U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

20–565 PDF 2016

S. Hrg. 114–449 

UNDER ATTACK: FEDERAL CYBERSECURITY AND 

THE OPM DATA BREACH 

HEARING 

BEFORE THE

COMMITTEE ON 

HOMELAND SECURITY AND 

GOVERNMENTAL AFFAIRS 

UNITED STATES SENATE 

ONE HUNDRED FOURTEENTH CONGRESS 

FIRST SESSION 

JUNE 25, 2015 

Available via the World Wide Web: http://www.fdsys.gov/ 

Printed for the use of the 

Committee on Homeland Security and Governmental Affairs 

( 
(II) 

COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS 

RON JOHNSON, Wisconsin Chairman 

JOHN MCCAIN, Arizona 

ROB PORTMAN, Ohio 

RAND PAUL, Kentucky 

JAMES LANKFORD, Oklahoma 

MICHAEL B. ENZI, Wyoming 

KELLY AYOTTE, New Hampshire 

JONI ERNST, Iowa 

BEN SASSE, Nebraska 

THOMAS R. CARPER, Delaware 

CLAIRE MCCASKILL, Missouri 

JON TESTER, Montana 

TAMMY BALDWIN, Wisconsin 

HEIDI HEITKAMP, North Dakota 

CORY A. BOOKER, New Jersey 

GARY C. PETERS, Michigan 

KEITH B. ASHDOWN, Staff Director 

WILLIAM H.W. MCKENNA, Chief Counsel for Homeland Security 

DAVID S. LUCKEY, Director of Homeland Security 

GABRIELLE A. BATKIN, Minority Staff Director 

JOHN P. KILVINGTON, Minority Deputy Staff Director 

MATTHEW R. GROTE, Minority Senior Professional Staff Member 

LAURA W. KILBRIDE, Chief Clerk 

LAUREN M. CORCORAN, Hearing Clerk 
(III) 

C O N T E N T S 

Opening statements: Page 

Senator Johnson ............................................................................................... 1 

Senator Carper ................................................................................................. 2 

Senator Tester .................................................................................................. 15 

Senator McCain ................................................................................................ 18 

Senator Booker ................................................................................................. 20 

Senator Ernst .................................................................................................... 23 

Senator Lankford .............................................................................................. 27 

Senator Sasse .................................................................................................... 30 

Senator Portman .............................................................................................. 33 

Senator Ayotte .................................................................................................. 38 

Prepared statements: 

Senator Johnson ............................................................................................... 49 

Senator Carper ................................................................................................. 51 

WITNESSES 

THURSDAY, JUNE 25, 2015 

Hon. Katherine Archuleta, Director, Office of Personnel Management .............. 5 

Tony Scott, U.S. Chief Information Officer, Office of Management and Budget 7 

Andy Ozment, Ph.D., Assistant Secretary, Office of Cybersecurity and Communications, National Protection and Programs Directorate, U.S. Department of Homeland Security ................................................................................. 8 

Hon. Patrick E. McFarland, Inspector General, Office of Personnel Management; accompanied by Lewis F. Parker, Deputy Assistant Inspector General 

for Audits .............................................................................................................. 11 

ALPHABETICAL LIST OF WITNESSES

Archuleta, Hon. Katherine: 

Testimony .......................................................................................................... 5 

Prepared statement with attachment ............................................................. 53 

McFarland, Hon. Patrick E.: 

Testimony .......................................................................................................... 11 

Prepared statement .......................................................................................... 79 

Ozment, Andy, Ph.D.: 

Testimony .......................................................................................................... 8 

Prepared statement .......................................................................................... 71 

Scott, Tony: 

Testimony .......................................................................................................... 7 

Prepared statement .......................................................................................... 68 

APPENDIX 

Chart referenced by Senator Carper ...................................................................... 90 

Statement submitted for the Record from National Treasury Employees 

Union ..................................................................................................................... 91 

Responses to post-hearing questions for the Record: 

Ms. Archuleta .................................................................................................... 95 

Mr. Scott ............................................................................................................ 107 

Mr. Ozment ....................................................................................................... 108 

(1) 

UNDER ATTACK: FEDERAL CYBERSECURITY 

AND THE OPM DATA BREACH 

THURSDAY, JUNE 25, 2015 

U.S. SENATE, COMMITTEE ON HOMELAND SECURITY

AND GOVERNMENTAL AFFAIRS, Washington, DC. 

The Committee met, pursuant to notice, at 9:31 a.m., in room 

SD–342, Dirksen Senate Office Building, Hon. Ron Johnson, Chairman of the Committee, presiding. 

Present: Senators Johnson, McCain, Portman, Lankford, Ayotte, 

Ernst, Sasse, Carper, McCaskill, Tester, Heitkamp, Booker, and 

Peters. 

OPENING STATEMENT OF CHAIRMAN JOHNSON 

Chairman JOHNSON. This hearing will come to order. 

Good morning, everyone. I have been told the Director is running 

a little late, so we will get started without her. 

Again, I would like to welcome all of our witnesses. I appreciate 

the time you have put into preparing your testimony. It is very informative. This is a very serious issue because earlier this month 

the Office of Personnel Management (OPM), announced that over 

the last year, hackers stole 4.1 million Federal employees’ personal 

records. Then just days later, we learned the attack was actually 

far broader, involving some of the most sensitive data the Federal 

Government holds on its employees and likely many more records. 

It is hard to overstate the seriousness of this breach. It has put 

people’s lives and our Nation at risk. 

This massive theft of data may be the largest breach the Federal 

Government has seen to date. But it is not the first data breach 

affecting Federal agencies or even OPM. Unfortunately, I doubt it 

will be the last. Our Nation is dependent on cyber infrastructure, 

and that makes our future vulnerable. But cyber threats against us 

are going to continue to grow in size and sophistication. 

The purpose of this hearing is to lay out the reality of that cyber 

threat and vulnerability. The first step in solving any problem is 

recognizing and admitting you have one. We must acknowledge we 

have a significant cybersecurity problem in the Federal Government, especially at OPM. This intrusion on OPM networks is only 

the latest of many against the agency, and OPM has become a case 

study in the consequences of inadequate action and neglect. 

Cybersecurity on Federal agency networks has proven to be 

grossly inadequate. Foreign actors, cyber criminals, and hacktivists 

are accessing our networks with ease and impunity. While our de-
2 

fenses are antiquated, by comparison our adversaries are proving 

to be highly sophisticated. Meanwhile, agencies are concentrating 

their resources trying to dictate cybersecurity requirements for private companies, which in many cases are implementing 

cybersecurity better and cheaper. 

OPM has been hacked five times in the last 3 years and has still 

not responded to effectively secure its network. Today’s hearing 

will focus on the two most recent breaches. 

We will hear from the OPM Inspector General (IG), Mr. Patrick 

McFarland, that OPM has continued to neglect information security which may have contributed to these breaches. 

We will hear from Dr. Andy Ozment about the specifics of this 

attack as well as the Department of Homeland Security’s (DHS) 

role in Federal cybersecurity. 

Mr. Tony Scott will testify about efforts on cybersecurity across 

the government and the information security requirements of Federal agencies. 

Finally, we will give OPM Director Katherine Archuleta an opportunity to explain how this happened on her watch, to let us 

know who she believes is responsible, and to clarify what we can 

expect from OPM going forward. 

There is a bullseye on the back of USA.gov, and it does not appear this administration is devoting enough attention to this reality. We need leadership to develop and implement an effective 

plan to stop future cyber attacks. Without effective cybersecurity, 

our Nation will not be safe or secure. Cybersecurity must be a top 

priority. 

So, again, I want to thank the witnesses and welcome everybody 

here to the hearing room. I am looking forward to the testimony, 

and with that I will turn it over to our Ranking Member, Senator 

Carper. 

OPENING STATEMENT OF SENATOR CARPER 

Senator CARPER. Thanks, Mr. Chairman. Thanks for holding this 

hearing, and welcome to all of our witnesses. We appreciate your 

being here and appreciate your service to our country. 

A few weeks ago, we learned of a massive data breach at the Office of Personnel Management. Personal and financial information 

for more than 4 million current and former Federal employees may 

have been compromised. And if that is not bad enough, reports now 

indicate that background investigation information, some of the 

most sensitive personal information the Federal Government holds, 

may have also been compromised, potentially touching millions of 

additional lives. 

This attack is deeply troubling and could have far-reaching consequences for a great number of people. It could have a profound 

impact on our national security as well. 

Understandably, the public and my colleagues are upset, and 

they are frustrated. They want answers, and so do I, and so do this 

Committee. Before we leave here today, I want us to learn the answers to at least four questions: 

First, what went wrong? 

Second, what are we doing about it? 

Third, what more needs to be done? 
3 

1The chart referenced by Senator Carper appears in the Appendix on page 90. 

And, fourth, how can we help, the legislative branch, the House 

and the Senate? 

Ultimately, sustained corrective action will be needed before we 

restore the public’s confidence in our government’s ability to keep 

their personal information safe and secure. I was encouraged to 

hear that the Office of Management and Budget (OMB) recently 

launched a 30-day cybersecurity sprint to further protect Federal 

systems from cyber attacks. That is a good start, but I think we 

all agree it is not enough. 

As we can see from OMB’s most recent annual report card on 

Federal network security—I think we have a table.1 There should 

be a table on everybody’s desk. I would just bring it to your attention. 

Senator CARPER. As we can see from this table, there is a lot of 

room for improvement. It should be the goal of every agency, large 

and small, to be at the top of this table, not at the bottom. 

Having said that, making it to the top of the chart does not guarantee immunity from successful cyber attacks. Too many of the bad 

guys are good at what they do, and they are getting better all the 

time. We have to bring our ‘‘A’’ game to the fight every single day. 

As we say in the Navy, this is an all-hands-on-deck moment. 

For those agencies that continue to lag behind, there needs to be 

enlightened leadership, accountability, and a commitment to continuing improvements. One valuable cybersecurity tool that is 

available to all Federal agencies is the DHS program known as 

‘‘EINSTEIN.’’ I may hasten to add it is not a panacea. It is a system that can record, detect, and block cyber threats. And all of us 

on this Committee have recently heard about the importance of 

EINSTEIN after the OPM breach. The system used cyber threat information from the OPM data breach to uncover a similar intrusion 

which we may have never known about at the Department of Interior. That is an important discovery. 

But finding out about a data breach after they occur is not good 

enough. We want to be able to stop these attacks before they can 

do any damage. 

It is my understanding that the newest version of 

EINSTEIN—we call it ‘‘EINSTEIN 3A.’’ I think the ‘‘A’’ is for ‘‘accelerated,’’ isn’t it?—can do just that. Unfortunately, today less 

than half of all Federal civilian agencies fall under the protection 

of EINSTEIN’s most advanced capabilities. 

Let me add again, I recognize that this system is not perfect. No 

one is saying that it is. No system is. But as my colleagues and our 

staff have heard me say many times before, if it is not perfect, let 

us make it better. And from everything I have heard, EINSTEIN 

3A is another important and badly needed step toward that goal? 

That is exactly why Senator Johnson and I, along with our staff 

members, are working on legislation now to authorize and improve 

EINSTEIN with the help of some of our witnesses. This legislation 

will speed up its adoption across the government, require use of 

leading technologies, and improve accountability and oversight. I 

look forward to working with my colleagues on this legislation so 
4 

that we can ensure every agency is equipped with the ever improving capabilities needed to fend off cyber attacks in the future. 

In closing, I think it is important to recognize the breach at OPM 

follows a long list of major cyber attacks against the government 

and, as we know, our private sector. And there are likely more to 

come. To tackle a challenge this big, we do need an all-hands-ondeck approach. What does this mean? Simply, it means we need all 

the people, resources, and authorities that we can reasonably muster to be ready to respond. 

We can begin by continuing to fill the top spots in our government agencies, something on which this agency has done, personally, I think, a superb job. I am proud of the work that we have 

done to provide the top excellent talent to help lead the Department of Homeland Security. OPM, however, has been without a 

Senate-confirmed Deputy Director for nearly 4 years. 

I will say that again. The Office of Personnel Management has 

been without a Senate-confirmed Deputy Director for nearly 4 

years. It is not that the administration has not been submitting the 

names of qualified and talented candidates for these posts most of 

the time. For example, this Committee has favorably reported out 

the name of Navy Admiral Earl Gay, the President’s nominee for 

this position at OPM, twice—once last year and again this year. 

We have done our job here on this Committee to vet him, to report 

him out. It is time to get him confirmed so that the Director and 

the agency have the help they need to right the ship. 

Finally, we could also build on the cybersecurity legislation we 

passed last year and pass new legislation like EINSTEIN, like information sharing, like data breach. We have a job to do, and we 

need to do that ourselves. It would also fully fund agency security 

efforts. 

These are all important steps we can take, but they will be incredibly difficult to accomplish if we do not work together. 

Thanks, Mr. Chairman. Again, thank you all for being here. Let 

us have a good hearing. 

Chairman JOHNSON. Thank you, Senator Carper. 

It is the tradition of this Committee to swear in witnesses, so if 

you will all stand and raise your right hand. We will wait for the 

Director. 

Good morning, Director. Raise your right hand. Do you swear 

that the testimony you will give before this Committee will be the 

truth, the whole truth, and nothing but the truth, so help you, 

God? 

Ms. ARCHULETA. I do. 

Mr. SCOTT. I do. 

Mr. OZMENT. I do. 

Mr. MCFARLAND. I do. 

Chairman JOHNSON. Thank you. Please be seated. 

Good morning, Director. 

Ms. ARCHULETA. Good morning, and I apologize. 

Chairman JOHNSON. I know traffic can be tough in Washington, 

DC, so I appreciate you being able to make it here. 

If you are ready, we can start with you. Our first witness is OPM 

Director Katherine Archuleta. Ms. Archuleta is the Director of the 

Office of Personnel Management, a position she has held since No-
5 

1The prepared statement of Ms. Archuleta appears in the Appendix on page 53. 

vember 2013. Prior to serving as Director of OPM, Ms. Archuleta 

was a senior policy adviser to then-Secretary of Energy Federico 

Pen ̃a. Director Archuleta. 

TESTIMONY OF THE HONORABLE KATHERINE ARCHULETA,1

DIRECTOR, OFFICE OF PERSONNEL MANAGEMENT 

Ms. ARCHULETA. Chairman Johnson, Ranking Member Carper, 

and Members of the Committee, thank you for the opportunity to 

testify before you today. I understand and I share the concerns and 

frustrations of Federal employees and those affected by the intrusion into OPM’s information technology (IT) systems. Although 

OPM has taken significant steps to meet our responsibility to secure the personal data of those we serve, it is clear that OPM 

needs to dramatically accelerate those efforts. I am committed to 

a full and compliance investigation of these incidents, and we continue to move urgently to take action to mitigate the longstanding 

vulnerabilities of the agency’s systems. 

In March 2014, we released our Strategic IT Plan to modernize 

and to secure OPM’s aging legacy system. We began implementing 

the plan immediately, and in fiscal years (FY) 2014 and 2015, we 

directed nearly $70 million toward the implementation of new security controls to better protect our systems. OPM is also in the process of developing a new network infrastructure environment to improve the security of OPM infrastructure and IT systems. Once 

completed, OPM IT systems will be migrated into this new environment from the current legacy networks. 

