Cyber Intrusion into U.S. Office of Personnel Management: In Brief
Released: 2015-07-17T00:00:00

On June 4, 2015, the U.S. Office of Personnel Management (OPM) revealed that a cyber intrusion into its information technology systems and data "may have compromised the personal information of [approximately 4.2 million] current and former Federal employees." Later in June, OPM reported a separate cyber incident, which it said had compromised its databases housing background investigation records and resulted in the theft of sensitive information of 21.5 million individuals.

The OPM breach, one of the largest reported on federal government systems, was detected partly through the use of the Department of Homeland Security's (DHS's) Einstein systemâan intrusion detection system that "screens federal Internet traffic to identify potential cyber threats." Reportedly, the hackers used compromised security credentialsâthose assigned to a KeyPoint Government Solutions employee, a federal background check contractor working on OPM systemsâto exploit OPM's systems and gain access. Officials do not believe that the intruders are still in the system.

In the aftermath of the intrusions, Katherine Archuleta has stepped down as the director of OPM amid criticisms of how the agency managed its response to the intrusions and secured its information systems. Beth Cobert has taken on the role of acting director. In addition, OPM's Electronic Questionnaires for Investigations Processing (e-QIP) application, the "web-based automated system that was designed to facilitate the processing of standard investigative forms used when conducting background investigations," has been taken offline for "security enhancements."

Notably, as is common with data breaches, a vailable information on the recent OPM breach developments remains incomplete. Assumptions about the nature, origins, extent, and implications of the data breach may change, and some media reporting may conflict with official statements. Policymakers have received official briefings on the breach developments, and Congress has held a number of hearings on the issue. This report provides an overview of the current understanding of the recent OPM breaches, as well as issues and questions raised about the source of the breaches, possible uses of the information exfiltrated, potential national security ramifications, and implications for the cybersecurity of federal information systems.

Exposed and Compromised Data

Information released in June 2015 regarding the first OPM breach indicates that hackers gained access to personal information including "employees' Social Security numbers, job assignments, performance ratings and training information." The second reported breach involved the theft of data on 19.7 million current, former, and prospective employees and contractors who applied for a background investigation in 2000 or after using certain OPM forms. This second breach also impacted personal information of 1.8 million non-applicants; OPM notes that these non-applicants are primarily individuals married to or otherwise cohabitating with background investigation applicants. OPM confirmed that "the usernames and passwords that background investigation applicants used to fill out their background investigation forms were also stolen." About 1.1 million stolen records also include fingerprints.

Notably, the two breaches revealed in June 2015 are not the first incidents targeting OPM databases containing such sensitive information. In a previous 2014 breach of OPM, hackers purportedly targeted "files on tens of thousands of employees who [had] applied for top-secret security clearances."

Attribution and Links to China?

Determining an actor (and actor's motivation) involved in a cyber incident can help guide how the United States responds. If a perpetrator is believed to be motivated by profit or economic advantage, the investigation and response may be led by law enforcement using the tools of the criminal justice system. If the perpetrator is deemed to be a state-sponsored actor with a different motivation, the United States may utilize diplomatic or military tools in its response.

Speaking at an intelligence conference on June 24, 2015, Admiral Michael Rogers, director of the National Security Agency and head of U.S. Cyber Command, declined to discuss who might be responsible for the attacks, stating "I'm not [going to] get into the specifics of attribution.... That's a process that we're working through on the policy side. There's a wide range of people, groups and nation states out there aggressively attempting to gain access to that data." Speaking at the same conference a day later, however, Director of National Intelligence James Clapper identified China as the "leading suspect" in the attacks. Mr. Clapper expressed grudging admiration for the alleged hackers, noting "[y]ou have to kind of salute the Chinese for what they did.... You know, if we had an opportunity to do that, I don't think we'd hesitate for a moment."

