Keep Calm and Spy On: Why the OPM Hack Won’t Bring Down US Intelligence

opm-hack-3-750px-640x360.jpg

There are very few known cases in which blackmail was involved in getting government employees to give up classified information

1. What we know about it
Intelligence is about decision advantage and relative gains. If the Chinese had stolen this information without us finding out, we would be truly screwed. It might take us years to piece together why they seemed to have so much more information on us. Welcome to the wilderness of mirrors.
2. The CIA is pretty good at what they do
The big concern is that the information stolen from Office of Personnel Management – OPM - could be used to identify US intelligence operatives and the people they meet with. Under this theory, being bandied about in the blogosphere, if the Chinese had a complete list of all federal employees, including those who work at the State Department but excluding those who work in the intelligence community, they could identify CIA case officers under official cover who don’t have State Department employment records and didn’t fill out SF-86s with OPM. If the Chinese then knew which of their officials were meeting with these case officers, they could roll up our network in China.
If it’s really possible that China now owns our human intelligence network, that’s really bad. But let me take General Hayden’s comment a step further. If it is indeed true that CIA case officer cover could be blown, by hacking into an OPM database, it’s not shame on China and it’s not even shame on OPM; it’s shame on CIA.  Anything that the twitterati can figure out in a week is something CIA counterintelligence should have addressed long ago. This kind of data is the digital equivalent of pocket litter.
Again, I don’t think we are giving the CIA enough credit here, but if it’s true, the harm can be mitigated since we know what data was lost. It might mean a lot of case officers will be riding desk duty for the rest of their careers. Luckily, this data couldn’t expose any No Official Cover case officers. We will end up relying more on signals intelligence and open source intelligence. Who knows, it might even lead to more work for the Eurasia Group. In short, we can manage the losses.
3. Password resets were already weak
The data could certainly be used for password reset. Even more advanced systems that don’t rely on answers the user provides but pull data from public records could be accessed with the information in the SF-86. But let’s not pretend that password systems were secure before this data was lost. We’ve needed to kill off the password for twenty years. The National Strategy for Trusted Identities in Cyberspace is aimed at doing just that. Most major consumer online services are now offering two-factor authentication. I’ve never run into an online password reset process at a Federal agency for anything critical, but any system using them should put stronger controls in place.
4. Spearphishing is already pretty effective
Could the information be used to target spearphishing e-mails? Sure, when targeting someone with a spearphishing e-mail, the more information, the better. On the other hand, spearphishing is already pretty effective—it’s the threat vector for most significant cyber incidents and LinkedIn and Facebook make it pretty easy. It’s also a problem that some companies are effectively managing through a combination of user training (PhishMe, Wombat Security) and next generation threat detection (Palo Alto Networks, Fidelis, FireEye). At most, access to this data will make a bad problem worse.
5. Blackmail is an overstated threat
There are too many would-be spy novelists in Washington, D.C. conjuring up fanciful scenarios in which information in the EQIP database could be used to blackmail government employees. There are two things to keep in mind when considering blackmail scenarios.
First, there are very few known cases in which blackmail was involved in getting government employees to give up classified information. As far as we know, Edward Snowden and Chelsea Manning were both motivated politically. Aldrich Ames and Robert Hanssen were both financially motivated. The lone case I am aware of in which blackmail was involved since World War II was that of Clayton Lonetree, a Marine stationed at the US embassy in Moscow. He was seduced by a KGB agent named “Violetta Seina” and caught in a honeypot. But the harm he did was, according to the then-commandant of the Marine Corps, “minimal.” He was released from prison after serving only nine years.
Second, one of the main policy justifications for the security clearance process is to mitigate the possibility of blackmail. In part, by collecting the information, the Federal government ensures that foreign spies can’t threaten clearance holders’ jobs with it. Let’s say you admit to past drug use on your SF-86. If you are still granted a clearance, no one can threaten to tell the government about your past drug use.

While the clearance process does capture information on finances and even romantic affairs, problems in these areas quickly get your application rejected. There is no benefit of the doubt. With about 5.5 million clearance holders today, the system most certainly isn’t infallible. But a foreign intelligence agency is going to have a much harder time identifying cases where security investigators made a mistake than the US government in what I am guessing is a massive review currently underway.
DefenseOne: http://bit.ly/1gjayql

 

« Is The Tech Investment Bubble About To Burst ?
China tightens grip over the Internet »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

European Cyber Security Organisation (ECSO)

European Cyber Security Organisation (ECSO)

The main objective of ECSO is to support all types of initiatives or projects that aim to develop, promote and encourage European cybersecurity.

Casaba Security

Casaba Security

Casaba are specialists in software security providing managed Software Development Lifecycle services as well as products for security testing.

BMS Group

BMS Group

BMS is an independent, employee-owned specialist insurance broking group. Broking solutions include Cyber and Technology.

Datec PNG

Datec PNG

Datec is the the largest end-to-end information and communications technology solutions and services provider in Papua New Guinea.

Matias Consulting Group (MCG)

Matias Consulting Group (MCG)

Your Business needs competitive and resilient ICT solutions. MCG defines, deploy & support them enabling you to focus on your core business.

CHT Security

CHT Security

CHT Security is a Managed Security Service Provider (MSSP) specialized in cyber security technologies enabling enterprises to defense against cyber threats to networks, gateways and endpoints.

Stratejm

Stratejm

Stratejm, a Next Generation Managed Security Services Provider, brings innovation and thought leadership to the fight against cyber criminals.

Silicon Cloud International

Silicon Cloud International

Silicon Cloud is a high performance and secure cloud computing platform for engineering and scientific applications.

SOC Experts

SOC Experts

SOC Experts is a pioneer (we started SOC training well before people realized how big the domain was going to be) and the only institution to provide end-to-end training on Security Operations Centers

Netpoleon Group

Netpoleon Group

Netpoleon is a leading provider of integrated security, networking solutions and value added services.

DAtAnchor

DAtAnchor

Anchor is simply a better way to protect and control sensitive data. Zero-trust, data-centric security. Simplified.

Trapp Technology

Trapp Technology

Trapp Technology combines the very best cloud, Internet, IT managed services, and IT consulting to provide a true all-in-one IT solution for small to mid-sized businesses.

Cyber Security Services

Cyber Security Services

Cyber Security Services is a cyber security consulting firm and security operations center (SOC).

Teleport

Teleport

Teleport is a remote-first technology company. We enable engineers to quickly access any computing resource anywhere on the planet.

VLC Solutions

VLC Solutions

VLC Solutions is an independent solutions and technology service provider offering Cloud Services, Cybersecurity, ERP Services, Network Management Services, and Compliance Solutions.

AuthMind

AuthMind

Prevent your next identity-related cyberattack with the AuthMind Identity SecOps Platform. It works anywhere and deploys in minutes.