Many of the improvements have been to address critical needs, 

such as the security vulnerabilities in our network. These upgrades 

include the installation of additional firewalls; restriction of remote 

access without two-factor authentication; continuous monitoring of 

all connections to ensure that only legitimate connections have access; and deploying anti-malware software across the environment 

to protect and prevent the deployment or execution of cyber crime 

tools that could compromise our networks. These improvements led 

us to the discovery of the malicious activity that has occurred, and 

we were able to immediately share the information so that other 

agencies could protect their networks. 

I want to share with the Committee some new steps that I am 

taking in addition to the steps we have already taken. 

First, I will hire a new cybersecurity adviser that will report directly to me. This cybersecurity adviser will work with OPM’s Chief 

Information Officer (CIO) to manage ongoing response to the recent 

incidents and complete development of OPM’s plan to mitigate further incidents and assess whether long-term changes to OPM’s IT 

architecture are needed. 

Second, to ensure that the agency is leveraging private sector 

best practices and expertise, I am reaching out to the chief information security officers (CISO) at leading private sector companies 

that are experiencing their own significant cybersecurity challenges, and I will host a meeting with these experts in the coming 

weeks to help identify further steps. 
6 

I believe that all Members of this Committee have received a 

copy of my action plan, and in deference to time limits, I am happy 

to discuss it further during the questioning. 

I would like to address now the confusion regarding the number 

of people affected by two recent related cyber incidents at OPM. 

First, it is my responsibility to provide as accurate information 

as I can to Congress, the public, and, most importantly, the affected individuals. 

Second, because this information and its potential misuse concerns their lives, it is essential to identify the affected individuals 

as quickly as possible. 

Third, we face challenges in analyzing the data due to the form 

of the records and the way they are stored. As such, I have deployed a dedicated team to undertake this time-consuming analysis 

and instructed them to make sure their work is accurate and completed as quickly as possible. 

As much as I want to have all the answers today, I do not want 

to be in the position of providing you or the affected individuals 

with potentially inaccurate data. With these considerations in 

mind, I want to clarify some of the reports that have appeared in 

the press. 

Some press accounts have suggested that the number of affected 

individuals has expanded from 4 million individuals to 18 million 

individuals. Other press accounts have asserted that 4 million individuals have been affected in the personnel file incident and 18 

million individuals have been affected in the background investigation incident. Therefore, I am providing the status as we know it 

today and reaffirming my commitment to providing more information as soon as we know it. 

First, the two kinds of data that I am addressing—personnel 

records and background investigations—affected different systems 

in two separate but related incidents. 

Second, the number of individuals with data compromised from 

the personnel records incident is approximately 4.2 million, as we 

reported on June 4, and this number has not changed, and we have 

notified these individuals. 

Third, as I have noted, we continue to analyze the background 

investigation as rapidly as possible to best understand what was 

compromised, and we are not at a point where we are able to provide a more definitive report on this issue. 

That said, I want to address the figure of 18 million individuals 

that has been cited in the press. It is my understanding that the 

18 million refers to a preliminary, unverified, and approximate 

number of unique Social Security numbers in the background investigations data. It is not a number that I feel comfortable at this 

time represents the total number of affected individuals. The Social 

Security number portion of the analysis is still under active review, 

and we do not have a more definitive number. Also, there may be 

an overlap between the individuals affected in the background investigation and the personnel file incident. 

Additionally, we are working deliberately to determine if individuals who have not had their Social Security numbers compromised 

but may have other information exposed should be considered individuals affected by this incident. For these reasons, I cannot yet 
7 

1The prepared statement of Mr. Scott appears in the Appendix on page 68. 

provide a more definitive response on the number of individuals affected by the background investigations intrusion, and it may well 

increase from these initial reports. My team is conducting further 

analysis with all speed and care, and, again, I look forward to providing an accurate and complete response. 

Thank you for the opportunity, and I am happy to address any 

questions you may have. 

Chairman JOHNSON. Thank you, Madam Director. 

Our next witness is Mr. Tony Scott. Mr. Scott is the Chief Information Officer for the United States. He was appointed by the 

President in February of this year. His previous roles include heading VMware’s global information technology group and 5 years as 

chief information officer at Microsoft. Mr. Scott. 

TESTIMONY OF TONY SCOTT,1 U.S. CHIEF INFORMATION 

OFFICER, OFFICE OF MANAGEMENT AND BUDGET 

Mr. SCOTT. Thank you, Chairman Johnson, Ranking Member 

Carper, and Members of the Committee. Thank you for the opportunity to appear before you today. I appreciate the chance to speak 

with you about recent cyber incidents affecting Federal agencies. 

As Federal CIO, I lead the Office of Management and Budget’s 

Office of E-Government & Information Technology, and my office is 

responsible for developing and overseeing the implementation of 

Federal information technology policy. But today I want to focus on 

my team’s role in facing our Nation’s current reality: confronting 

ever-evolving cybersecurity threats. 

Under the Federal Information Security Modernization Act 

(FISMA) of 2014—OMB is responsible for Federal information security oversight and policy issuance. OMB executes its responsibilities in close coordination with its Federal cybersecurity partners, 

including the Department of Homeland Security and the Department of Commerce’s National Institute of Standards and Technology (NIST). 

Last year, OMB announced the creation of a dedicated 

cybersecurity unit within my office: the E-Gov Cyber Unit. The creation of the E-Gov Cyber Unit reflects OMB’s focus on conducting 

robust, data-driven oversight of agencies’ cybersecurity programs, 

and the monitoring and improving of governmentwide responses to 

major cybersecurity incidents as well as issuing Federal guidance 

consistent with current and emerging technologies and risks. 

This is also the team behind the annual FISMA report which 

highlights both successes and challenges facing Federal agencies’ 

cyber programs. In fiscal year 2015, the E-Gov Cyber Unit is conducting oversight through CyberStat reviews and will prioritize 

agencies with high risk factors as determined by cybersecurity performance and incident data. Additionally, the unit is driving 

FISMA implementation by providing agencies with the guidance 

they need in this dynamic environment. One of the top fiscal year 

2015 policy priorities of the team is updating something known as 

Circular A–130, which is the central governmentwide policy document that establishes agency guidelines on how to manage infor-
8 

1The prepared statement of Mr. Ozment appears in the Appendix on page 71. 

mation resources, including best practices for how to secure those 

resources. 

As I testified before the House last week, OMB’s guidance to 

agencies for implementing the recently passed Federal Information 

Technology Acquisition Reform Act (FITARA), was issued, and it 

strengthens the role of the CIO in agency cybersecurity, and that 

is an important piece. 

To further improve Federal cybersecurity infrastructure and protect systems against these evolving threats, OMB launched a 30- 

day cybersecurity sprint 2 weeks ago. The sprint team is comprised 

of staff from OMB, National Security Council (NSC), DHS, and 

other agencies. We have over 100 people involved in this effort, and 

at the end of the review, we will create and operationalize a set of 

action plans to further address critical cybersecurity priorities and 

recommend a Federal Civilian Cybersecurity Strategy. 

In addition, immediately the 30-day sprint directs agencies to immediately deploy priority threat-actor indicators that have been 

provided by DHS to scan systems and check logs, patch critical 

vulnerabilities without delay, tighten policies and practices for 

privileged users, and accelerate the implementation of multi-factor 

authentication, especially for privileged users. 

As I mentioned earlier, confronting cybersecurity threats is a reality I faced during my time in the private sector and continue facing in my new role as Federal Chief Information Officer. Because 

of this, ensuring the security of information within the Federal 

Government’s networks and systems will remain a core focus of 

mine and of the administration. We are moving aggressively to implement innovative protections and respond quickly to new challenges as they arise. In addition to our efforts, we also look forward 

to working with Congress on actions that may further protect our 

Nation’s critical networks and systems. 

I thank the Committee for holding this hearing and for your commitment to improving Federal cybersecurity, and I would be 

pleased to answer any questions you may have. 

Chairman JOHNSON. Thank you, Mr. Scott. 

Our next witness is Dr. Andy Ozment. Dr. Ozment is the Assistant Secretary for Cybersecurity and Communications at the Department of Homeland Security where he leads several of the Department’s key cyber programs. Prior to his service at DHS, Dr. 

Ozment was the President’s Senior Director for Cybersecurity. Dr. 

Ozment. 

TESTIMONY OF ANDY OZMENT, PH.D.,1 ASSISTANT SECRETARY, OFFICE OF CYBERSECURITY AND COMMUNICATIONS, NATIONAL PROTECTION AND PROGRAMS DIRECTORATE, U.S. DEPARTMENT OF HOMELAND SECURITY 

Mr. OZMENT. Chairman Johnson, Ranking Member Carper, 

Members of the Committee, I appreciate the opportunity to appear 

before you today. Like you, my fellow panelists, and countless 

Americans, I am deeply concerned about the recent compromise at 

OPM, and I am dedicated to ensuring that we take all necessary 
9 

steps to protect our Federal workforce and to drive forward the 

cybersecurity of the Federal Government. 

As a result, I want to focus these remarks on how DHS is accelerating our efforts to protect Federal agencies and to help Federal 

agencies better protect themselves. 

To begin with, it is important to note that we are now making 

up for 20 years of underinvestment in cybersecurity across the public and the private sectors. At the same time, we are facing a major 

challenge in protecting our most sensitive information against sophisticated, well-resourced, and persistent adversaries. This is a 

complex problem without a simple solution. If an easy answer were 

at hand, this would not be a national challenge. 

To effectively address this challenge, our Federal agencies need 

to employ defense in-depth. Consider protecting a government facility against a physical threat. Adequate security is not only a fence, 

a camera, or building locks, but a combination of these measures 

that, in aggregate, make it difficult for an adversary to gain physical access. Cybersecurity also requires this defense in-depth, these 

multiple layers of security. No one measure is sufficient. 

Under legislation passed by Congress last year, Federal agencies 

are responsible for their cybersecurity. To assist them, DHS provides a common baseline of security across the civilian government 

and helps agencies manage their own cyber risk through four key 

efforts. 

First, we protect agencies by providing a common set of capabilities through the EINSTEIN and Continuous Diagnostics and Mitigation program (CDM). 

Second, we measure and motivate agencies to implement best 

practices. 

Third, we serve as a hub for information sharing. 

And, fourth, we provide incident response assistance when agencies suffer an intrusion. 

In my statement this morning, I will focus on the first area, how 

DHS provides a baseline of security through EINSTEIN and CDM. 

I have described the other three areas in my written Statement, 

and I am happy to take your questions on them. 

Our first line of defense against cyber threats in the EINSTEIN 

system, which protects agencies at their perimeter. Returning to 

the analogy of a physical government facility that I mentioned earlier, EINSTEIN 1 is similar to a camera at the road onto a facility 

that records all traffic and identifies anomalies in the number of 

cars entering and leaving. 

EINSTEIN 2 adds the ability to detect suspicious cars based 

upon a watchlist. EINSTEIN 2 does not stop the cars, but it does 

set off an alarm. Agencies report that EINSTEIN 1 and 2 are 

screening over 90 percent of all Federal civilian traffic, and they 

played a key role in identifying the recent compromise of OPM data 

hosted at the Department of Interior. 

The latest phase of the program, as Senator Carper mentioned, 

is known as EINSTEIN 3A, and it is akin to a guard post at the 

highway that leads to multiple government facilities. It uses classified information to look at the cars and compare them to a watch 

list, and then it actively blocks prohibited cars from entering the 

facility. We are accelerating our efforts to protect all civilian agen-
10 

cies et EINSTEIN 3A. The system now protects 15 Federal civilian 

agencies with over 930,000 Federal personnel, or approximately 45 

percent of the Federal civilian government, with at least one security countermeasure. 

We have added EINSTEIN 3A protections to over 20 percent of 

the Federal civilian government in the past 9 months alone. During 

that time, and since its inception, EINSTEIN 3A has blocked nearly 550,000 attempts to access potentially malicious websites, which 

is often associated with potential theft of agency data. 

Now, EINSTEIN 3A is currently a signature-based system. It can 

only block attacks or intrusions that it already knows about. That 

is necessary but not sufficient. We are also working on adding 

other technologies to the EINSTEIN 3A platform that can block 

never-before-seen intrusions, because EINSTEIN 3A is not just a 

set of existing capabilities, it is a platform upon which we can add 

other capabilities. 

As we accelerate EINSTEIN deployment, we also recognize that 

security cannot be achieved through only one type of tool. That is 

why we need defense in-depth. EINSTEIN is not a silver bullet and 

will never be able to block every threat. For example, it must be 

complemented with tools that monitor the inside of agency networks. Our CDM program helps address this challenge. 

Returning again to our analogy of a government facility, CDM 

Phase 1 allows agencies to continuously check the building locks inside the facility to ensure they are operating as they are intended 

to. Continuing the analogy, the next two phases will monitor personnel on the facility to make sure they are not engaging in unauthorized actions and will actively assess activity across the facility 

to detect unusual patterns of behavior. 

We have purchased CDM Phase 1 capabilities for eight agencies 

covering over 50 percent of the Federal civilian government, and 

we expect to purchase these capabilities for 97 percent of the civilian government by the end of this fiscal year. 

Now, the deadlines I have just told you for both CDM and EINSTEIN are when DHS provides a given capability. It takes additional time, months, for agencies to each then implement the capability for both EINSTEIN and CDM. And, of course, agencies must 

supplement EINSTEIN and CDM with their own tools appropriate 

to the needs of that existing agency. 

I would like to conclude by noting that Federal agencies are a 

rich target, and they will continue to experience frequent attempted intrusions. As our detection methods continue to improve, 

we will, in fact, detect more incidents that are already occurring 

that we do not know about. 

The recent breach at OPM is emblematic of this trend, as OPM 

was able to detect the intrusions by implementing best practices. 

We are accelerating the deployment of the tools we have, and we 

are bringing cutting-edge capabilities online, and we are asking our 

partner agencies and Congress to take action and work with us to 

strengthen the cybersecurity of the Federal Government. 

Thank you again for the opportunity to appear before you today, 

and I look forward to any questions. 

Chairman JOHNSON. Thank you, Dr. Ozment. 
11 

1The prepared statement of Mr. McFarland appears in the Appendix on page 79. 

Our next and last witness is Mr. Patrick McFarland. Mr. McFarland is the Inspector General (IG) for the Office of Personnel Management, a position he has held since 1990, making him the longest-serving Inspector General in the Federal Government. He has 

30 years of service in law enforcement, including 22 years at the 

Secret Service. 

First of all, sir, thank you for your service, and we look forward 

to your testimony. Mr. McFarland. 

TESTIMONY OF THE HONORABLE PATRICK E. MCFARLAND,1

INSPECTOR GENERAL, OFFICE OF PERSONNEL MANAGEMENT; ACCOMPANIED BY LEWIS F. PARKER, DEPUTY ASSISTANT INSPECTOR GENERAL FOR AUDITS 

Mr. MCFARLAND. Thank you. Chairman Johnson, Ranking Member Carper, and Members of the Committee, my name is Patrick 

McFarland. I am the Inspector General of the Office of Personnel 

Management. Thank you for inviting me to testify today at the 

hearing regarding the IT security audit work performed by our office. 

I am accompanied by Lewis Parker, my Deputy Assistant Inspector General for Audits, who, with your permission, may assist in 

answering any technical questions you may have. 

OPM has a long history of systemic failures to properly manage 

its IT infrastructure which may have ultimately led to the breaches 

we are discussing today. 

First I would like to discuss some of the findings from our annual 

audits under the Federal Information Security Management Act. 

We have identified three general areas of concern, which are discussed in detail in my written testimony. They are: 

One, information security governance. This is the management 

structure and process that form the foundation of a successful security program. It is vital to have a centralized governance structure. 

OPM has made improvements in this area, but we still have some 

concerns. 