Without explicitly denying involvement, China has called speculation about its role in the OPM breaches neither "responsible nor scientific." In late June 2015, top officials from the United States and China met in Washington, DC, for the annual session of the U.S.-China Strategic & Economic Dialogueâthe two countries' most high-level dialogue. The dialogue included discussion of cyber issues, but progress on these issues was not mentioned among the dialogue's official "outcomes." China said in early July that it was "imperative to stop groundless accusations, step up consultations to formulate an international code of conduct in cyberspace and jointly safeguard peace, security, openness and cooperation of the cyber space through enhanced dialogue and cooperation in the spirit of mutual respect."

Of note, the United States in May 2014 filed criminal charges over a set of computer intrusions allegedly from China. The U.S. Department of Justice indicted Â five members of China's People's Liberation Army (PLA) for commercial cyber espionage that allegedly targeted five U.S. firms and a labor union. It was the first, and so far only, time the United States has filed criminal charges against known state actors for cyber economic espionage.

Criminal charges appear to be unlikely in the case of the OPM breach. As a matter of policy, the United States has sought to distinguish between cyber intrusions to collect data for national security purposesâto which the United States deems counterintelligence to be an appropriate responseâand cyber intrusions to steal data for commercial purposesâto which the United States deems a criminal justice response to be appropriate. Describing discussions with Chinese officials at the July 2013 session of the annual U.S.-China Strategic & Economic Dialogue, a month after Edward Snowden made public documents related to U.S. signals intelligence, a senior Obama Administration stated, "[W]e were exceptionally clear, as the President has been, that there is a vast distinction between intelligence-gathering activities that all countries do and the theft of intellectual property for the benefit of businesses in the country, which we don't do and we don't think any country should do." The OPM breach so far appears to be seen in the category of intelligence-gathering, rather than commercial espionage.

If the United States chooses to respond in other ways to intrusions from China, experts have suggested that China has multiple vulnerabilities that the United States could exploit. "China's uneven industrial development, fragmented cyber defenses, uneven cyber operator tradecraft, and the market dominance of Western information technology firms provide an environment conducive to Western CNE [computer network exploitation] against China," notes one scholar of Chinese cyber issues.

Uses of Stolen OPM Data

It remains unclear how data from the OPM breaches might be used if they are indeed now in Chinese government hands. Experts in and out of government suspect that "China may be trying to build a giant database of federal employees" that could help identify U.S. officials and their roles. Writing in Wired magazine, Senator Ben Sasse observed, "China may now have the largest spy-recruiting database in history." There have been suggestions that information exposed in the breaches "could be useful in crafting 'spear-phishing' e-mails, which are designed to fool recipients into opening a link or an attachment so that the hacker can gain access to computer systems."

In addition to being used by nation states, a trove of data from breaches such as those at OPM can provide a number of avenues for criminals to exploit. For instance, compromised Social Security numbers and other personally identifiable information (PII) may be used for identity theft and financially motivated cybercrime, such as credit card fraud. However, experts have been skeptical as to whether compromised information from the OPM breaches will even appear for sale in the online black market. When cybercriminals have tried in the underground markets to pass off other stolen data as that coming from the OPM breaches, this has been debunked, and the stolen data were shown to have come from other sources. The lack of stolen OPM data appearing in the criminal underworld has led some to speculate the breaches were more likely conducted for espionage rather than criminal purposes. Nonetheless, even if data were stolen for non-criminal purposes, they could still fall into criminal hands.

While discussion about the stolen fingerprint information has been limited, analysts have begun to question how this data could be used. Some have speculated that if the fingerprints are of high enough quality, there may be "acutely negative long-term consequences for individuals affected and their future use of fingerprints to verify their identities." Depending on whose hands the fingerprints come into, they could be used for criminal or counterintelligence purposes. For instance, they could be trafficked on the black market for profit or used to reveal the true identities of undercover officials. Also a concern is that biometric data such as fingerprints cannot be reissuedâunlike other identifying information such as Social Security numbers. This could make recovery from the breach more challenging for some.

