On June 4, 2015, the U.S. Office of Personnel Management (OPM) revealed that a cyber intrusion into its information technology systems and data "may have compromised the personal information of [approximately 4.2 million] current and former Federal employees." Later in June, OPM reported a separate cyber incident, which it said had compromised its databases housing background investigation records and resulted in the theft of sensitive information of 21.5 million individuals. The OPM breach, one of the largest reported on federal government systems, was detected partly through the use of the Department of Homeland Security's (DHS's) Einstein systemâan intrusion detection system that "screens federal Internet traffic to identify potential cyber threats." Reportedly, the hackers used compromised security credentialsâthose assigned to a KeyPoint Government Solutions employee, a federal background check contractor working on OPM systemsâto exploit OPM's systems and gain access. Officials do not believe that the intruders are still in the system. In the aftermath of the intrusions, Katherine Archuleta has stepped down as the director of OPM amid criticisms of how the agency managed its response to the intrusions and secured its information systems. Beth Cobert has taken on the role of acting director. In addition, OPM's Electronic Questionnaires for Investigations Processing (e-QIP) application, the "web-based automated system that was designed to facilitate the processing of standard investigative forms used when conducting background investigations," has been taken offline for "security enhancements." Notably, as is common with data breaches, a vailable information on the recent OPM breach developments remains incomplete. Assumptions about the nature, origins, extent, and implications of the data breach may change, and some media reporting may conflict with official statements. Policymakers have received official briefings on the breach developments, and Congress has held a number of hearings on the issue. This report provides an overview of the current understanding of the recent OPM breaches, as well as issues and questions raised about the source of the breaches, possible uses of the information exfiltrated, potential national security ramifications, and implications for the cybersecurity of federal information systems. Information released in June 2015 regarding the first OPM breach indicates that hackers gained access to personal information including "employees' Social Security numbers, job assignments, performance ratings and training information." The second reported breach involved the theft of data on 19.7 million current, former, and prospective employees and contractors who applied for a background investigation in 2000 or after using certain OPM forms. This second breach also impacted personal information of 1.8 million non-applicants; OPM notes that these non-applicants are primarily individuals married to or otherwise cohabitating with background investigation applicants. OPM confirmed that "the usernames and passwords that background investigation applicants used to fill out their background investigation forms were also stolen." About 1.1 million stolen records also include fingerprints. Notably, the two breaches revealed in June 2015 are not the first incidents targeting OPM databases containing such sensitive information. In a previous 2014 breach of OPM, hackers purportedly targeted "files on tens of thousands of employees who [had] applied for top-secret security clearances." Determining an actor (and actor's motivation) involved in a cyber incident can help guide how the United States responds. If a perpetrator is believed to be motivated by profit or economic advantage, the investigation and response may be led by law enforcement using the tools of the criminal justice system. If the perpetrator is deemed to be a state-sponsored actor with a different motivation, the United States may utilize diplomatic or military tools in its response. Speaking at an intelligence conference on June 24, 2015, Admiral Michael Rogers, director of the National Security Agency and head of U.S. Cyber Command, declined to discuss who might be responsible for the attacks, stating "I'm not [going to] get into the specifics of attribution.... That's a process that we're working through on the policy side. There's a wide range of people, groups and nation states out there aggressively attempting to gain access to that data." Speaking at the same conference a day later, however, Director of National Intelligence James Clapper identified China as the "leading suspect" in the attacks. Mr. Clapper expressed grudging admiration for the alleged hackers, noting "[y]ou have to kind of salute the Chinese for what they did.... You know, if we had an opportunity to do that, I don't think we'd hesitate for a moment." Without explicitly denying involvement, China has called speculation about its role in the OPM breaches neither "responsible nor scientific." In late June 2015, top officials from the United States and China met in Washington, DC, for the annual session of the U.S.