Slashdot Mirror
More Than 22 Million People's Data Compromised By OPM Hack
OutOnARock writes with news that the Office of Personnel Management data breach reported earlier this month was actually far worse than earlier estimates had it; in all, it seems that more than 22 million people (not all of them government employees) had personal information compromised by the breach. From Yahoo News's coverage: That number is more than five times larger than what the Office of Personnel Management announced a month ago when first acknowledging a major breach had occurred. At the time, OPM only disclosed that the personnel records of 4.2 million current and former federal employees had been compromised.
Peasants you know what to do!
What's their bank account number?
We need to ask ourselves, would this incident have even happened if they had been using OpenBSD? It's hard to say for sure, since details about this incident are scant. But we do know that OpenBSD is designed from the ground-up to be as secure as possible, and its developers put an immense focus on security. It has proven itself to be among the most secure, yet still practical, operating systems, if not the most secure for general-purpose computing. So when one has to put together a server or even an entire network, and security is a real concern, then I think that OpenBSD is the only viable option available.
My two-hour background investigation interview lasted four hours because the bureaucrats in Washington couldn't understand how one person can have multiple jobs. After being out of work for two years (2009-2010), underemployed for six months (working 20 hours per month) and filing for Chapter Seven bankruptcy in 2011, don't you think a person would work a regular Monday-Friday job and a weekend job to get his finances in better shape? Meh...
Enjoy my case file, hackers! I hope your head explodes from my employment misery!
for everyone to read
I believe that brings the total number of people compromised in the past few years up to about, oh, a hundred million.
Only the Civ Gov side.
So, only one of the five spy agencies you know about.
-- Tigger warning: This post may contain tiggers! --
22 million government workers get hacked probably because some anus site got SQL injected.
The NSA spends no time auditing it's own systems to protect American citizens, and All of it's time spying on Americans and "terrorists"
If the NSA's mission is to truely defend America, how come sensitive government systems are still prone to SQL injection?
Let this all sink in.
This database should contain all the personal details on spies. If this was stolen by China, why haven't we heard about every spy being pulled out of China and Russia? They are friend-enemies after all.
Any chance this hack done by the NSA to help get more funding and show the Americans how much they are needed to keep us safe? The NSA would know all the details of how the OPM works. Easy target.
Go into a big Chinese bank. What do you see? Most of the computers used for operations are still running XP. Hacking old Win 2003 servers in China from the US might not be very difficult. There are A LOT of Win 2003 servers in China. If you use these computers to launch an attack, who isn't going to believe those uber-smart Chinese have hacked us again?
If the Chinese actually have this data, there should be a huge reaction. I haven't see it. 1,000's to 10,000's of Americans at the embassies and working abroad should have run back to the US on very short notice. We should be hearing how our spying has been set back 20 years. Things are WAY too quiet It doesn't make sense to me.
Money? Forget money.
This is about the Chinese using blackmail against government employees with security clearances. They're on a war-footing.
If only there were some person responsible for making sure the USA were protected against these sorts of threats.
Even FireFox textarea elements spell check for you. Maybe timothy is using IE6?
The US gov seemed to have really understood all the issues the UK and other nations had with selecting and sorting cleared staff from the UK security issues of the 1930's to 1980's.
Full background interviews, real cleared US gov staff looking deep into a persons submitted life story and the looking at the facts on the ground anywhere in the US.
Life story, education, friends, mail, reading material, calls logs all allowed the US gov to select the more useful and smart people for sensitive positions.
Over the past decade the move was to finding staff with unique skills quickly and trying to ensure US security paperwork was not going to be any issue for contractors, ex staff, former staff, people moving from the private sector into gov or gov into the private sector. All while keeping or re using past security access.
The US gov and mil could ensure skilled staff from the public and private sector where ready, could be found and sorted regionally and quickly for any task in or out of the USA.
The problem for the US gov is it needed so many contractors quickly and hoped remote digital files could 'clear' a boss and their new company or past contractor/mil/gov staff for new gov/mil/contractor work.
Vast new online digital databases allowed for lucrative jobs to be handed out and any security issues to fixed quickly.
The down side of this rapid system what what is what was fully understood by the US, UK, Australian and many other nations since the 1950's from their WW2 and 1930's security issues. Dont hire or create security in haste and keep the files away from all other people in gov, mil, private sector and other nations. How or why the US gov ever let go if its most secure files for national remote access is a real mystery.
Other nations who kept their files safe from new contractors needs and within the gov seemed to have understood the issues of rapid security expansion expansion and all the remote database issues. Why did the US gov and mil think it was a good idea or safe to allow complex files of that nature to just move regional and national networks from the mid 1990's on?
Domestic spying is now "Benign Information Gathering"
Love won, and bigots lost. Cry some more, bigot.
That will happen. It is only a matter of time.
So the NSA is clearly useless, and making the situation worse. They are not, and cannot protect us electronically. Instead, they are collecting all of our information and storing it for the inevitable hack that will give it to the rest of the world. The first question I ask when I'm asked to secure data is: "Do we actually need this data?" You can't steel what doesn't exist. Why the hell did this agency have data on people going back to the 1980s? Why is the NSA collecting data on all of us? It's a pointless endeavor that's putting us all at risk.