National Security Implications

Reports have emerged indicating that OPM had attempted to take over the administration of Scattered Castlesâthe intelligence community's (IC's) database of sensitive clearance holdersâand create a single clearance system for government employees. Although the IC refused out of concerns of increased vulnerability to hacking, news reports allege that some sharing of information between systems was underway by 2014. U.S. officials have denied that Scattered Castles was affected by the OPM hack, but they have neither confirmed nor denied that the databases were linked.

If the IC's database were linked with OPM's, this could potentially help the hackers gain access to intelligence agency personnel and identify clandestine and covert officers. Even if data on intelligence agency personnel were not compromised, the hackers might be able to use the sensitive personnel information to "neutralize" U.S. officials by exploiting their personal weaknesses and/or targeting their relatives abroad. Access to the IC's database could also reveal the process and criteria for gaining clearances and special access, allowing foreign agents to more easily infiltrate the U.S. government.

Some in the national security community have compared the potential damage of the OPM breaches to U.S. interests to that caused by Edward Snowden's leaks of classified information from the National Security Agency. Yet the potential exists for damage beyond mere theft of classified information, including data manipulation or misinformation. While there is no evidence to suggest that this has happened, hackers would have had the ability, some say, while in U.S. systems to alter personnel files and create fictitious ones that would have gone undetected as far back as 2012. Another concern is the possibility for data publication, as was done with the Snowden records. Dissemination of sensitive personnel files could damage the ability of clearance holders to operate with cover, and could open them up to potential exploitation from foreign intelligence agents.

Protecting Federal Information Systems

The cybersecurity of most federal information systems is governed by the Federal Information Security Management Act (FISMA, 44 U.S.C. Â§3551 et seq.), which was updated at the end of the 113 th Congress ( P.L. 113-283 ). The update gave explicit operational authority to DHS for implementation, including the authority to issue binding operational directives, and it set requirements for breach notification for federal agencies. In addition, 40 U.S.C. Â§11319, as added by P.L. 113-291 , provided agency chief information officers (CIOs) with additional budgeting and program authorities. A potential question for Congress is whether those and other provisions of law give agencies the legislative authority and resources they need to adequately address the risks of future intrusions. Among the specific questions Congress might consider are the following:

Are the current authorities and requirements under FISMA sufficient, if fully implemented, to protect federal systems from future intrusions such as the most recent OPM intrusions? If not, what changes are needed to sufficiently reduce the level of risk? For example, should the priority level for cybersecurity be elevated with respect to other aspects of mission fulfillment; should the federal government adopt the explicit goal of being assessed by independent experts as having world-class cybersecurity? What are the barriers to improving federal cybersecurity to a level that would sufficiently reduce the risks of incidents such as the breaches at OPM, and what legislative actions are needed to remove them? For example, do agency heads, responsible for cybersecurity under FISMA, have sufficient understanding of cybersecurity to execute those responsibilities effectivelyâa broadly held concern with respect to private-sector chief executive officers that the National Institute of Standards and Technology (NIST) Cybersecurity Framework was designed in part to help address? Are the recent amendments to CIO authorities sufficient for them to implement their cybersecurity responsibilities under FISMA? Does DHS have sufficient authorities to protect federal civilian systems under its statutory responsibilities? For example, should it have greater legislative authority to deploy countermeasures on federal systems, as some legislative proposals would provide? Are the specific actions taken and proposed by the Obama Administration in the wake of the OPM breaches, such as the "cybersecurity sprint" and the proposed strategy and acquisition guidance initiatives, sufficient to provide the required improvements in cybersecurity at federal agencies?

Congress is currently considering legislation to reduce perceived barriers to information sharing among private-sector entities and between them and federal agencies. An additional potential question for Congress is whether the protections outlined in the proposed bills against inadvertent disclosure by federal agencies will be sufficient in the wake of breaches such as those involving OPM.