Two, security assessments and authorizations. This is a comprehensive assessment of each IT system to ensure that it meets 

the applicable security standards before allowing the system to operate. Our 2014 FISMA audit found that 11 of OPM’s 47 systems 

were operating without a valid authorization. 

Three, technical security controls. OPM has implemented a variety of controls to make the agency IT system more secure. However, these tools must be used properly and must cover the entire 

IT environment. We are concerned that they do not. 

The second issue I would like to briefly discuss is the Flash 

Audit Alert that I issued last week. In 2014, OPM began a massive 

project to overhaul the agency’s IT environment by building an entirely new infrastructure called ‘‘the Shell’’ and migrating all of its 

systems to that Shell from the existing infrastructure. We have two 

serious concerns with how the project is being implemented. 

First, OPM is not following proper IT project management procedures and, therefore, does not know the true scope and cost of this 

project. The agency never prepared a project charter or conducted 
12 

a feasibility study or even identified all of the applications that will 

have to be moved from the existing IT infrastructure to the new 

Shell environment. 

Further, the agency did not prepare the mandatory major IT 

business case, formerly known as the ‘‘Exhibit 300.’’ This document 

is an important step in the planning of any large-scale IT project 

as it forces the agency to conduct a detailed cost-benefit analysis 

as well as a risk evaluation, among other things. OPM apparently 

believes this is simply an administrative exercise. We disagree. Because OPM has not conducted these very basic planning steps, it 

does not know the true cost of the project and cannot provide an 

accurate timeframe for completion. OPM has estimated that this 

project will cost $93 million; however, that amount includes only 

strengthening the agency’s current IT security posture and the creation of a new Shell environment. It does not include the cost of 

migrating all of OPM’s 50 major IT systems and numerous sub-systems to the Shell. This migration will be the most costly and complex phase of this project. Even if the $93 million figure was an accurate estimate, the 

agency does not have a dedicated funding stream for the project. 

Therefore, it is entirely possible that OPM could run out of funds 

before completion, leaving the agency’s IT environment more vulnerable than it is now. 

The second major point discussed in the alert relates to the use 

of a sole-source contract. OPM has contracted with a single vendor 

to complete all of the multiple phases of this project. Unless there 

is a specific exception, Federal contracts are supposed to be subject 

to full and open competition. However, there is an exception for 

compelling and urgent situations. 

The first phase of this project, which involves securing OPM’s IT 

environment, was indeed such a compelling and urgent situation. 

That phase addressed a crisis, namely, the breaches that occurred 

last year. However, later phases, such as migrating the applications to the new Shell environment, are not urgent. Instead, they 

involve work, that is essentially a long-term capital investment. 

OPM has indicated that the contract for the migration phase has 

not been awarded. We have not been provided documentation that 

OPM is soliciting bids from other contractors for this work, even 

though this work is supposedly underway. This supports our concern that the current vendor’s contract covers all phases of this 

project. 

It may sound counterintuitive, but OPM must slow down and not 

continue to barrel forward with this project. The agency must take 

the time to get it right the first time to determine the scope of the 

project, calculate the costs, and make a clear plan about how to implement this massive overhaul. OPM cannot afford to have this 

project fail. 

I fully support OPM’s efforts to modernize its IT environment 

and the Director’s long-term goals. However, if it is not done correctly, the agency will be in a worse situation than it is today, and 

millions of taxpayer dollars will have been wasted. 

Thank you. 

Chairman JOHNSON. Thank you, Mr. McFarland. I would like to 

start my questioning with you. 
13 

Looking back at your audits, under the Federal Information Security Management Act, if we just start with fiscal year 2009, you 

do not have to go much further than the first or second page of the 

executive summary to understand that security of the IT systems 

has been a problem. 

In your November 5, 2009, report, you report ‘‘lack of adequate 

information security governance activities in accordance with legislative and regulatory requirements.’’ 

In your November 10, 2010, report, you say, ‘‘We also expanded 

the material weaknesses related to IT security policies to include 

concerns with the agency’s overall information security governance 

and its information security management structure.’’ 

In your November 2011 report, you say, ‘‘We continue to believe 

that information security governance represents a material weakness in OPM’s IT security program.’’ 

November 5, 2012—and this is actually pretty troubling because 

in the audit, the Office of Chief Information Officer (OCIO) response to your draft audit report indicated that they disagreed with 

the classification of the material weakness because of the progress 

that OPM had made with its IT security program and because 

there was no loss of sensitive data during the fiscal year. However, 

the OCIO’s statement is inaccurate as there were, in fact, numerous information security incidents in fiscal year 2012 that led to 

the loss or unauthorized release of mission-critical or sensitive 

data. In other words, in the 2012 report, the Office of Chief Information Officer was in a State of denial. 

November 21, 2013, second page of the report, it says, ‘‘OPM’s 

decentralized governance structure continues to result in many instances of noncompliance with FISMA requirements; therefore, we 

are again reporting this issue as a material weakness for Fiscal 

Year 2013.’’ 

In 2014, probably the best thing you can say in terms of improvements is the material weaknesses related to information security 

governance has been upgraded to a significant deficiency due to the 

planned reorganization of OCIO. And, again, I am highly concerned 

about this flash audit. On the Infrastructure Improvement Project, 

your conclusion: ‘‘As a result, there is a high risk that this project 

will fail to meet the objectives of providing a secure operating environment for OPM’s systems and applications.’’ You go on to say: ‘‘In 

our opinion, the project management approach to this major infrastructure overhaul is entirely inadequate and introduces a very 

high risk of project failure.’’ 

It is pretty clear that the security of the IT system has been a 

problem, a material problem for quite some time. Now, when Director Archuleta came before this Committee in this Senate for confirmation, in her written answers to our questions, she said, ‘‘If 

confirmed as Director of OPM, improved management of OPM’s IT, 

including proper security and data management, will be one of my 

top priorities. I will work with OPM’s CIO and IG to ensure that 

adequate measures are in place to protect this vital information.’’ 

Mr. McFarland, has Director Archuleta ever met with you specifically to discuss the results of your FISMA audits? 

Mr. MCFARLAND. No, sir. 

Chairman JOHNSON. Do you meet with her regularly? 
14 

Mr. MCFARLAND. I meet with her at least once a month. 

Chairman JOHNSON. To what extent have you ever discussed the 

material problems with the security of the IT systems of OPM? 

Mr. MCFARLAND. The memorandum in front of me is dated June 

17 from us to the Director, and it spells out the Flash Audit Alert 

with a lot of information in it, and that was presented to her office. 

One week prior to that, we made sure that the chief of staff had 

a copy to help the flow of information for us. But we have not sat 

down, the Director and I, regarding this. We have not heard back 

other than last Tuesday when we received the response to our 

Flash Audit Alert. 

Chairman JOHNSON. So do you believe that her statement that 

she would work with OPM’s CIO and IG to ensure that adequate 

measures are in place to protect this vital information, do you believe she has fulfilled that commitment? 

Mr. MCFARLAND. Well, I do not believe she has fulfilled that 

commitment specifically with me, but I would assume—and it may 

be right, may be wrong—that her explanation entails the CIO’s involvement with our office. 

Chairman JOHNSON. Well, here is the problem. We have had 

three material breaches under her watch. In March 2014, the Chinese breached OPM looking for background investigations, and, of 

course, the subject of this hearing is the two most recent breaches. 

Director Archuleta, do you believe you have fulfilled that commitment that you made to this Committee and this Senate that you 

will work with OPM’s IG to ensure that adequate measures are in 

place to protect this vital information? 

Ms. ARCHULETA. I believe I am fulfilling that commitment, sir. 

With regard to the strategic plan that I promised in the confirmation, is that we have moved toward that, and your concerns about 

governance are exactly right. There was not a governance structure, and it was—one of the first things I did was to hire a capable 

and qualified CIO. 

Chairman JOHNSON. My time is running out. Why have you not 

met with the Inspector General who is tasked with these audits 

and has given you a lot of—has basically laid out the problem for 

you. Why have you not met and discussed this problem with the 

Inspector General? 

Ms. ARCHULETA. Thank you. We do meet on a monthly basis, 

and—— 

Chairman JOHNSON. But not to talk about this IT security situation. 

Ms. ARCHULETA. The agenda—— 

Chairman JOHNSON. Which was going to be a top priority of your 

term. 

Ms. ARCHULETA. Yes. The agenda is set by the IG, and he has 

been very helpful in identifying issues throughout the agency. 

With regard to the Flash Audit, my staff and his staff are meeting on Tuesday. We have not had a meeting since his release of the 

Flash Audit, but he and I will followup first with staff, and then 

we have a meeting together. We have not, as Mr. McFarland indicated, had the opportunity to meet yet, but I am sure it was his 

intention and always my intention that we would sit down and discuss this, as we have with all other issues. 
15 

Chairman JOHNSON. Have you spoken to the President about this 

breach? 

Ms. ARCHULETA. Yes, I have spoken to the President. 

Chairman JOHNSON. When? 

Ms. ARCHULETA. It was—— 

Chairman JOHNSON. About this breach, about the most recent 

breach of the 4.1 million to possibly 18 million records. 

Ms. ARCHULETA. I did brief the President on this, and he has 

made it repeatedly clear that cyber threats are one of his most serious economic and national security challenges as we face the Nation, and he has in his administration pursued a comprehensive 

strategy, including the appointment of Tony Scott, boosting our defenses in government, and sharing more information. He has also 

directed the establishment of a Cyber Intelligence Center and 

called on the Congress to pass legislation. 

Chairman JOHNSON. OK. When did you speak with the President 

about this? 

Ms. ARCHULETA. Approximately 2 weeks ago. 

Chairman JOHNSON. Do you understand the full gravity of the 

risk to this Nation, the risk to people’s lives, government officials 

that are trying to protect this Nation, because of the release of this 

information? 

Ms. ARCHULETA. Of course I do. I am as upset as you are about 

this. And that is why we have worked from day one to set in place 

the steps that had not existed there before, and I think—and if you 

notice in the plan that I sent you, we have taken significant steps 

toward that. But we are looking at nearly 30 years of a legacy system and no improvements prior to the time that I got there—not 

none, but not enough. 

And so as you look at the improvements we have made, certainly 

we have made important steps, but we need to make more, and 

that is why we are asking Congress for their support. 

Chairman JOHNSON. OK. Senator Carper. 

Senator CARPER. I am going to yield my time at this point to 

Senator Tester, who needs to go to an Appropriations Committee 

markup. 

OPENING STATEMENT OF SENATOR TESTER 

Senator TESTER. Thank you. Thank you, Mr. Chairman. Thank 

you, Tom Carper. Thank you very much. I appreciate that. 

Director Archuleta, was the cause of the initial breach because 

of the compromised credential of an employee of a contractor, 

KeyPoint Government Solutions? 

Ms. ARCHULETA. My colleagues would be very much more able to 

respond to that, but, yes, the first issue was a use of credential—— 

Senator TESTER. A compromised credential? 

Ms. ARCHULETA. A compromised credential. 

Senator TESTER. You would agree with that? 

Mr. OZMENT. Yes, sir, I would agree with that. 

Senator TESTER. Thank you. 

Director Archuleta, do you plan to continue OPM’s relationship 

with KeyPoint? 
16 

Ms. ARCHULETA. Yes, sir. We have found that they have responded to all other remediation efforts that we have asked them 

to perform. 

Senator TESTER. So it would be fair to say that you believe 

KeyPoint is able to keep its data and credentials secure at this 

point? 

Ms. ARCHULETA. Yes, sir, I do believe that that is true. They 

have made important strides. 

Senator TESTER. OK. IG McFarland, in your estimation has 

KeyPoint sufficiently updated its access to its systems to ensure 

that its data and credentials are secure? 

Mr. MCFARLAND. We do not know that at this time. 

Senator TESTER. Who would know that? 

Mr. MCFARLAND. I would hope the CIO would know it. 

Senator TESTER. OK. Has OPM updated their systems to ensure 

that data and credentials are secure, IG McFarland? 

Mr. MCFARLAND. I believe, yes, they have been working on the 

tactical aspect of the infrastructure, which is to update the present 

environment. 

Senator TESTER. Do you feel that their systems are secure at this 

point? 

Mr. MCFARLAND. No, I do not feel that they are secure at this 

point. 

Senator TESTER. OK. IG McFarland, based on what you know so 

far, do you believe that OPM should continue its relationship with 

KeyPoint? 

Mr. MCFARLAND. I would have to have more information. I would 

not be able to answer that right now. 

Senator TESTER. OK. Director Archuleta, as part of your testimony, you also include recommendations to improve cybersecurity 

at OPM, and, clearly, in these recommendations you call on Congress for additional support in order to accelerate upgrades for 

OPM’s IT infrastructure. Director, as a part of this additional support, are you requesting funding for additional IT software developers and IT support personnel? 

Ms. ARCHULETA. We are very much focused on the additional 

money to improve our security. Yes, it is the primary reason for the 

request for additional funds. 

Senator TESTER. OK. And so who have you made that request to? 

Ms. ARCHULETA. We are in the process of developing that request. We hope to have it to you by the end of this week, and we 

are working very closely with OMB on that. 

Senator TESTER. And do you have any idea how much that will 

be? 

Ms. ARCHULETA. I do not have the idea right now, sir, but I think 

there has been an initial number that we are focused in on, and 

I would be glad to get that to you by the end of this week. 

Senator TESTER. OK. You talked about gleaning some of the information out of private sector cybersecurity. Are you going to—you 

said that you were going to—in your opening testimony—I do not 

want to put words in your mouth, but what I heard was that you 

were going to go to the private sector to find out some methods 

that they utilized? 

Ms. ARCHULETA. Yes. The issue of cybersecurity—— 
17 

Senator TESTER. And if that is correct, just say—— 

Ms. ARCHULETA. Yes, it is correct. 

Senator TESTER. Are you going to the financial industry? 

Ms. ARCHULETA. We will be going throughout the industry, and 

financial, I am sure, will be part of that, sir, yes. 

Senator TESTER. OK, because they are getting attacked literally 

every night. 

Ms. ARCHULETA. Yes. 

Senator TESTER. And they seem to be doing a reasonable job at 

this point in time of fending those attacks off. 

Ms. ARCHULETA. That is the type of expertise we will want to 

know about and learn about. 

Senator TESTER. OK. Many times the private sector offers employees in software development and IT pretty damn generous benefits and pay. Yet at the Federal Government, we have had to endure Government shutdowns. In recent years, we have seen threat 

after threat cutting retirement, threat to cut wages, not exactly 

what I would say good recruiting and retention efforts. 

How is OPM addressing recruiting problems, not only in your 

supplemental request for dollars but in general? 

Ms. ARCHULETA. Thank you for that question, sir. I have actually 

been working very closely and had several conversations with the 

private sector that faces this same problem. The need for 

cybersecurity experts and, frankly, IT experts is one that both the 

public and public sector are in great need of, and we are working 

together with them and also working with our internal partners in 

all of the agencies to determine ways through hiring flexibilities, 

recruiting flexibilities and salary flexibilities to bring these individuals in. 

What we have found is that there is a great deal of interest in 

public service, and this is something that we are focused in on, and 

the recruitment of individuals both at the Millennials and mid-career. 

Senator TESTER. OK. This is for either you, Mr. Scott, or Mr. 

Ozment. Which one of you said that this is due to an underinvestment in cybersecurity over the last 10 years? Was that you, Mr. 

Ozment? 

Mr. OZMENT. That was me, sir. 

