‘Collective Panic’ Spreads Among Federal Employees Over OPM Hack

[Aerows]

http://www.buzzfeed.com/sheerafrenkel/federal-employees-describe-collective-panic-after-massive-ha#.doydbwgwQr

One of these anonymous individuals was a homosexual diplomat who works in the Arab world, and now has doubts it will be safe to continue on that career path, since the hackers will know he recently married his same-sex spouse, and such things are viewed dimly in the countries where he has been working.

That is just one of many examples of how sensitive information from the compromised security-clearance applications — which run to 117 pages in length apiece, not including additional supporting documentation and computer files — could be used to raise all kinds of hell for Americans abroad. Another example, reported by Business Insider, concerns a retired military man who disclosed a 20-year affair in his security clearance application. These files are chock-a-block with juicy blackmail information.

That is assuming petty crime is the goal of this immense and sophisticated hacking operation. There is currently little evidence of such motivations, which is interesting, because the pilfered data would have been worth millions on the black market if sold quickly. Identity theft is a time-sensitive operation. It is important to act before the victims realize their Social Security numbers, credit card numbers, passwords, etc. have been compromised, and take remedial action.

Remember, the data breach actually happened near the end of last year — it was discovered, apparently by accident, in April, and not disclosed to the millions of victims until now. In previous identity-theft hacking operations, such as the big scores pulled off by Russian gangs over the past few years, the stolen data was sold on black-market websites while it was still fresh. That is one of the ways security investigators learned the extent of the crimes – they monitor shadowy criminal data markets carefully. The gang that pulled off the biggest data heist in history does not seem interested in making a few bucks by selling off their wares, or by using the data themselves for financial crime.

[Purveyor]

1. I'd be freaking out too if I were a Fed employee. Sounds they the hackers have 'everything' on

these employees/officials, top to bottom.

[Aerows]

2. It's even worse

that this had gone on for so long before they noticed it!

[marym625]

3. Thank you for keeping up with this

And keeping us informed. Such an unbelievable breach.

The only good thing is that since this has been going on, no one has been hurt because of it. Or is that why the sudden publicity about it and the governments trying to lay blame on you know who

Have to say, my mind is reeling at the moment thinking about things that have happened in the last few years

[Kablooie]

4. And once again the data wasn't encrypted.

encrypted data is much harder, or impossible to access without knowing the keys.
It also can be accessed nearly as quickly as unencrypted data if the software has the key so there is really no reason for it not to be encrypted.

One government official said that encryption is new technology so they haven't had time to implement it.
Public encryption has only been available for -- 24 years. I guess a quarter century isn't long enough and of course government developed encryption systems much earlier.

[Aerows]

6. I can't get over

how long it was before they noticed. I agree with the other points you make, too, which is the foundation of the shit sundae, but taking that long to realize it was just the damn cherry on top.

They are also attempting to dodge responsibility for it, too. So obviously, it makes a lot of sense to blame Snowden, because how dare Clapper, Alexander and the gang need to take responsibility for anything. I mean, hey - they can stand up and lie to Congress and get away with it.

[haele]

8. Career "management" is always fighting the last war. Encryption wasn't as big an issue as access.

Because previous threats to information have been through the insider threat, or through improper email/file security.
Warnings about maintaining the latest encryption, protection of personal information (PPI) processes and other information security actions against both inside and outside hackers in the federal government have gone on for years and years (and years), but since upper level management was driven more by bean-counters and sequester politics than their actual responsibilities to their tasking and data, security always took a back seat.
The information was protected by a firewall on a system that "could only be accessed by official personnel" with either a ID/password or CAC/PIN.

That was supposedly good enough, right? We don't have to spend that time convincing Congress that we need couple million dollars of new infrastructure and to hire a couple hundred IT specialists to encrypt all the data over a period of 3 - 5 years for our increasingly underfunded agency, right? After all, we have a firewall and our crack in house IT crew - oh, which we just privatized to BAH because we had to cut our OPN and mission funding costs and transfer it over to the contracts side of the house.

Well, the chickens have come home to roost.

Haele

[FlatBaroque]

5. SNOWDEN!!!!!!!

The Russians are coming!! The Chinese are right behind them!!

[Aerows]

7. I'm sure it is only a coincidence

that suddenly the story about the Russians and Chinese decrypting the files came right after this story.