Cybercom: OPM Hack Highlights China Big Data Spying

Cybercom: OPM Hack Highlights China Big Data Spying

Pentagon moves to protect records from future attacks

Adm. Mike Rogers / AP

BY: Bill Gertz  January 25, 2016 
China’s theft of millions of records on Americans was part of a Big Data spying program conducted by Beijing that has prompted the Pentagon to take new steps to secure large data concentrations.

That was the assessment of U.S. Cyber Command commander Adm. Mike Rogers who on Thursday called the compromise of 22 million records from the Office of Personnel Management, as well as millions of heath care records in an earlier attack disclosed last year, a new form of cyber spying.

The Chinese cyber attacks from 2014 “get more to the idea of what’s acceptable, what’s not acceptable, what’s within established norms,” Rogers said during remarks at the Atlantic Council on Jan. 21.

The commander said nations around the world commonly use certain capabilities to learn about the world. “Hey, we call that spying and espionage,” he said.

However, the hack of government personnel records, along with the Chinese hacking of the health care provider Anthem, highlighted the targeting of seemingly unimportant caches of data. Analyzing large data repositories is a new trend in cyber espionage, Rogers says.

“If you go back five, ten years ago, I remember discussions where we thought there is just so much data here, no one could put it all together,” Rogers said. “Its very size makes it very difficult for an adversary to generate knowledge or understanding out of. And yet you look at the power of big data analytics now, whether that be in the private sector helping to understand patterns of behavior to generate tailored advertising, whether you look at it from an intelligence perspective, where you use the power of big data analytics to try to understand large masses of data to look for the analytic trends that help us understand what’s going on.”

The ability to analyze Big Data tranches is now available with refined software, a development that has made the targeting of databases increasingly attractive to nation states like China.

And the trend is likely to continue. “So what you saw at OPM, my comment would be you are going to see a whole lot more,” Rogers said, using an acronym for the Office of Personnel Management.

At the Pentagon, security analysts are now reviewing the military’s large data concentrations to determine whether they are appropriately secure from hacking.

“Do we need to step back and ask ourselves in the world that we are living in now, as opposed to the world we lived in when we created some of them, do we need to look at things a little differently, do we need to prioritize differently?” Rogers said of the review.

The questions are not easy to answer but solutions are being applied rapidly. The review is a direct result of the hacks of the federal personnel and Anthem records.

The Pentagon announced Friday that it will take away responsibility for storing millions of federal employee records from the Office of Personnel Management and transfer the authority to the Pentagon. Additionally, the Defense Department is setting up a new office to monitor the millions of background security investigations. The National Background Investigations Bureau will handle the estimated 600,000 background checks done annually.

The bureau will take over the job from the Office of Personnel Management’s Federal Investigative Services branch. The Pentagon also will oversee information security for the system.

The changes prompted the chairman of the House Oversight and Government Reform Committee, Rep. Jason Chaffetz (R., Utah), to issue a statement saying the changes will not solve the security shortfalls.

“The administration needs to undertake meaningful reforms to protect citizens’ most sensitive personal information,” Chaffetz said. “Today’s announcement seems aimed only at solving a perception problem rather than tackling the reforms needed to fix a broken security clearance process.”

The reforms were first reported by the Washington Post.

Also on Friday, the Office of the Director of National Intelligence released a video in response to the hack of government personnel records that is designed to help prevent the recruitment of spies by foreign governments, including the use of social media deception and spear-phishing.

The video shows a simulated recruitment of a government official by a foreign national who speaks with a Russian accent. The official reported the recruitment attempt to the security office. “He’s either a foreign intelligence officer or works for one,” a security official says. “He may have acquired information about your background from one of the many recent data breaches you heard about … He targeted you” using social media.

The video was produced by the Office of the Director of National Intelligence’s National Counterintelligence and Security Center.

“You don’t have to work for the CIA or have access to the most prized information for you to be a target,” Bill Evanina, the center’s director, said in a press release announcing the video. “Oftentimes they go for people with access to information that is more germane to their nation’s needs.”

Apparently, the video deliberately avoided the use of an Asian posing as a foreign spy under the Obama administration’s policy to seek to avoid upsetting Beijing.

China has denied hacking the federal government’s personnel records or Anthem despite intelligence indicating the cyber attacks emanated from Chinese government or military hackers.

The Office of Personnel Management hack exposed millions of federal workers to Chinese intelligence recruitment and hacking efforts.

Security analysts say China likely will use the data to identify U.S. spies working in China and to develop leads for future hacking.

For example, once network administrators for critical infrastructure computers are identified, China likely will use the data in efforts to learn passwords used by the administrators.