Senator TESTER. OK. So we are sitting here on this side of the 

dais. Some of us are appropriators, but we are all concerned about 

national security. Who should we be listening to about where we 

need to make those investments? 

Mr. OZMENT. Ultimately you need to listen to each agency and 

their CIO because they know their environment best. I know that 

what we have come forward, the Department of Homeland Security, in our budget request for my organization, also supports governmentwide security programs, and we need a combination of 

those governmentwide programs and individual agencies. 

Senator TESTER. Do we have a plan like that currently? Do we 

have a governmentwide program for cybersecurity that actually— 

the way I visualize it in my head, it actually has tentacles out to 

each agency? 

Mr. OZMENT. We have a number of documents that in combination lay out our governmentwide approach, in part influenced by 
18 

the recent passing of the FISMA modernization in December 2014. 

And so those documents in aggregate lay out the approach that we 

are taking. 

Senator TESTER. Is that effective? I mean, is the infrastructure 

effective to do what we need to do? Or do we have to add to—do 

you understand what I am asking? 

Mr. OZMENT. I do. There is always a balance between spending 

your time writing documents and spending your time doing the actual work. 

Senator TESTER. That is true. 

Mr. OZMENT. I think we are at a point right now where we 

have—a lot of guidance has been issued. There has been a lot of 

focus on how we move forward. I think we are at the point now 

where we need to focus on the execution. 

Senator TESTER. All right. Thank you all for your testimony. 

Thank you, Mr. Chairman, especially you, Mr. Vice Chairman. 

Chairman JOHNSON. Chairman McCain has got to be somewhere 

else. We are going to let him go next, if that is OK, Senator Booker? OK. Senator McCain. 

OPENING STATEMENT OF SENATOR MCCAIN 

Senator MCCAIN. Thank you, Mr. Chairman. I thank Senator 

Booker for his indulgence. 

Ms. Archuleta, the New York Times stated, ‘‘While Mr. Obama 

publicly named North Korea as the country that attacked Sony Pictures Entertainment last year, he and his aides have described the 

Chinese hackers in the government records case only to Members 

of Congress in classified hearings. Blaming the Chinese in public 

could affect cooperation on limiting the Iranian nuclear program 

and tensions with China’s Asian neighbors.’’ 

Are you ready to state, since it has been in all public periodicals, 

that it was China responsible for this hacking? 

Ms. ARCHULETA. I think that that would be—— 

Senator MCCAIN. That is a pretty simple answer. Are you ready 

to say that it was Chinese hacking or not? 

Ms. ARCHULETA. I would have to defer to—— 

Senator MCCAIN. So the answer is no? 

Ms. ARCHULETA [continuing]. My colleagues at State. I would 

defer to my colleagues at State to respond to that. 

Senator MCCAIN. So the answer is no, you will not—even though 

it is all in public knowledge that it was China, you are not ready 

to tell this Committee that you know that it was China that was 

responsible for the hacking. Is that true? 

Ms. ARCHULETA. OPM is not responsible for attribution. We rely 

on our colleagues to talk about that. 

Senator MCCAIN. Your committee—your business is to track and 

to respond to hacking, and—well, I would like to go back to the 

issue—you said you did not know where the figure of 18 million Social Security numbers came from. This is a Wall Street Journal article. ‘‘A senior Federal Bureau of Investigations (FBI) official interjected, said it was based on her agency’s own data, these people 

said, of 18.2 million.’’ Are you ready to acknowledge that the FBI’s 

number of 18.2 million is accurate? 
19 

Ms. ARCHULETA. As I stated in my opening remarks, sir, I do not 

believe that that is an accurate number, and I will not give an accurate—— 

Senator MCCAIN. So the FBI is giving us incorrect information? 

Ms. ARCHULETA. I do not have an understanding of where they 

assumed that 18 number, but I will tell you—— 

Senator MCCAIN. Have you met with the FBI? 

Ms. ARCHULETA. My associates have met with the FBI—— 

Senator MCCAIN. Your associates have, but you have not. 

Ms. ARCHULETA. No, sir, I have not met with the FBI. 

Senator MCCAIN. Why wouldn’t you, when there is a clear situation here of an allegation by the most respected law enforcement 

agency in America of 18.2 million. You are alleging that it is 4 million. Wouldn’t you sit down with the Director of the FBI and say, 

‘‘Hey, the American people need to know, especially those 14 million between 4 and 18 million that may have been breached? ’’ 

Ms. ARCHULETA. As the head of the agency, I have many people 

who are working in a number of different issues. This is an important question that you have asked me, and since the time that 

number—— 

Senator MCCAIN. I guess my question, again, is: Why wouldn’t 

you sit down with the FBI people and find out where they got their 

information so—— 

Ms. ARCHULETA. There are many—— 

Senator MCCAIN [continuing]. You can corroborate it or deny it? 

Ms. ARCHULETA. My colleagues have met with the FBI, and—— 

Senator MCCAIN. But you have not. 

Ms. ARCHULETA. No. 

Senator MCCAIN. It does not rise to your level of attention. I see. 

Now, what about the hundreds of millions of prescription drug 

claims and health records OPM holds to detect fraud in the Federal 

Employee Health Benefits Program (FEHBP)? Are those at risk? 

Ms. ARCHULETA. The enrollment forms are part of the data, and 

as I said in my statement, again, we are analyzing the data right 

now. 

Senator MCCAIN. You will not tell the Committee—— 

Ms. ARCHULETA. It does not—— 

Senator MCCAIN [continuing]. Whether they are at risk or not? 

Ms. ARCHULETA. I will share with you that we are analyzing this 

data to see the scope of the impact of this breach. 

Senator MCCAIN. Mr. McFarland, your office has been warning 

OPM about the vulnerability of its data for years. How were these 

warnings received by the agency, and why were they apparently ignored until it was too late? 

Mr. MCFARLAND. Well, I do not know why they were ignored, but 

they certainly—— 

Senator MCCAIN. But they were ignored. 

Mr. MCFARLAND. Yes, they were ignored, in my estimation. 

Senator MCCAIN. So they just received it, sort of like Ms. 

Archuleta received the information from the FBI. It probably may 

not have risen to the level of her interest. 

Now, Ms. Archuleta, you made an interesting statement. You 

told the Senate Appropriations Committee Tuesday that no one at 

OPM is personally to blame for the data breach. However, you told 
20 

the House panel Wednesday, ‘‘I hold all of us responsible. That is 

our job at OPM to protect the data.’’ In other words, everybody is 

responsible, so nobody is responsible. But you are responsible, and 

I wonder whether you think—since you said, ‘‘I hold all of us responsible,’’ do you think you should stay in your present position? 

Ms. ARCHULETA. Senator, I have been working hard from day one 

to correct decades of neglect, and I—— 

Senator MCCAIN. Ignoring the—— 

Ms. ARCHULETA [continuing]. Continue to—— 

Senator MCCAIN. Ignoring Mr. McFarland’s warnings. 

Ms. ARCHULETA. I have been here for 18 months, sir, and I have 

worked very hard. I think we have taken great strides not only 

within OPM and in partnership throughout government, 

cybersecurity is an enterprise effort in this administration, and I 

work closely with them. I am committed to continuing to do that. 

Senator MCCAIN. Well, unfortunately, you were not committed to 

heeding the warnings of Mr. McFarland, apparently, at least according to his assessment. 

I guess my final question is, which I am sure you will probably 

obfuscate: When will the American people know, when will they 

know the extent of this penetration which has violated the privacy 

of, at least in the estimation of the FBI, 18 million people? 

Ms. ARCHULETA. Thank you for that question, and as I stated 

earlier, we are working as rapidly as we can. I have a team that 

is working—that is devoted to this—— 

Senator MCCAIN. And you have no—— 

Ms. ARCHULETA [continuing]. But I will be—I—— 

Senator MCCAIN. And you have no estimate for the Committee 

as to when this—— 

Ms. ARCHULETA. When I know that the number is accurate, that 

is the time. 

Senator MCCAIN. But you cannot tell us when you would—— 

Ms. ARCHULETA. When I know the number is accurate. 

Senator MCCAIN. But you cannot tell us when. 

Ms. ARCHULETA. When they bring me an accurate—— 

Senator MCCAIN. I see. 

Ms. ARCHULETA [continuing]. And I have confidence in that number. 

Senator MCCAIN. Ms. Archuleta, I must say that I have seen a 

lot of performances. Yours ranks as one of the most interesting. 

I yield back. 

Chairman JOHNSON. Thank you, Chairman McCain. 

Because Senator Booker did yield, I will let you go before Senator 

Ernst. 

OPENING STATEMENT OF SENATOR BOOKER 

Senator BOOKER. Thank you very much. These days it is surprising to see somebody letting New Jersey go before Iowa. [Laughter.] 

Senator ERNST. It is OK. 

Senator BOOKER. Ms. Archuleta, I understand that the OPM Inspector General recommended the shutdown of OPM’s IT infrastructure system before we knew about the hacks. Did you follow 

the IG’s guidance? And if not, why? 
21 

Ms. ARCHULETA. I did not follow his guidance because I had to 

make a very conscious and deliberate decision as to the impact of 

the shutdown of those systems. I would have had to shut down the 

processing of the annuity checks to retirees. I would have had to 

shut down the system that does background investigations for the 

Federal Aviation Administration (FAA) or for the Transportation 

Security Administration (TSA). It would have meant that those individuals and the needs that those new hires and the services they 

would provide would not have been able to be provided. 

I made a conscious decision that we would move forward with 

this, but would make improvements as rapidly as possible, and we 

have done that. And the opportunity to work with the IG, I would 

say, is one that I feel is an important part of everything that we 

think about, but I also know that I have responsibility in many 

areas across OPM. 

Senator BOOKER. OK. Mr. Scott, you are America’s Chief Information Officer. It is obviously a very important and big task, and 

I want to ask you very specifically: Do you believe Ms. Archuleta 

and Donna Seymour are equipped to lead the efforts to shore up 

OPM’s cybersecurity in the wake of these attacks? Do you believe 

that their leadership is capable of dealing with this tremendous 

trial? 

Mr. SCOTT. I do, sir, and I have spent time on the ground with 

the teams that are in OPM doing the work, both from DHS and 

the OPM teams. They are working really hard and doing the right 

things. I have talked to them about the leadership that they are 

getting from both Director Archuleta and Donna Seymour, and 

they tell me that they are very supportive of the efforts and the 

leadership that they see there. And the one comment I would make 

is I think we need to be careful about distinguishing fire starters 

from fire fighters in this particular case, and they have my full 

support. 

Senator BOOKER. And you have a tremendous professional background. You understand the field not only in the private but the 

public sector. Given you know what you know going on around the 

country and meeting these attacks that are happening, frankly, the 

incredible nature of attacks going on on dozens of companies that 

are all name brands, things we have seen in the media, given that 

whole field, do you think she is the person equipped to do the job, 

as you say, of firefighting? 

Mr. SCOTT. Yes, sir, and I have been impressed with the deployment of the additional tools. I would say, the work that is going 

on in OPM right now would serve as a template and a model for 

work that other agencies need to do as well. We are learning on 

this across the whole Federal Government, and one of the goals of 

my office is to take all those lessons learned and apply them broadly across the Federal Government, working with my colleagues in 

DHS and elsewhere. We have to learn from this, and we have to 

be much faster as a Federal Government in responding to what is 

a very rising and fast rising and fast morphing set of threats. This 

is not a small challenge. 

Senator BOOKER. I appreciate that. 

Ms. Archuleta, there have been at least two instances of OPM 

systems being hacked. Could you just explain please how the first 
22 

and second breaches occurred, what steps you have taken to prevent a future breach, and what have you done to protect the dedicated public servants who have been affected by this breach? 

Ms. ARCHULETA. Certainly. Thank you for that question. The 

first breach occurred in April to the employee personnel records. As 

a result of the investigation around that, we found the second 

breach later. The forensic part of it I think my colleague Andy 

Ozment would be better able to respond to, but since that time, we 

have instituted even more security measures into our system, and 

at this time we are unaware of any other efforts to come into the 

system. And we are obviously monitoring that constantly 24/7 

through our center. 

Senator BOOKER. And if you can answer this question quickly, 

Dr. Ozment will have a chance to add to that question. But there 

have been much pointed questions toward you about the discrepancies between the numbers. The first attack, everyone was consistent. We knew what those numbers were. This attack, they are 

not being consistently reported, as has been pointed out by my colleagues, and we are having these varying numbers. Can you just 

explain why that is, hopefully leaving about 20 seconds of my 90 

seconds—— 

Ms. ARCHULETA. Yes, that is what I mentioned in my opening 

statement, sir. The first incidence was 4.2 million, and we have not 

determined the scope of the second incident yet. 

Senator BOOKER. And you had some pointed questions as to why 

that is, why are there varying numbers. 

Ms. ARCHULETA. Because I do want them to be accurate. 

Senator BOOKER. And so you are holding back giving a number 

until you have all the information. 

Ms. ARCHULETA. We have a team that is doing the analysis even 

as we speak to make sure that we will announce an accurate number. 

Senator BOOKER. Right, so to be premature would be to be inaccurate. 

Ms. ARCHULETA. That is exactly right. 

Senator BOOKER. I do have 55 seconds, sir. Could you just add 

a little bit more to what is being done? 

Mr. OZMENT. Absolutely. I can speak to the timeline of the incident itself. In April, OPM detected this incident because they had 

been rolling out security capabilities over the last year and a potentially additional timeframe. So if they had not rolled out those capabilities, we would never know that this intrusion—— 

Senator BOOKER. So the upgrades you all were doing in order to 

promote better hygiene, in order to do the right things, was the 

reason why we detected the attack that had occurred more than a 

year earlier? 

Mr. OZMENT. That is right. So OPM’s upgrades are what detected 

the attack. They notified DHS, my organization, immediately. We 

used the information they provided to detect the second intrusion 

at the Department of Interior Data Center. And the team since 

then has been on the ground doing the forensics analysis. In May, 

they were able to assess with high confidence that the 4.2 million 

personnel records had been exfiltrated from the Department of In-
23 

terior Data Center. That is OPM’s data but at the Department of 

Interior Data Center. 

In June, they assessed that some amount of information had 

been exfiltrated from OPM itself, but, it is complicated databases, 

and that is the analysis OPM is currently doing to figure out what 

exactly what the data that was taken. 

Senator BOOKER. Thank you, Dr. Ozment. 

And, Mr. Chairman, thank you for your deference to the people 

in New Jersey. 

Chairman JOHNSON. Thank you, Senator Booker. Always looking 

out for the folks in New Jersey—and Iowa. Senator Ernst. 

OPENING STATEMENT OF SENATOR ERNST 

Senator ERNST. Thank you. Thank you, Senator Booker, and 

thank you, Ranking Member. Thank you, Mr. Chairman, very 

much. 

This is a significant data breach. We will talk about this all the 

day, but bottom line, we need to see some action on this immediately. 

Mr. McFarland, thank you for being here today. We have heard 

in your testimony, we have seen your Flash Audit Alert that was 

released by your office earlier this month, and in that audit alert, 

you did highlight your serious concerns regarding OPM’s management of its new IT project, the improvement project. And I cannot 

overstate the importance of project management, particularly with 

respect to projects as complex and important as this particular 

project. 

In fact, just yesterday in this Committee, we did approve a bill 

introduced by Senator Heitkamp and myself which will focus on 

improving program management in the Federal Government, and 

I would be interested to learn from you just a little bit more detail 

about your concerns to OPM’s management of this IT improvement 

project. 

