4 ms·

The problem is that we already have a nationalized version of this - the OPM database for security clearances - and it too has been hacked. It was known vulnera

The problem is that we already have a nationalized version of this - the OPM database for security clearances - and it too has been hacked. It was known vulnerable in 2009 and nothing was done about it until it was known to be hacked 6 years later. Even worse, while the author criticizes how Equifax got started - private investigators looking for affairs, etc - that is exactly what the OPM database is. They're looking for things that could be used to blackmail an individual so it includes financial history, marital info, drug use/abuse info, and potentially medical records. My coverage of it at the time: https://caseysoftware.com/blog/why-this-security-breach-is-worse-than-all-the-others-combined https://caseysoftware.com/blog/why-this-security-breach-is-w... And no, there has been zero accountability around it. Whenever someone says "the govt can protect this info better!" remember that this is the same government that doesn't follow the law with regards to wiretaps, FOIA requests, background check info, and many, many other things. Oh, and the NSA can't even protect their best tools.

KGIII 9y ago
All I got from the OPM hack was a form letter and free credit monitoring that I had no use for. Instead, I had to freeze my credit. Fortunately, I'm not really at risk for blackmail and I'm not worried about my information being out there. I am, however, worried about the information in my file that is about other people. They contacted and interviewed lots of my friends and family. Those notes, and the associations between these groups of people, are all in the data that was exfiltrated. You know what my friends and family got? Nothing, not even a form letter. Me? I'll be fine. However, some of them are now associated with others and who knows what other connections can be drawn when you cross-check with other information from the hack? So, yeah, I'm jaded and skeptical about the idea of having it be a government operation. People keep saying this is the worst hack ever. Man, if they only knew what was in the clearance application. I disclosed all sorts of things that I really don't want to be public information. And I got a form letter that was barely an apology. Hell, I think my notification was actually on a post card. Yeah, I just double checked. They sent my notification on a post card, not even in a secure envelope. I may be a bit biased.
- turk184 9y ago
  Same here. OPM was stupid and disgusting.
  - KGIII 9y ago
    Because we can't prove harm, we have no standing in the eyes of the court. We have no recourse. I couldn't even transfer my free credit monitoring to someone who could actually use it. It was non-transferable. I had no use for it, as I'd opted to freeze my credit entirely. I'm not sure which bothers me the most, the hack or the response? I do know that if I'd been responsible for spillage of classified information, I'd have gone to jail. If I'd been responsible for spilling that much classified data, I'd have never felt a ray of sunshine again. I'm very disappointed by it. What is most disappointing is that there was no good reason for me needing the clearance, FOUO would have been fine. I can't be specific, but there was no reason my work, or the data, should have been classified. On top of that, I'd already sold my business and had retired - years prior. There was no good reason for retaining my records. I'm currently reading about other countries that offer a government run service for credit reporting. I'm trying really hard to remain objective and unbiased, but it's really difficult. I feel sorry for the people who are impacted by this. It's not easy to go through. I'm not sure it's quite the same, but I felt violated when I found out about the OPM hack. I felt let down, abandoned, unappreciated, and powerless. The information was some of my most private information and, worse, wasn't just about me. I felt as though it was my fault that my friends and family also had their privacy violated. I am not that great with words, so that's about the best way I can think of to describe it. Disgusting is a good description. On a positive note, it does help me empathize with the folks impacted by this hack.
- caseysoftware 9y ago
  And that's what you disclosed. What did investigators discover and what did others said about you?
  - KGIII 9y ago
    I mostly know what others said about me, assuming they only spoke to people I listed. Those other people also disclosed information about themselves, some of it very personal. Not only did the OPM hack affect my privacy, it made me a cause of others losing some of their privacy. By extension, they made me responsible. Fortunately, none of my friends and family hold me accountable and understand that I'm not to blame. Still... It's not a good place to be, emotionally. I've since gotten over it, for the most part. I don't even know what was in their investigation notes. That's need to know and they don't think I need to know. I disclosed everything from drug use to promiscuity, with names, dates, and places. It wasn't just my information in those files. Who knows what can be done with that info by giving it big-data treatment? Add that database to this one, and the many others, and I'd be surprised if you couldn't draw much larger pictures and associations. The world is not that big and cross-checking on large data sets is almost certain to further erode privacy.

KGIII 9y ago

All I got from the OPM hack was a form letter and free credit monitoring that I had no use for. Instead, I had to freeze my credit. Fortunately, I'm not really at risk for blackmail and I'm not worried about my information being out there. I am, however, worried about the information in my file that is about other people. They contacted and interviewed lots of my friends and family. Those notes, and the associations between these groups of people, are all in the data that was exfiltrated. You know what my friends and family got? Nothing, not even a form letter. Me? I'll be fine. However, some of them are now associated with others and who knows what other connections can be drawn when you cross-check with other information from the hack? So, yeah, I'm jaded and skeptical about the idea of having it be a government operation. People keep saying this is the worst hack ever. Man, if they only knew what was in the clearance application. I disclosed all sorts of things that I really don't want to be public information. And I got a form letter that was barely an apology. Hell, I think my notification was actually on a post card. Yeah, I just double checked. They sent my notification on a post card, not even in a secure envelope. I may be a bit biased.

turk184 9y ago
Same here. OPM was stupid and disgusting.
- KGIII 9y ago
  Because we can't prove harm, we have no standing in the eyes of the court. We have no recourse. I couldn't even transfer my free credit monitoring to someone who could actually use it. It was non-transferable. I had no use for it, as I'd opted to freeze my credit entirely. I'm not sure which bothers me the most, the hack or the response? I do know that if I'd been responsible for spillage of classified information, I'd have gone to jail. If I'd been responsible for spilling that much classified data, I'd have never felt a ray of sunshine again. I'm very disappointed by it. What is most disappointing is that there was no good reason for me needing the clearance, FOUO would have been fine. I can't be specific, but there was no reason my work, or the data, should have been classified. On top of that, I'd already sold my business and had retired - years prior. There was no good reason for retaining my records. I'm currently reading about other countries that offer a government run service for credit reporting. I'm trying really hard to remain objective and unbiased, but it's really difficult. I feel sorry for the people who are impacted by this. It's not easy to go through. I'm not sure it's quite the same, but I felt violated when I found out about the OPM hack. I felt let down, abandoned, unappreciated, and powerless. The information was some of my most private information and, worse, wasn't just about me. I felt as though it was my fault that my friends and family also had their privacy violated. I am not that great with words, so that's about the best way I can think of to describe it. Disgusting is a good description. On a positive note, it does help me empathize with the folks impacted by this hack.
caseysoftware 9y ago
And that's what you disclosed. What did investigators discover and what did others said about you?
- KGIII 9y ago
  I mostly know what others said about me, assuming they only spoke to people I listed. Those other people also disclosed information about themselves, some of it very personal. Not only did the OPM hack affect my privacy, it made me a cause of others losing some of their privacy. By extension, they made me responsible. Fortunately, none of my friends and family hold me accountable and understand that I'm not to blame. Still... It's not a good place to be, emotionally. I've since gotten over it, for the most part. I don't even know what was in their investigation notes. That's need to know and they don't think I need to know. I disclosed everything from drug use to promiscuity, with names, dates, and places. It wasn't just my information in those files. Who knows what can be done with that info by giving it big-data treatment? Add that database to this one, and the many others, and I'd be surprised if you couldn't draw much larger pictures and associations. The world is not that big and cross-checking on large data sets is almost certain to further erode privacy.