Sam Thielman
September 17, 2015
NCSC says OPM hack exposing data of 21 million wasn’t their responsibility
One of the largest breaches of US government data in history is somebody else’s responsibility, counterintelligence officials told senator Ron Wyden in a formal letter passed to the Guardian on Wednesday.
The Democratic senator from Oregon last month submitted three questions to the National Counterintelligence and Security Center (NCSC) about the hacking earlier this year of the Office of Personnel Management (OPM), in which the personal information of 21 million people was exposed.
In August, Wyden asked whether the NCSC had identified as a security risk the OPM’s giant database of federal security clearances, which includes personal and identifying information as private as psychiatric evaluations and social security numbers.
Wyden also asked whether the NCSC had made any recommendations related to better securing the database, which retains data going back to 1985. The theft of the information exposed some 21 million current, former and prospective government employees and has been attributed to Chinese hackers by the US government. The placement of blame is at the forefront of many minds in the nation’s capital.
“[E]xecutive branch oversight of agency information security policies and practices rests with the Office of Management and Budget (OMB) and the Department of Homeland Security (DHS),” wrote William Evanina, director of the NCSC and also the National Counterintelligence Executive. Evanina, appointed to his position by national intelligence director James Clapper last year, told Wyden that his department doesn’t tell other agencies how to handle IT security.
Wyden professed himself unimpressed. “The OPM breach had a huge counterintelligence impact and the only response by the nation’s top counterintelligence officials is to say that it wasn’t their job,” he wrote in an emailed statement, calling it “a bureaucratic response” that was “unworthy of individuals who are being trusted to defend America”.
“While the National Counterintelligence and Security Center shouldn’t need to advise agencies on how to improve their IT security,” he wrote, “it must identify vulnerabilities so that the relevant agencies can take the necessary steps to secure their data.”
Wyden also slammed other members of the US Senate for trying to railroad the Cybersecurity Information Sharing Act (Cisa) through in response to the hack.
“The Senate is now trying to respond to the OPM hack by passing a bill that would lead to more personal information being shared with these agencies,” Wyden wrote. “The way to improve cybersecurity is to ensure that network owners take responsibility for plugging security holes, not encourage the sharing of personal information with agencies that can’t protect it adequately.”
Evannina, who led an investigation into the effects of Edward Snowden’s disclosures of NSA surveillance of Americans, is a prominent figure of authority on the topic of leaks and unauthorized disclosure.
Asked by intelligence publication DefenseOne about where insider leaks sit on the government’s list of priorities, Evanina said that the government had been on high alert since Chelsea Manning and WikiLeaks revealed the killing of Iraqi journalists in 2010, “but it sped up from a regional railway to the Acela train” after the Snowden revelations.
The NCSC’s website says the center “provides effective leadership and support to the counterintelligence and security activities of the US Intelligence Community, the US Government, and US private sector entities who are at risk of intelligence collection or attack by foreign adversaries”.
In response to Wyden’s third question – why the OPM had a database going back 30 years – Evanina wrote: “The ability to assess the ‘whole person’ over a long period of time enables security clearance adjudicators to identify and address any issues (personnel security or counterintelligence-related) that may exist or may arise.”
No comments:
Post a Comment