Mr. MCFARLAND. Yes, Senator. I think a good start here and a 

good example would be the fact that anyone doing a capital investment in the IT world, at least my understanding—and I can be corrected if I am wrong—by OMB’s regulation is required to do a business plan known as Exhibit 300. That has not been done by OPM, 

yet I do hear in the last few days information that OPM and OMB 

are working very closely together. And I do not doubt that. But my 

concern is something as simple and straightforward as a business 

plan, if it is not completed—and we hear it is completed by OPM, 

and then our documentation that we requested shows that it has 

not been done, I would like to find out—I do not necessarily want 

to use this forum for my question, but I think it goes to the heart 

of your question. What has happened with this business plan? Has 

it been done or not? 

Senator ERNST. And that to me is significant failure that the fact 

that something so simple as a business plan cannot be produced for 

this project, which left millions of Federal employees and their data 

at risk. 

So, Ms. Archuleta, I do want to followup, because it sounds like 

now there is a request for additional dollars, and what we want to 

ensure is that if the dollars are allocated, that it will actually be 
24 

put toward this project and that we do see results and that it is 

managed wisely. I cannot say that dollars we have put forth so far 

have been utilized maybe to the best of the taxpayers’ interests. 

So if you could address that, just give us that assurance that this 

will be handled. 

Ms. ARCHULETA. Thank you. Thank you for that question. In his 

Flash Audit, the Inspector General recommended the completion of 

a major IT business case document for fiscal year 2017, and I actually look forward to discussing with the Inspector General the practical implications of completing such a document for submission for 

fiscal year 2017. We are in an urgent situation. I do understand, 

though, his concerns, and I would like to assure him that all of our 

decisions are being tracked, documented, and justified, and that we 

are working very closely with OMB. 

As I mentioned earlier, I think that the Flash Audit discussions 

need to occur between me and the IG, and we will do that. Our 

staffs are meeting next Tuesday, and I am sure Mr. McFarland and 

I will meet immediately following. The important thing is that we 

address his concerns, but I think the other thing is that we move 

quickly. As Tony and Andy have already described, we are in a 

very urgent situation. So we need to balance and make sure that 

we are doing all the things that the IG has described, but as well, 

we understand the urgency of moving forward aggressively. 

Senator ERNST. I do appreciate that, but this is rather late, and 

in retrospect we cannot go take back the data that has been captured by whoever this person or entity is out there that has gotten 

into the system, who has breached and gotten this data. 

One thing that maybe we have not discussed yet is the fact that 

not only do we have millions of Federal records, and employee 

records that were breached, but I know when I filled out the applications for security clearances in the military, not only was my personal information on those forms, but I had to list references on 

those forms. Their information is also included in this. 

So we have not only millions of Federal employees, potential Federal employees, but all of their reference’s information is there as 

well. How many more millions of people are we talking about? 

Have we alerted those people? And what is going to be done to followup on their information as well? 

Ms. ARCHULETA. Thank you for that question. It is an important 

question, and I agree with you totally. I am as upset as you are 

at the fact that these documents or this information has been 

breached. 

Here is what we are doing, as I mentioned in my testimony, and 

why I cannot give a number right now. When we look at, for example, the background investigation, there is a lot of information in 

that. Some of that contains, if there is a—some of it does contain 

personally identifiable information (PII), and some of it does not. 

And so as we are analyzing the type of data that is in these files, 

those are the things that we are looking at, because we care as 

deeply as you do that we notify those who have been affected by 

this, and also understand those who have not been affected, even 

though you may have mentioned them in your SF–86. We are doing 

a complete analysis of that, and that is why I am very hesitant not 
25 

to put out a number until we are absolutely sure we have looked 

at the whole range of possible impact. 

Senator ERNST. Thank you today for the testimony. 

Yes, sir? 

Mr. MCFARLAND. Senator, if I may make one other point? Is it 

all right? 

Senator ERNST. Yes. 

Mr. MCFARLAND. The funding is a prime example of our concern. 

It is all over the board. The situation basically is in 2015 OPM is 

dealing with $32 million. In 2016, they are asking for another appropriation of another $21,000. In the meantime, DHS has provided them $5 million. And the other $67 million from what I understand, is supposed to come from the program areas at OPM. 

That is so sporadic. It just does not hold water from our perspective 

as to having a funding source ahead of time for the full project. It 

is like playing catchup, and the worst part of that is that the OPM 

program offices are going to be tasked to pay for that from their 

program office funds, appropriated funds, for the migration of each 

of their systems, instead of having a big picture of funding very 

clearly for everybody. Plus I think, the OMB is very much in favor 

of having transparency, and this just avoids transparency. It subsumes the money coming from program offices instead of a dedicated source of funding. 

Senator ERNST. Thank you. I think that is an exceptional point. 

Thank you for allowing the additional response. 

Chairman JOHNSON. Thank you, Senator Ernst. I do want to 

point out, as best as I can determine, the information given to me, 

we spend something like $80 billion per year on IT systems in the 

Federal Government. So this is a problem of management; it is a 

problem of prioritization. And that is why I pointed out in my opening statement that this should be a top priority of the Federal Government. If it was made a top priority, there should be plenty of 

funding within the current budget to provide this kind of security. 

Senator Carper. 

Senator CARPER. It has been raised who was behind this hack, 

this latest hack at OPM, this series of hacks, and someone just 

gave me a copy of an article that quotes FBI Director Comey, and 

it says: ‘‘There are two kinds of big companies in the United States. 

There are those that have been hacked by the Chinese and those 

who do not know they have been hacked by the Chinese.’’ 

It goes on to say that, ‘‘They are prolific. Their strategy seems 

to be we will just be everywhere all the time, and there is no way 

they can stop us.’’ 

It goes on to say, ‘‘Bonnie and Clyde could not do a thousand robberies in the same day in all 50 States from their pajamas halfway 

around the world.’’ Those are the words of James Comey. I thought 

I would just share them with all of you today as we reflect on our 

inability to do a perfect job protecting our sensitive information 

within the Federal Government. 

I am going to go from here to a hearing on how do we fund transportation in our country, and I think there is a corollary here, Ms. 

Archuleta, between your failure to be able to come in and in 18 

months to turn this around. I think there is a corollary here, and 

I will just use transportation. I think we need to be fair, OK? I am 
26 

a Navy guy, I think my colleagues know. We have a tradition in 

the Navy. If you are the commanding officer of the ship, your ship 

runs aground in the middle of the night, you were sound asleep in 

your wardroom, we hold the captain responsible. Some people say 

that is not fair, but that is our tradition in the Navy. You are the 

captain of the ship, and so you are held responsible, whether that 

is fair or not. 

Having said that, I am reminded of a situation where let us 

say—and we are not talking about personnel management. Let us 

say we are talking about transportation in our country. We all 

know we have roads, highways, bridges, and transit systems that 

are decrepit, failing, and we need to do something about it. Let us 

say we confirmed a Secretary of Transportation 18 months ago. We 

do not give that Secretary of Transportation the money, which we 

are not doing, that is needed to be able to fix our roads, highways, 

bridges, and transit systems. And not only that, we do not confirm 

a Deputy to be part of the team, the leadership team at the Department of Transportation (DOT). It has been 4 years since we have 

had a Deputy, and, again, in the Navy, you have a commanding officer. You are the commanding officer. The Deputy is the executive 

officer, and this important agency has been without an executive 

officer for 4 years. 

Part of that responsibility is the administration because they did 

not send us somebody, they did not send us a name for a long time. 

But they did last year. They sent us a great guy, a Navy guy, 

Naval Academy, commanded ships, aircraft squadrons, has all 

kinds of credentials, and we need to get him confirmed. This Committee has done its job. Now we have to get him confirmed so you 

have the help that you need. 

In terms of the help that you need, this Committee I think did 

some pretty remarkable things last year in terms of legislation. We 

took the old Federal Information Security Management Act and we 

modernized it. That is being implemented now. We said the Department of Homeland Security does not have the kind of workforce capabilities that they need to hire and retain the sort of talent that the need to fight these cyber wars. We have addressed 

that. You are beginning to use those skills at DHS. 

We took your ops center, the so-called National Cybersecurity 

and Communications Integration Center (NCCIC), and made it 

real. We authorized it, said this is the real deal, and let us just not 

pay attention to them but let us give them the authority they need. 

We said let us look at our Federal information technology and 

our acquisition systems and see what we can do to reform them 

and give them the kind of oomph that they require. We have done 

all those things. We have done all those things. But there are some 

things we have not done. There are some things we have not done. 

I have heard enough on EINSTEIN 3 in the last week that I am 

convinced that that is something we ought to do. And EINSTEIN 

1 and EINSTEIN 2, good start, but 3, 3A is obviously important. 

Andy, I thought you gave us a real good explanation. I want to ask 

you to come back and just explain again external, internal, the idea 

of the building, the locks, the vault inside, and how EINSTEIN 3 

actually interfaces with—I think you called it CDM, the Continued 

Diagnostics and Mitigation approach, which is more like the inside 
27 

protection as opposed to EINSTEIN 2, which is the outside protection. Would you just run that by us again? I thought it was a very 

helpful explanation. 

Mr. OZMENT. Certainly. The most important concept here is the 

concept of defense in-depth, that there is no one tool, no one security measure that solves the security challenge. Just as in a physical building you have multiple layers of security—a fence, guards, 

cameras, locks on doors—you have to have the same in 

cybersecurity. 

EINSTEIN is that perimeter system. It is the fence and the 

guard houses and the cameras around the perimeter of the government. It is equally important that you have security on the inside. 

Agencies have to do more of that internal security based upon their 

unique needs and missions, but Continuous Diagnostics and Mitigation is a program we have to help agencies with that, where we 

are buying capabilities on behalf of those agencies. They choose 

from a menu that suits them and roll it out. And those capabilities 

will come in three phases. 

The first phase is the equivalent of a guard that goes around and 

checks that all the buildings are locked, that all the doors and windows are closed, basic security measures to make sure that they 

are in place. 

The second phase of CDM opens the doors to the buildings and 

checks who is on the inside. Does that person—are they authorized 

to be in this building? Are they doing things that they are permitted to be doing? 

And then the third phase is like a very smart security guard that 

goes around and just says, Hey, I see something unusual, we need 

to look at that, because that behavior, that thing I see inside this 

facility, that does not belong here. 

Those are the three phases of CDM looking inside the building. 

EINSTEIN, which is that perimeter, the first phase was just a 

camera. Here are the cars coming in and out. Record the cars. If 

there is an unusually large number of cars, set off an alarm. 

The second phase added a watch list: Hey, this particular blue 

car is not supposed to enter this facility. Set off an alarm. 

The third phase, which we are currently rolling out, is like a 

gate. It is a guard house and a gate. The gate stops the malicious 

car from entering the facility, but the other great thing is, because 

it is a guard house, we can add different security capabilities to it. 

We can add new cameras. We can add new gates, additional 

guards. It is a platform that we can add new capabilities to over 

time. 

So while we are first focused on rolling it out across the government and building that first gate, we are also looking to the future 

and saying what other capabilities can we add to this guard house. 

Senator CARPER. Excellent explanation. Thank you so much. 

Chairman JOHNSON. Senator Lankford. 

OPENING STATEMENT OF SENATOR LANKFORD 

Senator LANKFORD. Thank you. Thanks for all your preparation 

and being here. I know this is not what you wanted to be able to 

do today. There are lots of other things you would like to be able 

to do outside on a beautiful day like that than be in here with us. 
28 

But we have a lot of things to be able to deal with in the days 

ahead on this. 

Ms. Archuleta, let me clarify a couple things with you. You made 

the statement about the first intrusion, second intrusion, and the 

4.2 is from the first intrusion. So just to clarify, none of the letters 

that have gone out have been connected to the breach dealing with 

the background security, so the letters that went out, all of them 

are related to the first breach, none of those letters related to the 

second. 

Ms. ARCHULETA. That is correct, sir. 

Senator LANKFORD. OK. You and I had an interaction just a couple of days ago, and we were talking about the development of the 

plan. By the way, I mentioned to you we had sent you a letter from 

the Subcommittee that I chair on this Committee, and your staff 

has been very prompt to be able to get back to us on that, and I 

appreciate that, to be able to get back on those details. 

One of the questions I had asked about was the cybersecurity 

plan development. You had mentioned your CIO and the Chief 

Technology Officer (CTO) had led the effort to put this together, 

but one thing I am going to need clarification on, among 

several—and we will reply back to you formally on this—is the contractor that was the adviser, or was there an outside adviser to the 

CIO and CTO when they were putting the cyber plan, or did they 

completely put that plan together in-house? 

Ms. ARCHULETA. No, our plan was developed in-house. The IT security plan was—the IT implementation plan was built in-house. 

Senator LANKFORD. OK. Also in our interaction from a couple of 

days ago, I had asked about the statement that has been made 

about authorizing systems. There are 47 total systems that are out 

there, that there were 11 systems that were reported not authorized at that point. You said, no, 10 of those had been authorized, 

there is one of them that is an outside contractor that has not. 

From the IG’s testimony today, I noticed the statement: ‘‘In 

April, the CIO issued a memorandum that granted an extension of 

the previous authorizations for all systems whose authorization 

had already expired, and for those scheduled to expire through 

September 2016. Should this moratorium on authorizations continue, the agency will have up to 23 systems that have not been 

subject to a thorough security controls assessment. The justification 

for this action was that OPM is in the process of modernizing its 

IT infrastructure and once this modernization is complete, all systems would have to receive new authorizations anyway. While we 

support the OCIO’s effort to modernize its systems, this action to 

extend authorizations is contrary to OMB guidance, which specifically States that an ‘extended’ or ‘interim’ authorization is not 

valid. Consequently, these systems are still operating without a 

current authorization, as they have not been subject to the complete security assessment process that the authorization memorandum is intended to represent. OMB does not require authorizations every 3 years if the agency has a mature continuing monitoring program in place. Our audit work has found that they do 

not.’’ 

So the question is: The authorizations that are in place, are they 

done by fiat basically of the agency saying we are working on this, 
29 

or have they actually gone through the actual authorization process? 

Ms. ARCHULETA. We have worked very closely with OMB, and 

they are aware of the process that we are using on these authorizations, and that understanding where we are in the process of moving toward new systems. So we have complete concurrence with 

OMB on these authorizations. So we are in compliance, and we are 

working on the final one that we noted as rapidly as possible. 

Senator LANKFORD. So the question there on compliance is OMB 

has changed what their typical ruling is—— 

Ms. ARCHULETA. There are circumstances that allow us, because 

of the situation that we are in in terms of migrating and because 

of the legacy of our systems, yes. 

Senator LANKFORD. OK. Mr. McFarland, any comments on that 

at all? 

Mr. MCFARLAND. Well, that is not my understanding. My understanding is that what you just said, Senator, about the continuous 

monitoring exception, if it is mature. OPM does not have a mature 

continuous monitoring program. 

Now, if OMB has made an exception, we have not been notified 

of that. 

Senator LANKFORD. OK. The very rapid path that you had to 

take to deal with credit monitoring, to be able to notify and provide 

credit monitoring for 4 million people at this point, had to come together very quickly. My understanding of the contracting on that, 

you put out on a Thursday, gave 2 days and said anyone who 

wants to bid on this needs to have it finished by Saturday and to 

be able to get the bid on, and you let that out immediately the next 

week on that. The contractor that was involved, is that someone 

that OPM has used before or is familiar with? Or how did this 

process come together that quickly? Because that is something obviously pulling that together extremely fast. 

