Why the US federal employee record breach is worse than others

>I know data security is hard, but maybe if the government spent money on proper protections of people's data instead of building data centers to spy on it's citizens, this wouldn't have happened.

The Gozer Principal: in Information Security you get to design the weapon that will be used against you [1]. Don't build a tool you are unwilling to hand to your greatest enemy.

For example what happens when foreign governments steal the domestic bulk surveillance data? I bet the NSA accidentally hoovers up all sorts of top secret information that is just accidentally sent over the wire or non-classified data that could do great damage to US interests. Or what happens when a foreign government gains access to the tools used to perform this bulk collection? They could inject fake traffic or hide traffic for strategic deception campaigns.

Collect it all is a strategically empty slogan, it represents a serious risk to US national security, but on the other hand it is a wonderful Rice Bowl [2] for the NSA.

>What can an organization do to protect such sensitive information, or at least reduce their exposure and the amount of data that is able to be leaked before detection?

* Keep it offline/airgapped.

* Store the most dangerous data on paper with hashes replicated online to insure integrity.

* Delete information you don't need anymore.

* Do not have a centralized repository of data to reduce risk of catastrophic exposure.

There are always trade offs between usability, functionality and security.

[1]: https://twitter.com/ethan_heilman/status/510993743156375552

[2]: https://en.wikipedia.org/wiki/Iron_rice_bowl#Other_uses

> when you gather a lot of information on people, you become a target

The uncomfortable truth for many HN readers is that this is also true for all of that user data that businesses are currently aggregating: from the data people trust an online service to manage to the modern version of "library records" we call analytics. Thee is value in all of this, or it wouldn't be worth paying to collect/store it.

Unfortunately, even if the data is collected with the best intentions, the fact that the database exists creates a target that must secured. It also creates an "attractive nuisance" for governments holding national security letters and PRISM. Those are troubling enough, but gathering data about people has another risk that is rarely addressed: moral hazard. There is always the temptation to sell that data to the highest bidder, which we have seen happen many times as businesses look to find new ways to "monetize" their users.

For the sf-86 data it really should have been stored on an air gapped network, encrypted, with physical security. That type of data is far too valuable to leave connected to a publicly accessible network in any way.

This is said with tongue in cheek, but they could have bought that CyFIR product a year earlier.

What on earth were you thinking?

To expand a bit on that: any job that requires you to list the names of random people that you've had contact with in the past should be avoided like the bloody plague, there is nothing that those people have done to warrant you putting their name into some form and subsequent database with unknown consequences for the people you decide to list.

They're not sheep to be offered up on the altar of your ambition to rise up in the ranks, absolutely nothing good could ever come for them. So if the penalty is perjury just walk, that way you don't perjure yourself.

A lot of investigators are completely incompetent and the job has one of the lowest pay of any cleared jobs out there. My investigator didn't realize I was male until he had interviewed a friend of mine and corrected him.

Not just that, but how do these disparate government agencies verify that so-and-so checking into the local agency office is actually cleared for SECRET or TS or whatever?

They have to look it up somehow. That lookup will likely involve a computer database, and the pathway to reach that database will likely involve the Internet.

Practically all the rest of this sad story follows immediately, because the whole strategy of how the government handles computerized records in general is all screwed up.

Even after this I'm not sure it will get better... the trend in government is for inexorable centralization of related information. At the same time there's incredible demand to have those work-related systems available online and all the time, so that people can work while on duty travel, or from home.

Obviously there are technical things that can be done to mostly have our cake and eat it too (VPNs, redacted mirrors/views of the sensitive central database to be made available across the public Internet, etc.). But no one gets promoted in the government for doing that, and much of the talent is at Google or Facebook or Silicon Valley anyways :P.

> Nobody thought of the Office of Personnel Management as security critical

This was the actual plotline of Skyfall.

> Remember the demands after 9/11 for "tearing down the walls" between the law enforcement and security communities?

Maybe the solution is to have a smaller law enforcement and security community. Fewer components, better MTBF.

Can you say the same thing about the people they researched to validate your information?

> If it really was the Chinese behind it, then the data likely won't ever end up dumped on pastebin

What if the calculation of both maximum effect and maximum deniability is exactly that: Create a shadowy, possibly composite hacker persona (a "Satoshi Nakamoto"), release a bunch of signatures and generate publicity, and then roll out the database, verifiable by the previously released signatures.

Is it the entire SF-86 database, including contractors? Or just government employees?

First thing to pop in to my head after reading your comment is this Upton Sinclair quote: "It is difficult to get a man to understand something, when his salary depends on his not understanding it."

It's a bit like wishing slaughterhouse workers would start to consider the animal's feelings and spend more time thinking about them.

I hope so too, just like I hope I get to fly around in a UFO because that would be pretty cool. Not really expecting that to happen though.

It would be fascinating if foriegn intelligence agents were to use this information against NSA agents in some way.

I think you're missing the point, and would mind if we all went through your financial, medical and personal records. These records are made available to OPM under what are supposed to be strict privacy controls, because it's very very personal information. Everything from divorces, psychological counseling, drug history, you name it. You open up every secret in your life to scrutiny to demonstrate that despite all that you can be trusted. None of that is anyone's business, and it supposed to be protected and only available to a small number of people for a period of time to determine if you can be trusted.

Everyone has things in their lives they'd rather not have made public because it's nobodies business, and this compromise just betrayed the trust all those people put in the US government.

Or you could archive it on an air gapped network and delete it from all systems connected to the internet. Seems like a relatively simple procedure that I imagine is in use all the time with sensitive data...

FWIW, I recently had to get the records of a medical test that was performed when I was a teenager. All I had to do was fax the hospital a form with my date of birth, approximate year the test was done, and a signature, and they sent the records to me in the mail. Absolutely terrifying.

I'd rather have my health records public than information that could be used to compromise my financial security, considering the US doesn't enforce squat against credit credit bureaus who provide blatantly false information.

If you have something you can be blackmailed over you can't get security clearance. The info, however, does facilitate identity theft and KBA type auth. It'd be easier to pose as someone who does have clearance, which undermines the system.

I sure this will put me on some list, but you are right. They have a ton of information. It's probably just a matter of time before they get hacked. The question is by whom and for what purpose. It would be interesting if it was done as an act of civil disobedience.

It's for security-sensitive positions. They ask questions to your neighbors about you to see if you're hiding anything.

Heck, just to apply to the bar I had to list eight character references plus a contact at every employer I've had in 13 years. It's pretty standard practice for trust-sensitive jobs to ferret out people who have something to hide or are lying on their application.

This is a database of potential Snowdens. The "intelligence community" is a strange, puritanical, paranoid sort of place. It wouldn't be so bad if it hadn't grown so preposterously large.

Different country, similar use case (clearance) - guy I worked with says a great way to get a proper fake identity is to assume one of a dead child from years ago when documentation wasn't as precise as it is now. (gives you a real, registered birth certificate) That's where family/neighbors information comes in - agency asks them and they say "sure, I remember, he died so young"...

I've been through this multiple times. Basically they just come out to your neighborhood and ask your neighbors if they've noticed anything suspicious going on. Strange behavior, odd visitors, unexplained affluence, etc. Takes all of 5 minutes. If it were my job to vet people, I suppose I'd be doing the same sanity-checks to make sure I wasn't dealing with an unstable person: drug addict, wife-beater, etc.

>why does the government care about the neighbours of their employees???

I think that's so they can ask the neighbours questions.