-------------------------------------------------
THE BREACH OF THE CENTURY
[Document subtitle]

UNIVERSITY OF MARYLAND UNIVERSITY COLLEGE
INTRODUCTION TO HOMELAND SECURITY

It is frustrating to think that my family might suffer from my information having been stolen. I have served 25 years in the United States Army, was deployed to Iraq in 2005, 2008, and 2010. My wife also teaches kindergarten in DoDEA (Department of Defense Education Activities), and the country put all my love ones in the crosshairs. My wife and I received our letters from the Office of Personnel Management informing us that our personal information was compromised in the data breach that happened in June of 2015. The latest numbers on the OPM breach are roughly 19.7 million security clearance applicants, 2 million family and friends, and 4.2 million federal employees.
Regarding sheer size, the breach of the Office of Personnel Management database, may not be the biggest we have ever seen, but regarding depth and breadth and the nature of the sensitive personal information extracted by hacker or hackers somewhat unknown, it eclipses anything the United States have seen to date. Practically every day there is another headline heralding the discovery of the compromise of another business or agency. The reactions on the part of Soldiers, family members, and department of defense workers are the same; disbelief, sadness, outrage, and worried. It is a shock to the world that our government could have been this careless with no encryption, no two-factor authentication, improper data segmentation, insufficient training, and failure to implement upgrades in a timely fashion.
If you would like the names of the U.S. special operators, you may want to avoid the experience of hitting an impenetrable wall by the Freedom of Information Act and just ask the Chinese government instead. Last week, a friend of mine, a former Chief Warrant Officer Five in the U.S. Army, received a letter from the Office of Personnel Management informing him that his personal information had been compromised in a data breach. Several of our brothers and sisters received the same letter, which stated that a malicious cyber intrusion had resulted in the theft of their background investigation files. These files contain the sort of sensitive personal information that must be disclosed to obtain a security clearance. When disclosing the attack earlier this year, government officials said the Chinese were responsible, although it is impossible to prove.
What sort of personal information was stolen? According to our letter from OPM our name, Social Security number, address, date of birth, place of birth, home of record, educational and employment history, personal foreign travel history, information about immediate family members as well as business and personal acquaintances, and other information used to conduct and adjudicate our background investigation.
These files also include photos, fingerprints, and data about vices and sensitive personal matters that could potentially be used for evil purposes. Some of the information dates back as far as 25 years.
The CIA was believed to be shielded from the data breach since it does not use the OPM for background investigations, but many special operations forces members end up working with the CIA on projects that are sensitive in nature. It is unclear whether the personal information of current special operation forces members were also stolen. However, with so many former members working as contractors on classified projects, it is naive to suggest that the damage has been limited. With fingerprints, photos, and blackmail material, just imagine what a foreign government could do to compromise our most elite military operators. Personal vulnerabilities could be exploited to produce moles, with former military members blackmailed into spying or otherwise acting against American interests. U.S. personnel suspected to be operating under deep cover could have a stray fingerprint lifted and checked against this rogue database to uncover their identity.
The exposure of information about family and friends provides evil entities with easy entry into the lives of special operations forces personnel since family and friends are not trained in OPSEC themselves, are likely to be unsuspecting of any evil agenda, and likely have a global Internet and social media presence. If they post details about family vacations on Facebook, Twitter or Instagram, a bad guy could ascertain the location of an operative.
It has been reported that the cyber-attackers obtained valid system access credentials and that encryption may not have helped.
The bottom line is that few pieces of classified government information are more sensitive than special operations forces data, and there is no way this material should be located on any computer system. The blood line (PII) is at the very heart of national security and should be protected at all costs. A breach of this magnitude gaining this kind of sensitive personal information is as careless as storing the nuclear launch codes on iCloud.
The Office of Personnel Management (OPM) in concert with Department of Homeland Security (DHS)/National Cybersecurity and Communications Integration Center (NCCIC) spent the last year implementing improved cybersecurity capabilities across its networks. As a result, in early April 2015, OPM became aware of a cybersecurity intrusion. As soon as OPM identified malicious activity on their network, they collaborated with the NCCIC. The NCCIC then used EINSTEIN 2 to scrub historical traces for other compromises across the Federal government. Through this process, the NCCIC identified a potential fracture at a Department of Interior data center which stored federal personnel records for OPM. Next, the NCCIC used the EINSTEIN 1 system to determine if data extraction had occurred. In May 2015, the NCCIC incident response team confirmed extraction of approximately 4.2 million federal employee records stored at the DOI data center on behalf of OPM. NCCIC assesses that the adversary was present in the applicable DOI data center from October 2014 to March 2015.
One of the most important roles DHS played in this breach was collaboration and synchronization of information across agencies. The interoperability between OPM, NCCIC; which is one of the many action arms for DHS, and other agencies has been paramount in not only securing the brain of the government but those heroes who are putting their life on the line to safeguard it. The fallout has not settled nor will it due to the nature of our asymmetrical threat.

References
DHS. (2015, 11 12). Retrieved from DHS: http://www.dhs.gov/national-cybersecurity-communications-integration-center
Federal News Radio. (2015, 11 10). Retrieved from Federal News Radio: http://federalnewsradio.com/opm-cyber-breach/2015/11/opm-set-verification-center-cyber-breach-victims/
Paletta, D. (2015, 11 08). The Wall Street Journal. Retrieved from The Wall Street Journal: http://www.wsj.com/articles/SB10007111583511843695404581069863170899504
Public Intelligence. (2015, 11 10). Retrieved from Public Intelligence: https://publicintelligence.net/nccic-capabilities-guide/
Wired. (2015, 11 09). Retrieved from Wired: http://www.wired.com/2015/06/opm-breach-security-privacy-debacle/