Ms. ARCHULETA. The contracting office actually does handle that 

process, and on May 28, they posted the RFQ, and it closed on May 

30. And they did receive several responses. We worked first with 

the General Services Administration (GSA) list, and we found that 

there were not vendors on that list that met the requirements that 

we needed, and that is why we moved rapidly. We wanted to be 

sure that we were able to notify individuals very quickly, and that 

is why we used a very rapid turnaround. 

We also find that the companies that were—the types of services 

we were looking for, those companies are used to that type of 

timeline, and so that is why we were able to get the three responses that we did. 

Senator LANKFORD. I do not know what kind of feedback you 

have had so far on this, and this is just one of those rolling—once 

things get hard, they just continue to get harder for a while. But 

the contractor in question that has handled this has dealt with numerous website crashes from, obviously, 4 million people hitting 

their site and has not been able to sustain it. Even some of my own 

staff that have received a letter cannot seem to get on their website 

and to be able to get going on the credit monitoring. So while the 

contractor that was placed in this was fast in the turnaround, they 
30 

do not seem to be able to sustain on the other side of it. Have you 

had any other input on that? 

Ms. ARCHULETA. I am very frustrated by sort of the initial steps 

that the contractor faced, and we are meeting with them on a daily 

basis to improve the services to our employees. Our employees deserve quick answers. They need to begin on a website. If they do 

not, they should not—if they cannot get to a call center employee, 

for example, they should not have to wait on the phone, and that 

is why we instituted a service similar to the Social Security Administration (SSA) where there are callbacks. 

We think it has worked better, but we have learned a lot from 

this and are noting very carefully as we look at the next notifications, what areas we need to improve upon. 

Senator LANKFORD. The questions will be—every agency head 

across the entire Federal family is going to want your notes from 

the past month, because the best thing that we can do is to be able 

to get our technology up to speed so that we have fewer instances 

like this, but also have preparation for when something actually occurs. So I hope you will be able to share some of those very quickly 

written notes, because there is a lot that has to be put into place 

to be able to help clean this up. 

Ms. ARCHULETA. Thank you, sir. 

Senator LANKFORD. Thank you. 

Chairman JOHNSON. Senator Sasse. 

OPENING STATEMENT OF SENATOR SASSE 

Senator SASSE. Thank you, Mr. Chairman. 

Director Archuleta, this is the fourth briefing, I believe, on this 

topic in the last week. It is not surprising that new details keep 

coming out, but I think what is frustrating and confusing for many 

of us is that many core elements of the timeline have shifted over 

the week. So I would like to just walk through a basic timeline of 

events and have you help me understand if we have some of these 

facts correct. 

We heard in one setting this week that March 2014 is when 

OPM was first breached. That is not accurate, is it? 

Ms. ARCHULETA. In March 2014, there was adversarial activity 

in the OPM network that dated back to November 2013, and no PII 

was lost during that. 

Senator SASSE. How was that November 2013 breach detected 

and by whom? 

Ms. ARCHULETA. We detected that adversarial activity, and we 

worked with DHS on the forensics of that. 

Senator SASSE. OK. Dr. Ozment, that is your understanding as 

well? 

Mr. OZMENT. Certainly. I will elaborate on the timeline, if you do 

not mind, because it is quite confusing. There was an incident in 

2014, March 2014, at OPM. DHS has received a tip from an interagency partner and reached out to OPM, and we worked together 

and found that intrusion, as the Director noted, and that intrusion 

dated from November 2013. 

We now, of course, have two incidents or potentially two events 

that are the same incident. The terminology is not great here. 
31 

Senator SASSE. That is an important distinction, though, isn’t it? 

Because the notifications both to the Congress, potentially to folks 

in the White House, and ultimately to whatever the right number 

is, north of 10 million, all those things will be implicated based on 

whether or not there were one or two events. 

Mr. OZMENT. There are clearly two events right now: the Department of Interior Data Center that hosted the 4.2 million OPM personnel records, and the breach at OPM itself where the analysis is 

still occurring to identify how much data was stolen. I think the 

key distinction is, who is the adversary and was it the same adversary in both cases, and for that I would have to defer to law enforcement and intelligence to speak to that. But, clearly two different locations, two different sets of data involved. 

Senator SASSE. Thank you. 

Director Archuleta, you said that the attackers got into OPM’s 

network through a credential that was given to a KeyPoint contract 

employee who was working on background investigations, correct? 

Ms. ARCHULETA. That is correct, sir. 

Senator SASSE. At yesterday’s hearing, we learned that no personally identifiable information was stolen in that breach, but blueprints for the main frame were. Is that your understanding? 

Ms. ARCHULETA. I think we were talking about—I want to be 

sure which one. That was in March 2014. I think there are two different incidences that—— 

Senator SASSE. But what was gotten in November 2013? 

Ms. ARCHULETA. In November of—OK, I am sorry, sir. I misunderstood the question. I apologize. 

Senator SASSE. Thanks. 

Ms. ARCHULETA. As I understand it, in November 2013, while no 

PII was lost, there was an extraction of some manuals. As Donna 

Seymour testified yesterday, as did the representative from DHS, 

those manuals are common manuals that could be bought in a 

store. 

Senator SASSE. And what information was on the main frame 

computers that they got the manuals to? 

Ms. ARCHULETA. I would have to get back with you, sir, on that. 

I do not know exactly. 

Senator SASSE. I believe it has been reported that it was security 

clearance background information. Dr. Ozment, do you think that 

is correct? 

Mr. OZMENT. I would have to defer to OPM on that. 

Senator SASSE. It has been publicly reported that just a few 

months later, in June 2014, USIS, another OPM contractor working on security clearance investigations, reported that it had also 

been breached. Is that correct? 

Ms. ARCHULETA. Yes. 

Senator SASSE. And what was stolen from USIS? 

Ms. ARCHULETA. There was OPM data impacting approximately 

2.6 thousand individuals. 

Senator SASSE. 2.6 thousand? 

Ms. ARCHULETA. Yes. 

Senator SASSE. And that was security clearance information, but 

it was on laptops? 
32 

Ms. ARCHULETA. I believe, sir. I would have to get back with you 

on that. 

Senator SASSE. Earlier this week, you were asked about a separate breach at KeyPoint which was discovered in September 2014. 

We believe in our office that that breach occurred in August 2014 

and that 49,000 security clearance holders’ records were breached. 

Do you think that is accurate? 

Ms. ARCHULETA. The adversarial activity dated back to December 

2013, sir. 

Senator SASSE. OK, but didn’t you just a minute ago say that the 

only thing captured in November and December 2013 was the 

manuals? 

Mr. OZMENT. Sir, I can jump in and speak to that. 

Senator SASSE. Please. 

Mr. OZMENT. The first incident that Director Archuleta is referring to is an incident that was detected in March 2014 at OPM and 

the activity at OPM that was detected in March 2014 dated back 

to November 2013. 

Separately, the activity at USIS, a contractor to both OPM and 

DHS, dated back to April 2013. Separately, the activity at 

KeyPoint dated back to December 2013. 

Senator SASSE. OK. So in addition to that distinction, you said 

in your testimony that there was an October 2014 Interior Department breach. Can you tell me what records were being housed at 

Interior? 

Mr. OZMENT. I would defer to OPM in general, but I—— 

Ms. ARCHULETA. It is the employee personnel records. 

Senator SASSE. So this is all non-security clearance information 

from the Interior breach. 

Ms. ARCHULETA. The 4.2, yes. 

Senator SASSE. OK. And in December 2014, what was the OPM 

breach in December? 

Mr. OZMENT. The breach that was—that started in—my apologies. 

The most recent OPM investigation where OPM is still 

ascertaining which background investigations were compromised 

was detected in April, but the activity ran from May 2014 through 

April, although the intruder was most active on the network from 

June 2014 to January 2015. I am not sure what you are referring 

to with the December 2014 data. 

Senator SASSE. I am trying to confirm that there were security 

clearance background investigations in that breach as well. I think 

one of the reasons we care about this is because in March 2014’s 

breach, we have been told that blueprints to the main frame were 

all that were stolen, and then that same main frame I believe was 

hacked in December 2014. And if that is true, I am wondering if 

any systems that did not have the manuals taken were actually 

hacked with secure background investigation in December 2014. If 

not, calling these mere ‘‘manuals’’ is inaccurate. 

Ms. ARCHULETA. Can we get that information back to you in a 

full list, sir? 

Senator SASSE. Sure. 

Ms. ARCHULETA. So it would describe it. 
33 

Senator SASSE. We have about a 10-page letter to you on Monday, and so we would be grateful for info to that being added to 

that response. 

Ms. ARCHULETA. We are actively responding, sir. Thank you very 

much. 

Senator SASSE. I have more questions, but I will wait until the 

second round, if the Chairman wants to go first. 

Chairman JOHNSON. Thank you, Senator Sasse. 

Dr. Ozment, based on Senator Sasse’s questions, I mean, obviously there has been a lot of activity. You combine the IG reports 

that have been showing the lack of security or the material problems with security. Just trying to get this all straight, it is difficult. 

Is it true that DHS did write a mitigation plan based on that November 2013 attack? 

Mr. OZMENT. Yes, Senator. When DHS’ Incident Response Team 

goes onsite to any incident, as part of their report out of that incident, they say here are some of the steps that we recommend that 

an agency take to bolster its defenses. It is not a complete plan. 

It is not a, ground-up look at a network. It is based on what we 

saw and our time here, we recommend that you make the following 

changes. 

Chairman JOHNSON. OK. I am not sure our Committee has access to that plan, so can you provide that to the Committee, please? 

Mr. OZMENT. I will take that back, sir. 

Chairman JOHNSON. I appreciate that. Rather than start a second round right away, I will just defer to Senator Portman for your 

first round. 

OPENING STATEMENT OF SENATOR PORTMAN 

Senator PORTMAN. Great. Thank you, Mr. Chairman. Thanks for 

having this hearing. It has been very helpful, I think, for all of us 

to have an exchange of information. It has also been very troubling, 

to be frank with you. And, one of my concerns from the start of this 

has been about the nature of the information that these hackers 

have received and specifically information that is very sensitive. As 

was mentioned earlier in the panel, the SF–86 is a form that you 

have to fill out to get a security clearance, and it includes highly 

confidential information, mental health history, issues about your 

personal life and so on that in the wrong hands can be very damaging, not just to that individual but also to our national security. 

And so one of the concerns that I would like to raise with you 

today is the extent to which this information you believe might be 

in the hands of our adversaries, and specifically, what are we going 

to do about that? 

I realize that there are some sensitive matters here being discussed, but I think this has all been sort of out in the public, and 

if there is something you believe should not be discussed in this 

setting—I know the Chairman is very eager to get this information 

also—we would be happy to talk to you about it in a more classified 

setting. 

So my first question, Dr. Ozment, is to you: Are we any closer 

to knowing what the scope of information was that has been 

accessed on this Federal Investigative Services (FIS) systems? Was 

it the SF–86 forms? Was it investigatory notes and supporting doc-
34 

uments? They are also part of background information. And tell us 

what we know about that. 

Mr. OZMENT. Senator Portman, I will start the answer to that 

question, and with your permission, I will ask Director Archuleta 

to complete it. 

Anytime you are trying to assess the impact of an intrusion, you 

have two activities that have to take place. First, the forensic investigators have to figure out essentially where did the adversary 

go, what did they have access to, and what did they do with the 

information they had access to. And you are rarely working with 

full evidence. If you think about a physical crime scene, you are 

looking for fingerprint, you are looking—did somebody leave a halfsmoked cigarette? You are looking for clues, and that is what our 

forensics investigators are doing. It takes time, and sophisticated 

adversaries try to erase their tracks. They wear gloves so they do 

not leave fingerprint. And that is definitely the case here. 

Senator PORTMAN. So what do we know? 

Mr. OZMENT. So what we know is we continue to look at systems 

and see where were the adversaries, were they on the system. We 

then have to work with OPM, and OPM has to say this is what was 

on the system, which means that, we can say the adversary was 

here. They have to be able to say this is what was on the system. 

And I will ask Director Archuleta to speak to that. 

Ms. ARCHULETA. I am glad to speak to that. In early June, our 

forensics teams advised the interagency—well, they advised me, I 

will just say that, they advised me that there was a high confidence that the background investigation records had been compromised. 

Senator PORTMAN. OK. Let me ask you another question. Dr. 

Ozment, there has been some discussion regarding whether these 

adversaries might have manipulated data in the background investigation databases that we have just heard from the Director she 

has high confidence that those have been breached. They could 

have actually manipulated data in our Federal Government systems with regard to these background investigations, for example, 

to change the outcome of a clearance adjudication, remove derogatory information, maybe add derogatory information. 

Can you tell us anything about that possibility? 

Mr. OZMENT. Sir, I can speak broadly. The adversary did have 

the type of access that could allow them to change information. I 

cannot speak to whether that change of information would allow 

them to do any of the things that you have specifically suggested 

there. I will say—— 

Senator PORTMAN. Is it possible? 

Mr. OZMENT. It is possible to change information. The implications of that I cannot speak to. I will say—and I do not want to 

speak for my intelligence community colleagues, but I will repeat 

what they said in a prior session, which is—and law enforcement 

colleagues, which is they view that as unlikely. 

Senator PORTMAN. Is it possible that adversaries responsible for 

the breaches have also manipulated the data in the background investigation data base itself? 

Mr. OZMENT. I can say that the adversaries had the type of access that would allow them to manipulate some types of data. I do 
35 

not know specifically what was on the databases that they had access to. I would have to defer to OPM for that. 

Senator PORTMAN. Yes. Director Archuleta, one thing we talked 

about earlier is why we have not responded more quickly. When 

did you first learn about these breaches? 

Mr. OZMENT. We were notified of the breach that you are describing. The first breach occurred—I will talk about both incidents. The 

first breach occurred in April, and—— 

Senator PORTMAN. April of this year? 

Ms. ARCHULETA. April of this year, and we were notified of the 

high—as I mentioned earlier, we were notified of the second 

breach, the high probability of extraction or exposure in June. 

Senator PORTMAN. So these background investigations we are 

talking about here, the highly sensitive information, we have 

known since June. Is that correct? 

Ms. ARCHULETA. Yes, sir. 

Senator PORTMAN. We did not know before that? 

Mr. OZMENT. No, sir. 

Senator PORTMAN. We talked earlier about your not having met 

with the Director of the FBI despite these incredible discrepancies 

in the information we are receiving from the two agencies. So I 

would hope the conclusion there is that you all are going to get one 

story for the American people. My constituents want to know, including the 10 million people who are wondering. Have you met 

with the Secretary of Defense or the Director of National Intelligence (DNI) about this breach in the background information 

database and the potential impact it could have on their employees? 

Ms. ARCHULETA. I have not met with them personally, no. 

Senator PORTMAN. I would think that would be another obvious 

thing to do. I mean, my concern, again, was the concern I think 

every American should share, which is the most sensitive information and the most important national security agencies has now potentially been compromised. And I would hope that the FBI Director who leads our counterintelligence efforts as well as Secretary 

of Defense and DNI would be involved in this effort. 

Ms. ARCHULETA. May I just say that because I have not met with 

him does not mean that they are not engaged in this effort. The 

intelligence community issues are issues I know that they are 

meeting about, but those are not issues, as I am on the personnel 

records, that I am included in. But I do know that there have been 

meetings about that with them. 

Senator PORTMAN. One final question, and this just sort of comes 

to me as we have been listening today to the testimony, who should 

have this information, the most sensitive information we talked 

about. The Department of Defense (DOD) used to have it. OPM has 

it now. Clearly, with these breaches, this should be revisited. So I 

would ask you, Mr. Scott, do you believe the Department of Defense is a better place to have this sensitive information? Are they 

better prepared to handle it? 

