Cybersecurity & Tech

The Data Breach At The Office Of Personnel Management

Herb Lin
Thursday, June 4, 2015, 9:29 PM

Press reports today (New York Times,

Meet The Authors
Subscribe to Lawfare

Press reports today (New York Times, Washington Post) indicate that personnel databases at the Office of Personnel Management (OPM) were breached in April 2015, resulting in the possible compromise of 4 million records containing sensitive personal information. OPM is apparently treating this data breach in much the same way that a private company would treat it – offering credit monitoring and identity theft insurance to affected personnel and urging such people to look for suspicious activity in their financial accounts.

It’s a good thing to offer credit monitoring and the like. But a breach of this type—involving millions of current and former employees across many federal agencies—has ramifications far beyond the financial risks to individuals affected. With sensitive personal information in hand, hackers will have a much easier time in conducting social engineering attacks against these individuals. Some of the individuals affected by this breach undoubtedly have access to sensitive *government* information, and now that information is at greater risk of compromise.

So treating this matter merely as a financial risk for affected employees misses the boat. What, if anything, will the U.S. government do to sensitize the affected employees about following basic cybersecurity and cyber hygiene measures in the wake of this incident? I will feel much better once I know the answer to that question.

Topics:
Cybersecurity & Tech
Back to Top
Herb Lin

Herb Lin

HerbLinCyber
Read More
Dr. Herb Lin is senior research scholar for cyber policy and security at the Center for International Security and Cooperation and Hank J. Holland Fellow in Cyber Policy and Security at the Hoover Institution, both at Stanford University. His research interests relate broadly to policy-related dimensions of cybersecurity and cyberspace, and he is particularly interested in and knowledgeable about the use of offensive operations in cyberspace, especially as instruments of national policy. In addition to his positions at Stanford University, he is Chief Scientist, Emeritus for the Computer Science and Telecommunications Board, National Research Council (NRC) of the National Academies, where he served from 1990 through 2014 as study director of major projects on public policy and information technology, and Adjunct Senior Research Scholar and Senior Fellow in Cybersecurity (not in residence) at the Saltzman Institute for War and Peace Studies in the School for International and Public Affairs at Columbia University. Prior to his NRC service, he was a professional staff member and staff scientist for the House Armed Services Committee (1986-1990), where his portfolio included defense policy and arms control issues. He received his doctorate in physics from MIT.
}

Subscribe to Lawfare