-China Strategic & Economic Dialogueâthe two countries' most high-level dialogue. The dialogue included discussion of cyber issues, but progress on these issues was not mentioned among the dialogue's official "outcomes." China said in early July that it was "imperative to stop groundless accusations, step up consultations to formulate an international code of conduct in cyberspace and jointly safeguard peace, security, openness and cooperation of the cyber space through enhanced dialogue and cooperation in the spirit of mutual respect." Of note, the United States in May 2014 filed criminal charges over a set of computer intrusions allegedly from China. The U.S. Department of Justice indicted Â  five members of China's People's Liberation Army (PLA) for commercial cyber espionage that allegedly targeted five U.S. firms and a labor union. It was the first, and so far only, time the United States has filed criminal charges against known state actors for cyber economic espionage. Criminal charges appear to be unlikely in the case of the OPM breach. As a matter of policy, the United States has sought to distinguish between cyber intrusions to collect data for national security purposesâto which the United States deems counterintelligence to be an appropriate responseâand cyber intrusions to steal data for commercial purposesâto which the United States deems a criminal justice response to be appropriate. Describing discussions with Chinese officials at the July 2013 session of the annual U.S.-China Strategic & Economic Dialogue, a month after Edward Snowden made public documents related to U.S. signals intelligence, a senior Obama Administration stated, "[W]e were exceptionally clear, as the President has been, that there is a vast distinction between intelligence-gathering activities that all countries do and the theft of intellectual property for the benefit of businesses in the country, which we don't do and we don't think any country should do." The OPM breach so far appears to be seen in the category of intelligence-gathering, rather than commercial espionage. If the United States chooses to respond in other ways to intrusions from China, experts have suggested that China has multiple vulnerabilities that the United States could exploit. "China's uneven industrial development, fragmented cyber defenses, uneven cyber operator tradecraft, and the market dominance of Western information technology firms provide an environment conducive to Western CNE [computer network exploitation] against China," notes one scholar of Chinese cyber issues. It remains unclear how data from the OPM breaches might be used if they are indeed now in Chinese government hands. Experts in and out of government suspect that "China may be trying to build a giant database of federal employees" that could help identify U.S. officials and their roles. Writing in Wired magazine, Senator Ben Sasse observed, "China may now have the largest spy-recruiting database in history." There have been suggestions that information exposed in the breaches "could be useful in crafting 'spear-phishing' e-mails, which are designed to fool recipients into opening a link or an attachment so that the hacker can gain access to computer systems." In addition to being used by nation states, a trove of data from breaches such as those at OPM can provide a number of avenues for criminals to exploit. For instance, compromised Social Security numbers and other personally identifiable information (PII) may be used for identity theft and financially motivated cybercrime, such as credit card fraud. However, experts have been skeptical as to whether compromised information from the OPM breaches will even appear for sale in the online black market. When cybercriminals have tried in the underground markets to pass off other stolen data as that coming from the OPM breaches, this has been debunked, and the stolen data were shown to have come from other sources. The lack of stolen OPM data appearing in the criminal underworld has led some to speculate the breaches were more likely conducted for espionage rather than criminal purposes. Nonetheless, even if data were stolen for non-criminal purposes, they could still fall into criminal hands. While discussion about the stolen fingerprint information has been limited, analysts have begun to question how this data could be used. Some have speculated that if the fingerprints are of high enough quality, there may be "acutely negative long-term consequences for individuals affected and their future use of fingerprints to verify their identities." Depending on whose hands the fingerprints come into, they could be used for criminal or counterintelligence purposes. For instance, they could be trafficked on the black market for profit or used to reveal the true identities of undercover officials. Also a concern is that biometric data such as fingerprints cannot be reissuedâunlike other identifying information such as Social Security numbers. This could make recovery from the breach more challenging for some. Reports have emerged indicating that OPM had attempted to take over the administration of Scattered Castlesâthe intelligence community's (IC's) database of sensitive clearance holdersâand create a single clearance system for government employees.