Tens of millions of U.S. government employees and their close relations had personnel information revealed as part of the breaches in 2014 and 2015, when hackers managed to infiltrate the OPMs servers. It was real egg on the face for the administration, as well as damaging to the potential security of many of America’s most at-risk government employees.
We’re told that the first breach — which actually took place in 2013 but was not discovered until several months later in 2014 — allowed hackers to steal manuals and information on the types of data stored on the servers. It was the second breach that did the real damage however, stealing investigation data, personnel records and even fingerprints of millions of government employees.
While it was likely that security at the OPM had been breached, it wasn’t clear if it was entirely at fault for the hack, but that is what the Oversight Committee has decided. In its extensive report, titled (damningly): “The OPM Data Breach: How the Government Jeopardized Our National Security for More than a Generation,” the committee claimed that there were basic tools that could have been used to prevent breaches, but the OPM did not use them.
In fact, even the tool used to discover the breaches was not purchased by the OPM. It was undergoing a trial of the software on its live network and discovered the massive infiltration of foreign actors, which many believe were acting on behalf of the Chinese government.
Even then, the OPM didn’t pay up, purportedly returning the software after attempting to clear up the breach without incident (as per Ars Technica).
The report also takes aim at former OPM chief information officer Donna Seymour, who it claims lied during her testimony about the breaches, deliberately playing down the OPM’s lack of readiness and even claiming that the damage done was not as severe as it ultimately turned out to be.
Moving forward, the report recommends that all federal agencies have an appointed CIO who is not only competent and empowered to make necessary changes, but is also accountable for and failing in the organization’s digital security.
Other recommendations include fewer employees identifying themselves using social security numbers, as well as treating all employees as “outside” users with much more limited permissions.
