Privacy Incident Involving DHS OIG Case Management System | Hacker News Reader

Privacy Incident Involving DHS OIG Case Management System

dhs.gov

63 pointsel_duderino25 comments

Not just employees, but also "subjects, witnesses, and complainants". Yikes. This is way worse than the last one.

> the last one

I've lost track now.. which one do you mean?

The OPM breach of the SF-86 database is still the worst and most catastrophic that I'm aware of. That was larger (millions), was the result of background checks (aka blackmail fodder), included full read/write access (tainted?), and likely every position that required a clearance outside the CIA.

That's the one I meant. You're right, that one does seem worse. I didn't realize that the previous one had information on so many people.

This one seems especially terrible because it had information on people unrelated to the US government.

During a background check, they start by investigating the subject and interview friends, family, employers, colleagues, classmates, significant others, roommates, etc.. and may investigate them to some degree. They only have detailed info on the subject but would still have lots of info on the others.

*I had a Secret 10+ years ago.

Does anyone have experience with the credit protection firms always hired to attempt to make right in these cases? It seems like the onus is still on the individual to fix their credit if something bad does happen, so they could conceivably effectively be doing nothing.

> “...unauthorized unauthorized transfer of data.”

Am I being dense or is this unintended?

Probably a typo, but in the CIA world, there is a lot of 'authorized unauthorized' "off the books" activity.

>Probably a typo, but in large and slow moving bureaucracies, there is a lot of 'authorized unauthorized' "off the books" activity.

FTFY.

It's actually a pretty good way to explain speculative execution. You know you might need to so something so you just do it using the slush fund and if it isn't useful you toss the result and if it is useful you keep doing it while papers are shuffled around and authorization happens. Certainly not ideal but not unheard of either.

  Investigative Data: Individuals associated with DHS OIG
  investigations from 2002 through 2014, which includes
  subjects, witnesses and complainants who were both DHS
  employees and non-DHS employees.  The PII contained in this
  database varies for each individual depending on the
  documentation and evidence collected for a given case.
  Information contained in this database could include names,
  Social Security numbers, alien registration numbers, dates
  of birth, email addresses, phone numbers, addresses, and
  personal information provided in interviews with DHS OIG
  investigative agents.

Most of that is business-as-usual for a DB leak, but there's something that catches my eye:

  personal information provided in interviews with DHS OIG
  investigative agents.

Would this only be information provided by people about themselves, or does the inclusion of "subjects of investigations" mean that this is a colossal dump of life-ruining hearsay that could destroy anyone that DHS has ever touched?

Speaking of which, this bit at the end disgusts me:

  What is DHS doing to better secure employees’ PII?

Why does this read as anything other than "What is DHS doing to better secure american citizens' PII"? DHS employees aren't the only people affected by this. I'd expect "subjects, witnesses and complainants of DHS investigations" to number in the millions.

Put away the pitchforks.

OIG is internal affairs. The people they investigate are employees, not the public.

https://www.oig.dhs.gov

"The breach of the DHS OIG Case Files included individuals associated with DHS OIG investigations. Family members and close associates were impacted by this privacy incident only if they were involved in a DHS OIG investigation."

That does make it a bit less... totally horrifying. I imagine that there're still plenty of normal people in the "witnesses and complainants" category, so I can't imagine that this only affects DHS employees, but if nothing else that should dramatically reduce the size of the data set.

Employees /are/ the public.

You don't lose the right to protection from someones incompetence just because you're employed by them.

As the DHS OIG database is a System of Record, it has a verbose System of Record Notification (SORN) which is publicly available to be perused should you wish to know what information is kept and for how long.

https://www.gpo.gov/fdsys/pkg/FR-2015-07-27/html/2015-18385....

And here we go again.

Does anyone know if this includes SF-86 and related investigation data?

The SORN which describes exactly what data is contained in this system can be found below:

https://www.gpo.gov/fdsys/pkg/FR-2015-07-27/html/2015-18385....

The OIG case data would have nothing to do with SF-86 data which is kept by OPM.

The OIG investigates complaints against DHS (and child agencies) officials, employees, and policies brought by Congress, the public, and other agencies. It's similar to the stereotypical Internal Affairs department in every police movie.

OPM keeps that data even for contractors?

Can someone from USDS chime in? I thought these occurrences were mitigated against by having tech professionals providing guidance to internal development teams.

AFAIK, each agency has to request USDS/18F assistance.

And it's unrealistic to expect that assistance to prevent breaches, especially when there are hundreds of government agencies separately running insecure legacy systems. The USDS/18F has on the order of < 100 employees AFAIK. That is hardly enough manpower to secure the systems of every government agency.

In 2015, someone from USDS left to establish a similar team at DHS [0]:

> Last week, Eric Hysen announced that he’s leaving the White House’s U.S. Digital Service (USDS) to establish a similar team within DHS, as the agency’s digital service lead

According to his Twitter and LinkedIn info, Hysen has apparently left DHS and now works at the Chan Zuckerberg Initiative.

According to the 2016 USDS report to Congress [1], USCIS (Citizenship and Immigration), an agency within DHS, did collaborate with USDS and 18F to launch a modernization of its immigration requests system. Given the size of DHS, I seriously doubt that this effort alone would have significantly impacted or involved other agencies in DHS.

The USDS 2017 report [2] mentions DHS as one of 7 federal agencies at which they have "active teams", but no other details are given.

[0] https://fedtechmagazine.com/article/2015/10/dhs-creates-digi...

[1] https://www.usds.gov/report-to-congress/2016/projects/

[2] https://www.usds.gov/report-to-congress/2017/07/

Excellent sleuthing.

Homeland "Security"

Sounds like a great name for a cinema in the DC area.

Reply on news.ycombinator.com