thirdly, why do you think YOU would notice what the government was doing with its embassies? If it were doing something abnormal, would you even recognise it as "something abnormal"?
Re: (Score:2)
Paranoia getting the better of you?
That's the first problem when you have an agency like the NSA. There's absolutely nothing to stop them from doing something like this and arguing later that it was for national security.
First off, it would take a particularly stupid intelligence agency to keep its personnel records on OPM computers where just anyone could see them.
This is the second problem when you have an agency like the NSA. You believe, like in the movies, all the top talent is there and nothing like this could happen. But in reality, all the talent that's willing to do what their told without question is what's there. Quality may not be their strong suit, and again, this is the f
Re: (Score:2)
And thirdly, why do you think YOU would notice what the government was doing with its embassies? If it were doing something abnormal, would you even recognise it as "something abnormal"?"
Most other nations do really try to really count every passport in and out and do have working, fully updated databases, other paper work and tax systems to track every worker.
Most nations do
Re: (Score:2)
personnel records on OPM computers where just anyone could see them
Would it. That information is still needed. Paychecks have to get cut etc. All these clandestine people need some kind of cover. So why not give them "jobs" as administrative employees in what everyone already understands to be a giant bureaucracy. That way if anyone inside or outside goes looking for information they find exactly what they expect.
Re: (Score:1)
I agree. Smells like a false flag to drum up funding for the NSA.
We already pay the NSA to secure the communications and .gov systems, wonder what they did with all that money?
Re: (Score:1)
Re: (Score:2)
They trust their own contacts within the US system and have fully tested them going back decades.
Russian and China also understand the "Limited hangout" https://en.wikipedia.org/wiki/... [wikipedia.org] of any bulk files.
How many US mil traps and gems are really in that data? Go looking over bulk data and what for?
Russia and China have always understoo
Re: (Score:2)
Russia and China dont have to care. They think very long term and have all their real contacts in cleared US gov/mil position going back generations and many decades.
That is their strength compared to the democracies of the west. The democratic powers can only plan maybe 8 years ahead (if they are feeling very confident).
Re: (Score:2)
The West could not even hold the one type of database it really, really, really had to hold as a good secret away from random, fast, open public networks.
So some cleared contractor could go to some out of state jobs fair, find some needed translator or skilled expert and get them cleared to start work sooner to bid on some federal task 'sooner'...
Just so the private sector could feel more happy about getting more federal funding
Re: (Score:1)
Re: (Score:2)
NSA doesn't need to do any of that. Their budget is made up of money laundered through programs with boring names so nobody can tell what they get anyway.
And if they want the data all they have to do is ask OPM. Or offer to store backups for them. The privacy act protections are almost nonexistent and completely worthless.
Re: (Score:1)
Why did the US even allow such a database? (Score:4, Interesting)
Full background interviews, real cleared US gov staff looking deep into a persons submitted life story and the looking at the facts on the ground anywhere in the US.
Life story, education, friends, mail, reading material, calls logs all allowed the US gov to select the more useful and smart people for sensitive positions.
Over the past decade the move was to finding staff with unique skills quickly and trying to ensure US security paperwork was not going to be any issue for contractors, ex staff, former staff, people moving from the private sector into gov or gov into the private sector. All while keeping or re using past security access.
The US gov and mil could ensure skilled staff from the public and private sector where ready, could be found and sorted regionally and quickly for any task in or out of the USA.
The problem for the US gov is it needed so many contractors quickly and hoped remote digital files could 'clear' a boss and their new company or past contractor/mil/gov staff for new gov/mil/contractor work.
Vast new online digital databases allowed for lucrative jobs to be handed out and any security issues to fixed quickly.
The down side of this rapid system what what is what was fully understood by the US, UK, Australian and many other nations since the 1950's from their WW2 and 1930's security issues. Dont hire or create security in haste and keep the files away from all other people in gov, mil, private sector and other nations. How or why the US gov ever let go if its most secure files for national remote access is a real mystery.
Other nations who kept their files safe from new contractors needs and within the gov seemed to have understood the issues of rapid security expansion expansion and all the remote database issues. Why did the US gov and mil think it was a good idea or safe to allow complex files of that nature to just move regional and national networks from the mid 1990's on?
Wait until they hack Obamacare's DB (Score:5, Insightful)
That will happen. It is only a matter of time.
Re: (Score:1)
To what end? Those aren't exactly people ripe for identity theft. You'd have a bunch of low-credit, low income people who couldn't get a high interest car loan, much less be of use to anyone in China.
Blue Cross (Score:2)
That will happen. It is only a matter of time.
Haven't you been paying attention? They already hacked blue cross, which is a shitload more concerning in terms of intelligence targets than hacking health care info for America's poor and out-of-work.
No more NSA (Score:4, Interesting)
So the NSA is clearly useless, and making the situation worse. They are not, and cannot protect us electronically. Instead, they are collecting all of our information and storing it for the inevitable hack that will give it to the rest of the world. The first question I ask when I'm asked to secure data is: "Do we actually need this data?" You can't steel what doesn't exist. Why the hell did this agency have data on people going back to the 1980s? Why is the NSA collecting data on all of us? It's a pointless endeavor that's putting us all at risk.
Re: (Score:2)
So the NSA is clearly useless, and making the situation worse. They are not, and cannot protect us electronically. Instead, they are collecting all of our information and storing it for the inevitable hack that will give it to the rest of the world. The first question I ask when I'm asked to secure data is: "Do we actually need this data?" You can't steel what doesn't exist. Why the hell did this agency have data on people going back to the 1980s? Why is the NSA collecting data on all of us? It's a pointless endeavor that's putting us all at risk.
The NSA don't want to protect you electronically. They need to make sure that their buddies in 5 eyes can spy on you. GCHQ, CSIS, NZSIS and ASIS all have to be able to hack you, spy on you etc. The NSA doesn't want to stand in the way of that. Hence counterintelligence operations in the 5 eyes nations are a shambles.
Comment removed (Score:5, Insightful)
Re: (Score:2)
I'm one of them (Score:2)
Until about a year ago, I had a security clearance. So I'm one of the 22 million. I've already been contacted by our site clearance officer. They gave me this link from the OPM [opm.gov] about the breach, which has more information than the links in the article.
For those who haven't gone through it, during a background search they send actual human beings around to your friend and family, and then to second-order contacts they know who know you, to ask questions about you. So the OPM, and now the hackers, literally
Re: (Score:2)
will eventually sub-contract databases to someone else (good chance a foreign company like everything else). And that database sitting on a server in China, India, or wherever
In this science fiction scenario of yours, I'd be more worried about said country instructing its workers to munge the data to let certain designated people get clearances.
Some science fiction comes to pass of course, but I'd like to think anyone with access to that particular database is required to have a COMSEC [wikipedia.org] clearance (which are prohibited to "foreign persons").
Identification is not Authentication (Score:1)
Re: (Score:1)