You don't need to be in love to get married. There's no requirement to prove love. Long term cohabitiating couples, homo or hetero don't need government validation of their relationships.
This is about recognition for benefits and property rights, though the latter was often done by homosexual couples through LLCs for joint property.
Bring back the old version of slashdot.
OPM is pretty legendary in federal circles as basically the sort of federal agency that inspired the bureaucrat jokes on Futurama. The only way to "reform" them is to just scuttle the agency and transfer its functions to the various departments. The Office of the Director of National Intelligence should get the investigators and that authority. Civil service management should be a per-department issue. Managing retirees' benefits could easily just be contracted out to whatever private companies already manage the asset pool of the pension funds. The federal retirees I know would love to deal with a bank rather than OPM. Why? A bank would actually give a shit about processing their communications in a timely fashion.
While we're off topic, we might as well mention that the majority of straight people holding hands and shouting "Hurray! Love wins!" were making gay jokes 20 years ago. Most folk have always thought the notion of gay sex was disgusting (at least between 2 men or 2 "ugly" women). If there were really such a large number of people who advocated it, ssm would've been legalized a looooong time ago. No. It was a farce that people fell for, because they were duped into thinking everyone else wanted it, and it snowballed. Good job, lemmings of America. You've made us the most fickle nation on Earth. Now, all this talking has made me thirsty. Hey! Why does this koolaid taste like semen?
That will happen. It is only a matter of time.
Haven't you been paying attention? They already hacked blue cross, which is a shitload more concerning in terms of intelligence targets than hacking health care info for America's poor and out-of-work.
r c0mpr0m1z1n j00!!!!111!eleventy!
This is an open letter to the OPM and IT Security Professionals or Administrators involved:
Other than outright incompetence WHY, why for the love of all we hold dear, were these systems connected to the Internet? Or connected to internal networks that were then connected to the Internet?
According to congressional testimony there are a group of systems some of which can not be secured AND/OR cannot be secured with encryption or modernized. Okay, the solution is simple, disconnect them and use "Sneaker Net" to access the data.
For the uninitiated "Sneaker Net" or "Trainer Net" means you need to have physical access i.e. walk over to computer that is connected to the system in order to access it. It is disconnect from all other systems and networks.
Is it inconvenient and inefficient? Sure, but it is better than putting a system that cannot be secured on a network that is in anyway connected to the Internet.
It is that simple to protect sensitive legacy systems at a basic level.
Next question: Why isn't this data protect at, AT LEAST, the security level the applicant is applying for?
Is it expensive to do this, yes! BUT on the application it is indicated what security level is being applied for...now how valuable is that data?
Next question [rhetorical]: What is the MOST IMPORTANT PART of any government project, organization, or security plan?
Answer: THE PERSONNEL!!!
Until about a year ago, I had a security clearance. So I'm one of the 22 million. I've already been contacted by our site clearance officer. They gave me this link from the OPM about the breach, which has more information than the links in the article.
For those who haven't gone through it, during a background search they send actual human beings around to your friend and family, and then to second-order contacts they know who know you, to ask questions about you. So the OPM, and now the hackers, literally know stuff about me that I don't know.
Most government agencies would never have let this happen in the first place because they're not stupid enough to "save money" by creating such an unbelievably high value collection of data so easily accessible to the Internet. Another thing, they would never have hired foreign contractors to work on such a critical database. OPM's contract office should be headed to Leavenworth for that decision.
People are sheep.
Bring back the old version of slashdot.
you're a dick. Do you even know what is in the Bill of Rights? Christ, morons like you are what makes me wish I was born in another country.
Could someone just publish a list of everyone's name, phone numbers, addresses, and SSN's already? Then there would be some motivation for people and organizations to learn the difference between identification and authentication. Knowing a number with nine or so digits associated with an individual shouldn't give you access to their credit, whether it's their SSN or their telephone number.
They also use this Meta-Security-Hole called "C language" ? Brought to you by a branch of government, which the danaer gift of an operating system written in said language. Free !
What could possibly be wrong with a free system on which you can store your secrets ? Absolutely nothing, certainly.
Never say again "military intelligence is an oxymoron". These folks have pwned an entire industry, because said industry trades in information. Information is power. Military is about power.
Most people are unaware that consumers can prevent their credit from being checked by instituting a credit report freeze at the major credit reporting agencies. This reduces the risk of identity theft almost to zero since lenders won't be able to do a credit check.
I created a White House petition this morning that would require the credit reporting agencies to freeze automatically the credit report for anyone impacted by a data breech. Unfortunately one has to get 100,000 signatures in a one month period before the White House will consider the proposal. Even with social media, unless one can get the word out really fast, far and wide, it seems like an impossible task. Anyhow, if anyone is interested, spread the word if you can.
https://petitions.whitehouse.gov//petition/require-all-citizens-credit-reports-be-frozen-default