Mr. SCOTT. I have to say, Senator, I am fairly new to the Federal 

Government, and I do not have a comprehensive view at this particular point. This 30-day sprint that we are doing will look across 

a wide range of policy, practice, organization, resourcing, and a 
36 

number of other things, and that certainly we can put on our list 

as something to come back with—— 

Senator PORTMAN. The Federal Investigative Services is a specific area, Mr. Scott. We would appreciate your input as to where 

you think that ought to reside. I do not know if you, Mr. Ozment, 

or you, Ms. Archuleta, have thoughts on that. 

Ms. ARCHULETA. As a suitability agent, I work very closely with 

our security agent and OMB to really discuss the improvements 

that need to be made throughout the Federal investigative background, and we have been working on that together and take very 

seriously that responsibility. I think we do a good job at this, and 

because we do work very closely with our partners on it, especially 

with DOD, to make sure that they are getting the type of background investigations and the quality and the timeliness that they 

deserve, and we are working very hard at that and making improvements all the time to be sure that we are delivering the product they deserve. 

Senator PORTMAN. Thank you. My time has expired. 

Chairman JOHNSON. Thank you, Senator Portman. 

I just want to kind of get the timeline straight on these breaches 

we are talking about that are the subject of this hearing. The 

breach that involved personnel information occurred in December 

2014 and was discovered in April of this year, about 4 months 

later. Is that correct, Director Archuleta? 

Ms. ARCHULETA. Yes, sir. 

Chairman JOHNSON. And the breach that involved all the background information, very sensitive national security background information, that occurred a year ago in June 2014, and basically 

took 12 months to discover. That was actually discovered because 

we implemented some—is it a dual authentication process and we 

actually prevented them from continuing to exfiltrate information? 

Mr. OZMENT. Sir, if you will, I will recapitulate the full set of 

dates, because I think you are right, it is extremely important. 

The Department of Interior Data Center—and as you know, the 

investigation on all of these continues, so we learn new information 

all the time. All of these were discovered due to the April 2015 discovery, so OPM rolled out new security technologies, as they had 

been rolling out new security technologies, detected an intrusion on 

their networks in April 2015. They gave DHS the cyber threat indicators, similar to what is being discussed in information-sharing 

legislation. We used those and identified the breach at the Department of Interior. 

The breach at the Department of Interior, the adversary was on 

the network of the Department of Interior from October 2014 

through April 2015. Specific pieces of data were removed in December 2014. So that is where the December date is coming out, but 

looking at the whole range of when the adversary was on the network, it was October 2014 through April 2015. And I would encourage you to think about as the most relevant timeframe. 

Chairman JOHNSON. OK. 

Mr. OZMENT. At OPM itself, there are really two key timeframes: 

the timeframe when the adversary was on the network, which was 

May 2014 to April 2015; but the time that the adversary was essentially active on the network was only June 2014 through Janu-
37 

ary 2015. OPM rolled out a security control in January 2015 that 

stopped the adversary from taking further significant action, but it 

did not detect the adversary. So the adversary was largely stopped 

in January, but not detected until an additional control was rolled 

out in April. 

Chairman JOHNSON. OK. Again, so we found out in mid-April, 

and we announced this on June 4. The public became aware of this 

on June 4. 

Mr. OZMENT. So in mid-April, we discovered that the adversary 

was on the network, but not what they had done. And so we then 

commenced the forensics work. The forensics work reached a high 

confidence level more rapidly at the Department of Interior. So the 

Department of Interior, they more rapidly finished the forensics— 

or largely finished the forensics investigation and were able to conclude the breach. 

Chairman JOHNSON. OK. So, again, so I understand. That takes 

time. 

Mr. Scott, in your role within OMB as the Federal Government’s 

Chief Information Officer, you did announce the cybersecurity 

sprint last week. I realize you are relatively new in the role, just 

starting in February, and we are not going to solve these problems 

overnight. I have that. Why didn’t we announce a more robust effort right off the bat, basically in April? 

Mr. SCOTT. So we formed an E-Gov Cyber Unit late last year in 

my office, put that team together, worked closely with DHS and so 

on. And I began with that team to look at the cross-government 

data. Some of the elements of what we announced in the sprint we 

actually started before the full sprint was announced. So it has 

been an escalating set of activities. 

Chairman JOHNSON. So, again, you have expressed a fair amount 

of confidence in Director Archuleta and her team to fix this. But, 

again, I go back to the Federal Information Security Management 

Act audits, and, even in fiscal year 2009, in that audit, the first 

page of the executive summary says, ‘‘The lack of policies and procedures was reported as a material weakness in fiscal year 2007 

and fiscal year 2008.’’ 

The weakness in our government security systems has been 

known for a long time. I understand that you do not solve these 

problems overnight. I understand that Director Archuleta has been 

in the office about 18 months. But certainly, having been a manager in the private sector myself—again, I do not expect perfection. 

I understand the problems are difficult to solve. But I am looking 

for people to prioritize. I am looking at people’s actions that they 

took. And the fact that the Director did not meet with the Inspector 

General to specifically discuss these IG reports, the fact that she 

has not yet met with FBI Director Comey on these very serious 

issues really gives me pretty great pause in terms of having confidence that the current management team in OPM really is up to 

the task. 

Do you disagree with that? Do you really have that great a confidence? 

Again, you are the Federal Government’s Chief Information Officer. Do you really have confidence in the management team of 

OPM that they are going to be able to solve this problem when 
38 

they have shown such a lack of attention and priority to this issue? 

And let us face it, a record of failure now. 

Mr. SCOTT. Well, Senator, I think there are several bits of evidence I can go back to, many of which you have mentioned here. 

But the history going back to 2009 and 2010 shows that there has 

been a historical set of issues there. 

If I look in at OPM and elsewhere where progress has been 

made, I can see a delineation point from when Director Archuleta 

took place and recruited Donna Seymour into that role where there 

is a dramatic difference in terms of the actions that not only were 

planned, but then began execution. And I worry in this particular 

case that as we deploy more tools across the Federal Government 

and as we are likely to discover more of these kinds of issues, that 

there is a chilling effect on anybody wanting to come in and take 

one of these roles—— 

Chairman JOHNSON. I understand, and, again, that is a real 

problem. I appreciate that you are willing to exit the private sector, 

with your expertise and bring that to bear in terms of service to 

this Nation. But, again, here is my problem. A Flash Audit on the 

Infrastructure Improvement Project, where the final conclusion is, 

‘‘In our opinion, according to the Inspector General, the project 

management approach for this major infrastructure overhaul is entirely inadequate and introduces a very high risk of project failure.’’ 

That does not give me much confidence in the management team 

that is implementing that. 

Inspector General McFarland, do you have confidence in, based 

on your audits, on the work you have done, do you have confidence 

in OPM’s current management to really follow through on this and 

provide the security I think this Nation deserves? 

Mr. MCFARLAND. I believe that the interest and the intent is 

there, but based on what we have found, no. 

Chairman JOHNSON. I have no further questions. Senator Ayotte. 

OPENING STATEMENT OF SENATOR AYOTTE 

Senator AYOTTE. Thank you. I wanted to ask about—one of my 

staff members received a letter from OPM, and as I understand it, 

in the letter she was asked by a third-party contractor to produce 

information on her credit card and bank accounts, and she was also 

not told about the IRS’ IP PIN program, which we have spent some 

time on in this Committee, which allows taxpayers who are victims 

of identity theft or potential victims to protect themselves. 

So I was kind of troubled when I learned that this morning from 

her just because here we have a situation where all of these 

records have been breached, and if our solution is to ask people to 

submit additional very personal information on credit card bank 

records, that you would then—either you or your third-party contractor would be holding rather than working with potential victims of this to, have them seek the proper mechanism with the 

credit reporting agencies. So can you help me understand this and 

why you think this is a good approach? Because, let us face it, the 

fact that we are where we are with all these records that have now 

been breached, I do not think people should feel real confident at 

the moment of giving you additional information or a contractor 

working with the government on this. 
39 

Ms. ARCHULETA. To my knowledge, Senator, we are not asking 

and so I would like to talk to your—we are not asking for that information, so I would like to talk to your staff member to find out 

exactly what conversation or what information she got, because the 

registration for the credit monitoring is an action that each individual takes. So I would be glad to talk to her. I would like very 

much—— 

Senator AYOTTE. That would be great. I hope she is not already 

being—her information trying—identity thieves already trying to 

manipulate this because—— 

Ms. ARCHULETA. Yes. 

Senator AYOTTE. When she told me that this morning, my jaw 

dropped. And so I want to understand why OPM is not using 

encryption or what steps are being taken to better use encryption 

of people’s information given the breadth of personal information 

that OPM is maintaining on so many of the people in this country. 

Ms. ARCHULETA. Certainly. I wish that our systems, all of our 

systems were able to be fitted with the encryption tools, but we 

have an older legacy system, and there are certain applications 

that it would not—we would not be able to use encryption. And as 

Dr. Ozment will say, the encryption, in fact, would not have prevented this incident. That is an important fact. But that does not 

mean that we should not move forward to indeed apply encryption 

wherever we can, and we are moving forward with that as well as 

using more modern tools such as masking and the hiding of—or redacting of information when it is not needed. 

Senator AYOTTE. Well, encryption is one tool in the toolbox. Does 

OPM employ a layered approach at all? Because, obviously, 

layering is something that is important when you are looking at 

making sure that there are different ways that information is protected as a multi-verification process versus relying on one tool in 

the toolbox. 

Ms. ARCHULETA. I would have to get back with you, Senator, to 

be sure that I can give you the full information. 

Senator AYOTTE. Well, that would be very important, I think, because to me the fact that many of the tools that seem to be lacking 

in the use here are already being engaged in the private sector, yet 

the type of personal information that is being held by an agency 

like OPM is just staggering in terms of what we are hearing about 

the breadth of this breach. So I would like a followup on that question. 

One thing that I want to understand is that, in January, OPM 

began utilizing this two-factor authentication approach and incidentally, and unknowingly, ended the intrusion into the data system containing security clearance information. Do you believe that 

had this been in place to begin with the intrusion would not have 

been able to happen in the first place? 

Ms. ARCHULETA. I would have to ask Dr. Ozment more on the 

forensics side for that, but I know that we have moved very rapidly 

to increase the percentage of unprivileged users with two-factor 

strong—two-factor authentication. We also for remote users have a 

100-percent—I am sorry, that for—we have—requiring two-factor 

authentication for all remote users. 
40 

Senator AYOTTE. And one of the things that I had asked you 

about with my staff member when I told you the information she 

had received—and we touched upon it at the beginning—was something we heard a lot of testimony in this Committee on from the 

IRS Commissioner, because, unfortunately, the IRS has been 

breached as well, and they have this IRS IP PIN Program. It 

strikes me that, given the type of information that has been 

breached in this, the victims of this theft can very much expect 

that they could likely be victims of tax fraud going forward. So 

what steps are you taking to ensure that these victims have actual 

and are enrolled in the IRS IP PIN program to ensure that we are 

not having another hearing on I suppose potentially millions of individuals who now find themselves to be victims of tax fraud as 

well? 

Ms. ARCHULETA. I will ask my colleague Tony Scott to talk about 

that. I am not familiar with the IRS. 

Mr. SCOTT. Yes, the PIN program is actually designed to do a different thing, as I understand it, than would be the use case for 

OPM. But I can answer some of the question that you asked the 

Director. They do have a multilayered approach—— 

Senator AYOTTE. But, Tony—excuse me. I am sorry, Mr. Scott. 

Mr. SCOTT. Yes. 

Senator AYOTTE. But let me just say what the IRS—what I am 

trying to say is this, is that we know all this personal information 

has been breached. People are going to be—that are the victims of 

this will be filing their tax returns. If they are enrolled in the IRS 

PIN program, people cannot just file the tax return. They are then 

given a PIN at their physical address so, therefore, the identity 

thieves cannot then use this information to then victimize them on 

the IRS end. And this would be something, if I were a victim of 

this, that I would want to have put in place right away because 

this could protect me from potential tax fraud because of the extra 

step that has to be taken. 

So how are we working this with the IRS to make sure these victims have access to this program? Because this is a very large 

problem right now. 

Mr. SCOTT. Sure. I am sorry. I misunderstood your question initially. We will look at this cross-agency, not just at the IRS but 

anywhere else citizens need to interact with the Federal Government as part of our longer-term recommendation. 

Senator AYOTTE. So, forgive me, my time is up, but I think looking at it is probably insufficient given how devastating this type of 

use of people’s personal information can be. And I think that we 

cannot just look at it. I think we have to come up with a plan to 

give the people who have been victimized the opportunity to be 

part of this program so they then are not further victimized by becoming victims of tax fraud. 

Thank you. 

Chairman JOHNSON. Senator Sasse. 

Senator SASSE. Director Archuleta, here is where I think we are. 

I think this morning we have heard a sketch of a timeline that 

shows attackers persistently coming after confidential personnel 

and background investigation and OPM being caught flat-footed for 

up to 19 months. Has any malware been detected on OPM’s net-
41 

work since June 8 when the intrusion into security clearance databases was discovered? 

Ms. ARCHULETA. We are unaware of any at this time. 

Senator SASSE. Given how long it took OPM to detect the attacks, how can we know that the attacks are over? 

Ms. ARCHULETA. We worked very closely with our cybersecurity 

experts throughout government, working closely not only with DHS 

but FBI and their hunt teams. So we are constantly monitoring our 

systems. 

Senator SASSE. But couldn’t you have given that same answer in 

March and it would have been wrong? 

Ms. ARCHULETA. As we have developed and installed new security systems—in March 2014? 

Senator SASSE. March 2015 you did not have information—you 

had not discovered these attacks that were then on going. 

Ms. ARCHULETA. We have been working very hard, sir, to put in 

place all of the security measures, and I think in my plan there is 

a long list of things that we have done and been able to do. We 

need more resources to get that done, and that is why we have 

come to Congress to ask for them. 

Senator SASSE. I want to go to Dr. Ozment in a minute, but if 

I can translate, I think what you just said is you do not know that 

the attacks are over. Director Archuleta, I am saying—— 

Ms. ARCHULETA. I am sorry. We—— 

Senator SASSE. You said you are trying hard. That is different 

than having knowledge that the attacks are over. 

Ms. ARCHULETA. Sir, we combat over 10 million attempts in a 

month, and so we are working very hard. I can describe to you each 

of the things that we have done. That is why I gave you the paper 

this morning so that you would have that. We have worked very 

hard to do that not just at OPM but with all of our colleagues. 

Cybersecurity is an enterprise endeavor, and that is why we work 

with Tony and Andy and our colleagues at FBI and National Security Agency (NSA). We do work with them on this. We are combating a very aggressive, a very well funded, and a very focused 

perpetrator. 

Senator SASSE. I agree that we are dealing with persistent 

attackers, but I think you did not say that you have certainty that 

the attacks are over. 

Dr. Ozment, do you believe the attacks are over and that we 

know that with certainty? 

Mr. OZMENT. I spend a lot of time with both government and private sector cybersecurity experts, and I do not think any 

cybersecurity expert I know would ever say that we can be certain 

that we have blocked all intruders who are trying to get into our 

networks. And I think that is the State of the world that we are 

living in right now. It is not a condition unique to OPM. That is 

a universal truth for cybersecurity. 

Senator SASSE. Mr. Scott, has the malware that was found at 

OPM been discovered on any other agency’s networks? 

