In responding to China’s massive hack of federal personnel data, the government may have run afoul of computer security again.
Over the past two weeks, the Office of Personnel Management has sent email notices to hundreds of thousands of federal employees to notify them of the breach and to recommend that they click on a link to a private contractor’s Web site to sign up for credit monitoring and other protections.
But those emails have been met with increasing alarm by employees – along with retirees and former employees with personal data at risk – who worry that the communications may be a form of “spear phishing” used by adversaries to penetrate sensitive government computer systems.
After the Defense Department raised a red flag about the emails that its 750,000 civilian employees were receiving, OPM officials said earlier this month that the government had suspended its electronic notifications.
“We’ve seen such distrust and concerns about phishing,” OPM spokesman Sam Schumach said, describing the feedback from many of the 4.2 million current and former employees who are being notified that personnel files containing their Social Security numbers, addresses and other personal information may have been stolen.
Computer experts said that the personnel agency – already under fire from lawmakers from both parties for failing to protect sensitive databases from hackers – could be putting federal systems in jeopardy by asking employees to click on links in the emails.
“There’s a risk that you desensitize people by telling them that occasionally there’s going to be a very important email you have to click on,” said Joseph Lorenzo Hall, chief technologist at the Center for Democracy and Technology.
He called OPM’s first round of email transmissions the equivalent of “sending a postcard to people saying, ‘Gee, you just got hacked – go to this Web site.’ The hackers could wise up and send their own set of fake identity-protection emails and get into your computers all over again.”
That’s precisely what worried top Defense Department officials before the department’s chief information officer told OPM last week to suspend the notifications because of their disregard for basic cybersecurity training that’s crucial to ensuring the safety of military networks: Never click on unfamiliar links, attachments or email addresses, because they expose employees to spear-phishing attacks.
Defense Department offices across the country posted a bulletin in their internal communication networks from Terry Halvorsen, the department’s chief information officer, saying that OPM was “suspending notification to DoD personnel that their 1/8personal identifying information3/8 may have been breached until an improved, more secure notification and response process can be put in place.”
The notice continued:
“Recognizing that DoD personnel are trained not to open links embedded in emails not digitally signed and/or sent from unknown senders, DoD officials are working closely with other federal partners to establish notification procedures that will allow DoD personnel to reliably and confidently receive these notifications, and register for the benefits to which they are entitled.”
Employees across the government and their unions have raised concerns that the emails refer them to the Web site of a private company with a “.com” address instead of a government domain. Even though they are given a PIN, many people say they’re wary of giving a contractor their Social Security numbers, addresses and other information to qualify for identity-theft insurance and credit monitoring.
The contractor, CSID, resumed the email notifications late Wednesday with a change designed to give employees more confidence that the communications are legitimate and that the company’s Web site is secure, Schumach said. They still have the option to click directly on a link to enroll in credit-protection services, but now they can copy and paste the Web site address, www.csid.com/opm, themselves, a more secure strategy.
“To alleviate the concerns of phishing, OPM and (the contractor) have made changes to email notifications by adding additional options for those who want to enroll in the 1/8contractor’s3/8 services directly from the email,” Schumach said. “Now, affected individuals will be able to not only click on the ‘Enroll Now’ button, but will also have the option to copy a non-hyperlink address so they know exactly what Web site they will be visiting.”
Despite the fixes, OPM’s credibility may suffer still. OPM Director Katherine Archuleta was berated by Democrats and Republicans on Capitol Hill in the past week for what they called her serious negligence in failing to take long-recommended steps to secure the computer systems containing federal personnel records. Two top Republicans have called on her to resign.
“Even when they try to clean it up, they’re getting it wrong,” Christopher Soghoian, principal technologist for the American Civil Liberties Union, said of OPM’s response to the data breach. “A policy saying, ‘Don’t send clickable links to employees,’ is not rocket science. It’s Cybersecurity 101.”
Talk to us
> Give us your news tips.
> Send us a letter to the editor.
> More Herald contact information.