Mr. SCOTT. I think it is a better question for Andy, but the way 

it works is these indicators of compromise DHS has, and then they 

circulate to all the other agencies. And part of our cyber sprint, we 

have asked agencies to go back and take a look at those. 
42 

Senator SASSE. This is not a blame allocation question—— 

Mr. SCOTT. Right. 

Senator SASSE [continuing]. And not meant to be hostile, but 

isn’t your title senior to his? Help us understand what your role is 

if that is a question for Dr. Ozment. 

Mr. SCOTT. Ours is more policy and guidance. DHS has the operational responsibility in the cyber framework. 

Mr. OZMENT. And, sir, I can tell you that we have, as Mr. Scott 

highlighted, shared these indicators to departments and agencies. 

We have had at least one department think that they had an intrusion, but after further forensics, it turned out not to be the case. 

But we continue to, ask agencies to keep using these indicators, 

keep looking to see if they see activity on their networks. And, of 

course, if anything comes up, we work with the agency to investigate it. But we have not confirmed anything additional 

since—other than this Department of Interior Data Center and 

OPM itself. 

Senator SASSE. So would that mean that any other known Federal intrusions would be visible to this Committee? Are there any 

other cyber attacks against the Federal Government that have not 

been disclosed to this Committee? 

Mr. OZMENT. The FISMA 2014 legislation imposed requirements 

for notifying the Congress on cyber intrusions and attacks. To my 

knowledge, any intrusion and attack that would fall into those requirements has been notified to you. There is a constant low level 

of activity across the government, where sort of the noise of the 

Internet occurs. You have low-level criminal malware. I do not 

know that that is—I would not expect that that is required to be 

reported and is not reported. But the significant activity that is 

covered by FISMA 2014, to my knowledge all of that has been reported to the Congress. 

Senator SASSE. Thank you. I would like to go back to Senator 

Portman’s line of questioning about the SF–86. Director Archuleta, 

there have been many summaries of where we are in this attack 

in the media that have likened this to the Target or the Home 

Depot attack, which is where credit card information was stored. 

Obviously, we are talking about something much more serious than 

that. I want to quote from the SF–86 for a second. 

‘‘In addition to the questions on this form, this inquiry also is 

made about your adherence to security requirements, honesty and 

integrity, vulnerability to exploitation or coercion, falsification, misrepresentation, and any other behavior or activities or associations 

that tend to demonstrate a person is not reliable, trustworthy, and 

loyal.’’ 

As those of us who have been through top secret background investigations know, they ask lots of questions about sexual history, 

relationships, associations, anything that could lead an individual 

to be coerced or blackmailed. Can you help us understand why this 

information would have been stored on OPM networks to begin 

with? 

Ms. ARCHULETA. It is part of the background investigation that 

we do for the clearances at very high levels for classified positions, 

and that is part of the determination for the adjudication information. 
43 

One of the things that is important is that—in understanding 

this scope of this breach is to really understand how that data was 

saved. So I want to be sure, again, as I go back to my opening 

statement, is that we are looking at all of these files to see how 

that data was stored and sort of the impact and scope of that 

breach. And that is why we are taking much more careful time to 

do so. 

Senator SASSE. In the sexual history kinds of questioning, if people named other parties, would those have been in this information? 

Ms. ARCHULETA. It really is relying on the—I actually do not 

know what is stored in which files. I would be glad to get that to 

you to give you a description. I believe that, again, it is how that 

information is stored and what access the breach had to that. 

Senator SASSE. Dr. Ozment, do you think that narrative history 

would be stored? 

Mr. OZMENT. I cannot speak to the contents of the databases. 

Senator SASSE. I think I need to yield to Mr. Carper. I have more 

questions, but I will wait. 

Chairman JOHNSON. Senator Carper. 

Senator CARPER. Thanks. Thank you for yielding. And, again, 

thank you all for being here. I know you have been here for quite 

a while, and we are grateful for your presence and your answers 

to our questions. 

General McFarland, I am going to ask you to come back in a 

minute—and maybe not right now, but in a minute I am going to 

ask you to come back. You shared a cautionary note with us about 

rushing, maybe rushing so far to address this problem, fix this 

problem, that we actually waste money, and you sounded a cautionary note. Why don’t you just go ahead and sound that cautionary note again? What did you say right at the end of your testimony, please? Because we want to move with great dispatch, and 

usually that is good—maybe not always, but you gave us some advice that I thought was probably worth repeating. What did you 

say? 

Mr. MCFARLAND. I said it may sound counterintuitive, but OPM 

must slow down and not continue to barrel forward with this 

project. The agency must take the time to get it right the first time 

to determine the scope of the project, calculate the costs, and make 

a clear plan about how to implement this massive overhaul. OPM 

cannot afford to have the project fail. 

Senator CARPER. Thank you. I mentioned earlier these four legislative steps that we took last year to bolster DHS and their ability 

to fend off government, writ large, cyber attacks: the passage of the 

Federal Information Security Modernization Act; the workforce capabilities, strengthening the workforce capabilities at the Department of Homeland Security; strengthening and making real the ops 

center for the Department of Homeland Security; and also the passage of the Federal Information Technology and Acquisition Reform 

Act (FITARA). 

I think in your testimony here and in other hearings we have 

had, almost everybody says those were the right things to do. I am 

not sure we are fully implementing them as quickly as we need to, 

but at least I think on that front we have done our job. And we 
44 

are going to do oversight to make sure that the implementation is 

being done in an appropriate and expeditious way. 

Give us our to-do list. Give us a very brief to-do list of some 

things on the heels of what we have done legislatively what we 

need to do. What do we need to do next? And just very briefly. 

Director, very briefly. 

Ms. ARCHULETA. Yes, and as I do that, I would like to clarify perhaps a statement that the IG made in terms of the additional resources, an answer that he responded to. We requested $21 million 

in the President’s Fiscal Year 2016 budget, but we are currently reevaluating fiscal year 2016 IT modernization needs in light of these 

developments, and so we would appreciate the Senate’s support. 

And as I said, we will get back to you with that number. 

Senator CARPER. All right. Thanks. 

Mr. Scott, give us one thing that ought to be at the top of our 

to-do list. 

Mr. SCOTT. Sure. I have four very quickly. 

Senator CARPER. OK. 

Mr. SCOTT. The first one is pass the administration’s proposal for 

information sharing with the private sector. It will help everybody. 

It will help the Nation. 

Second—— 

Senator CARPER. I actually introduced, with a slight modification, 

the administration’s proposal, and hopefully we can get that done. 

God knows we need to. 

Mr. SCOTT. Thank you. The second one is do not allow exceptions 

to the FITARA rule. That legislates good governance and good 

practice and helps make the CIO fully accountable in each agency. 

Senator CARPER. OK. 

Mr. SCOTT. We will have recommendations coming out of our 

sprint, and I am sure there will be a reallocation of resource and 

priority as a result of those recommendations. 

Senator CARPER. All right. Thanks. Dr. Ozment. 

Mr. OZMENT. I would second Mr. Scott’s highlighting of 

cybersecurity threat indicator sharing legislation. I would also really emphasize the importance of passing authorizing legislation for 

EINSTEIN. As you know, it played a key role in this incident, and 

it is an important layer in our layers of defense. And one of the 

impediments has been that some agencies are concerned that existing legislation impedes their ability to work with us on EINSTEIN. 

So your clarification of that would be greatly appreciated. 

Senator CARPER. All right. Thanks. 

Mr. McFarland, General, give us one more thing to put at the top 

of our to-do list. These are helpful ideas. 

Mr. MCFARLAND. I would think that it would be very helpful if 

FITARA and FISMA had more teeth to it from OMB’s perspective. 

And instead of getting lists of who is doing this or who is doing 

that, who is delinquent, how far are they delinquent, that there 

would be some accountability against people. 

Senator CARPER. Good. Mr. Scott, would you respond to that, 

please? 

Mr. SCOTT. I think those are good recommendations, Senator. 

Senator CARPER. OK. Given what we all know about the OPM 

breach, can each of you talk about some of the lessons learned, 
45 

kind of looking back, we are all better Monday morning quarterbacks, but some of the lessons learned or the best practices that 

we should be incorporating across the government, and why 

haven’t we already taken these steps at some of the other agencies. 

Do you want to go first on that, Mr. Scott? 

Mr. SCOTT. Sure, I would be happy to. Some of the early things 

in this also leverages my experience in the private sector. If you 

look at where the money has gone and where most of the effort has 

gone, it has been to prevent the cyber attack from occurring in the 

first place. Even with multilayered approaches, most of that has 

been on prevention, but it is very clear with these persistent adversaries that some things are going to get through. They are just 

nasty, and they keep coming at you. And you are always going to 

have at some point somebody getting through. 

And so as a Nation, and especially as a Federal Government, we 

also have to invest in technology that will allow us to quickly detect much more rapidly than we have been when there is a breach, 

then contain, and then quickly remediate. And so some of our recommendations are likely to be in those areas where we have underinvested, even in a history of underinvestment in cyber more 

broadly. 

Senator CARPER. Dr. Ozment, same question, just briefly, if you 

would. 

Mr. OZMENT. I would just second what Mr. Scott said. 

Senator CARPER. That was a short answer. 

The last thing I would say is, to go back to my friend Senator 

Sasse, the question of is this going to be the last attack, we all 

know it is not. Will it be the last attack if this was from the Chinese or some other source? We know it is not. And one of the 

takeaways for me here today is this is an all-hands-on-deck moment; we all have a responsibility. This is a shared responsibility. 

You have yours, we have ours. And we need to not just point fingers at one another, but to actually figure out how to join hands 

and be a team in this all-hands-on-deck moment. And you have my 

pledge to do that, and we are going to bring our best efforts to 

bear, and we need for you to do that as well. 

Thank you. 

Chairman JOHNSON. Thank you, Senator Carper. 

Before I close out the hearing by giving the witnesses one last 

opportunity to make a closing comment, I would like to throw it 

over to Senator Sasse. You said you have another quick question 

or two? 

Senator SASSE. Yes, if I could just take 3 minutes, Mr. Chairman. 

First, following upon what Senator Carper just said, Mr. Scott, 

did OMB give OPM permission to operate without proper 

cybersecurity protections? 

Mr. SCOTT. I am not aware of any either giving or denying permission in that particular case. What we are doing is revising our 

guidelines. There was an every-3-year authorization thing earlier, 

and that is under review right now. And we did issue guidance that 

allowed for more continuous authorization versus a 3-year. But 

that is subject to revision. 

Senator SASSE. Thank you. 
46 

Dr. Ozment, did you understand—you are now being brought in 

to help cleanup this matter from DHS, but did DHS understand 

OPM’s vulnerabilities prior to them being breached? 

Mr. OZMENT. One of DHS and my organization’s roles is to help 

compile the annual FISMA report to Congress, some of which we 

were handed today or presented today. As part of that, we compile 

agencies’ self-reported information on their cybersecurity, and all 

agencies have vulnerabilities, just as all companies have 

vulnerabilities. 

To my knowledge, we were not aware of any specific 

vulnerabilities that were relevant to this incident, but we are generally aware that all agencies need to make additional progress on 

cybersecurity. 

Senator SASSE. But given some of the specific vulnerabilities at 

OPM, do you believe that OPM was fully honest about its problems 

with DHS leading up to the breach? 

Mr. OZMENT. To my knowledge, yes. 

Senator SASSE. I will close with this last question. The Inspector 

General has criticized OPM for operating a ‘‘decentralized system’’ 

of cybersecurity because it created unique vulnerabilities. Could 

you explain what that means and tell us if you think any other 

agencies are currently operating with similarly decentralized systems? Dr. Ozment, I mean it for you, but I did not know—the Inspector General leveled the criticism, but I am curious as to whether or not you think other agencies have the same vulnerability. 

Mr. OZMENT. I am sorry. Would you repeat the entire question? 

I apologize. 

Senator SASSE. You bet. The Inspector General has criticized 

OPM for operating with a ‘‘decentralized system’’ of cybersecurity 

which created some unique vulnerabilities. One, I wonder if you 

can translate what that means. And, two, I wonder if you think 

any other agencies have the same decentralized system. 

Mr. OZMENT. Thank you. I absolutely believe that it is very difficult for an agency to secure themselves if their CIO and CISO at 

the agency level are not empowered. I know that that is a concern 

that in part prompted, in fact, the FITARA legislation, and I think 

that is the crux of the matter. If they are not sufficiently empowered, if IT authority is decentralized within the agency, it is extremely difficult for that agency to secure itself. 

Senator SASSE. So I think that means you think that many agencies have the same problem. 

Mr. OZMENT. I think there are other agencies that need to make 

progress in that area, absolutely. 

Senator SASSE. Thanks. 

Chairman JOHNSON. Thank you, Senator Sasse. 

Again, I would like to offer the witnesses one last opportunity if 

you have a closing thought or comment. We will start with you, 

Madam Director. 

Ms. ARCHULETA. Thank you, Chairman. I appreciate the opportunity to be here today. 

I would like to take the opportunity to clarify earlier comments 

to Senator McCain about the 18 million number. The 18 million refers to the preliminary approximate number of unique Social Security numbers. It comes from one of the compromised systems. How-
47 

ever, it is incomplete, and it does not provide an accurate picture 

of the final number, and it is one system among several, and the 

number has not been cross-checked against the other relevant systems. 

In closing, I would state that, again, we are reevaluating our fiscal year 2016 needs. We are not seeking a fiscal year 2015 supplemental. And, again, I appreciate the opportunity to be here with 

you today. 

Chairman JOHNSON. Thank you. Mr. Scott. 

Mr. SCOTT. Thanks for having us today. I look forward to coming 

back to the Committee with our recommendations at the end of the 

30-day sprint period and would love to engage in a further conversation with you at that point. 

Chairman JOHNSON. Thank you. Dr. Ozment. 

Mr. OZMENT. Thank you. Upon reflection, I would like to add to 

my answer to Senator Tester about Federal cybersecurity strategy. 

We have the skeleton of our path forward, and we can and should 

move out and execute on that skeleton. 

I do think there is also value in continuing to flesh out that skeleton, and, in fact, I hope that that is—the 30-day surge will help 

us do that. 

I would also thank Senator Carper again for his remarks and reiterate the importance of information-sharing legislation and also 

positive authorization for the EINSTEIN program. 

Chairman JOHNSON. Thank you, Doctor. Inspector General 

McFarland. 

Mr. MCFARLAND. Yes, I would like to go back to Senator Sasse’s 

recent comment and suggest that we work very hard to centralize 

the governance of information technology whenever and wherever 

possible. 

Chairman JOHNSON. Thank you, Inspector General. Again, thank 

you for your service. Thank you for your independence. 

Mr. MCFARLAND. Thank you. 

Chairman JOHNSON. I want to thank all the witnesses for the 

time you have spent, for your thoughtful testimony, and your answers to our questions. 

The hearing record will remain open for 15 days until July 10 

at 5 p.m. for the submission of statements and questions for the 

record. 

This hearing is adjourned. 

[Whereupon, at 11:59 a.m., the Committee was adjourned.] 

(49) 

A P P E N D I X 
50 
51 
52 
53 
54 
55 
56 
57 
58 
59 
60 
61 
62 
63 
64 
65 
66 
67 
68 
69 
70 
71 
72 
73 
74 
75 
76 
77 
78 
79 
80 
81 
82 
83 
84 
85 
86 
87 
88 
89 
90 
91 
92 
93 
94 
95 
96 
97 
98 
99 
100 
101 
102 
103 
104 
105 
106 
107 
108 
109 
110 
111 
112 
113 
114 

Æ