8 ms·
Privacy Incident Involving DHS OIG Case Management System
- coldcode 9y agoHomeland "Security"
- dsfyu404ed 9y agoSounds like a great name for a cinema in the DC area.
- toomuchtodo 9y agoCan someone from USDS chime in? I thought these occurrences were mitigated against by having tech professionals providing guidance to internal development teams.
- tomschlick 9y agoAFAIK, each agency has to request USDS/18F assistance.
- deleted 9y ago[deleted]
- chatmasta 9y agoAnd it's unrealistic to expect that assistance to prevent breaches, especially when there are hundreds of government agencies separately running insecure legacy systems. The USDS/18F has on the order of < 100 employees AFAIK. That is hardly enough manpower to secure the systems of every government agency.
- danso 9y agoIn 2015, someone from USDS left to establish a similar team at DHS [0]: > Last week, Eric Hysen announced that he’s leaving the White House’s U.S. Digital Service (USDS) to establish a similar team within DHS, as the agency’s digital service lead According to his Twitter and LinkedIn info, Hysen has apparently left DHS and now works at the Chan Zuckerberg Initiative. According to the 2016 USDS report to Congress [1], USCIS (Citizenship and Immigration), an agency within DHS, did collaborate with USDS and 18F to launch a modernization of its immigration requests system. Given the size of DHS, I seriously doubt that this effort alone would have significantly impacted or involved other agencies in DHS. The USDS 2017 report [2] mentions DHS as one of 7 federal agencies at which they have "active teams", but no other details are given. [0] https://fedtechmagazine.com/article/2015/10/dhs-creates-digital-services-team https://fedtechmagazine.com/article/2015/10/dhs-creates-digi... [1] https://www.usds.gov/report-to-congress/2016/projects/ https://www.usds.gov/report-to-congress/2016/projects/ [2] https://www.usds.gov/report-to-congress/2017/07/ https://www.usds.gov/report-to-congress/2017/07/
- toomuchtodo 9y agoExcellent sleuthing.
- dingdongding 9y agoAnd here we go again.
- ntonozzi 9y agoNot just employees, but also "subjects, witnesses, and complainants". Yikes. This is way worse than the last one.
- caseysoftware 9y ago> the last one I've lost track now.. which one do you mean? The OPM breach of the SF-86 database is still the worst and most catastrophic that I'm aware of. That was larger (millions), was the result of background checks (aka blackmail fodder), included full read/write access (tainted?), and likely every position that required a clearance outside the CIA.
- ntonozzi 9y agoThat's the one I meant. You're right, that one does seem worse. I didn't realize that the previous one had information on so many people. This one seems especially terrible because it had information on people unrelated to the US government.
- caseysoftware 9y agoDuring a background check, they start by investigating the subject and interview friends, family, employers, colleagues, classmates, significant others, roommates, etc.. and may investigate them to some degree. They only have detailed info on the subject but would still have lots of info on the others. *I had a Secret 10+ years ago.
- wyldfire 9y agoDoes anyone know if this includes SF-86 and related investigation data?
- Godel_unicode 9y agoThe SORN which describes exactly what data is contained in this system can be found below: https://www.gpo.gov/fdsys/pkg/FR-2015-07-27/html/2015-18385.htm https://www.gpo.gov/fdsys/pkg/FR-2015-07-27/html/2015-18385....
- caseysoftware 9y agoThe OIG case data would have nothing to do with SF-86 data which is kept by OPM. The OIG investigates complaints against DHS (and child agencies) officials, employees, and policies brought by Congress, the public, and other agencies. It's similar to the stereotypical Internal Affairs department in every police movie.
- wyldfire 9y agoOPM keeps that data even for contractors?
- saulrh 9y agoInvestigative Data: Individuals associated with DHS OIG investigations from 2002 through 2014, which includes subjects, witnesses and complainants who were both DHS employees and non-DHS employees. The PII contained in this database varies for each individual depending on the documentation and evidence collected for a given case. Information contained in this database could include names, Social Security numbers, alien registration numbers, dates of birth, email addresses, phone numbers, addresses, and personal information provided in interviews with DHS OIG investigative agents. Most of that is business-as-usual for a DB leak, but there's something that catches my eye: personal information provided in interviews with DHS OIG investigative agents. Would this only be information provided by people about themselves, or does the inclusion of "subjects of investigations" mean that this is a colossal dump of life-ruining hearsay that could destroy anyone that DHS has ever touched? Speaking of which, this bit at the end disgusts me: What is DHS doing to better secure employees’ PII? Why does this read as anything other than "What is DHS doing to better secure american citizens' PII"? DHS employees aren't the only people affected by this. I'd expect "subjects, witnesses and complainants of DHS investigations" to number in the millions.
- fjsolwmv 9y agoPut away the pitchforks. OIG is internal affairs. The people they investigate are employees, not the public. https://www.oig.dhs.gov https://www.oig.dhs.gov
- rrggrr 9y ago"The breach of the DHS OIG Case Files included individuals associated with DHS OIG investigations. Family members and close associates were impacted by this privacy incident only if they were involved in a DHS OIG investigation."
- saulrh 9y agoThat does make it a bit less... totally horrifying. I imagine that there're still plenty of normal people in the "witnesses and complainants" category, so I can't imagine that this only affects DHS employees, but if nothing else that should dramatically reduce the size of the data set.
- mattnewton 9y agoDoes anyone have experience with the credit protection firms always hired to attempt to make right in these cases? It seems like the onus is still on the individual to fix their credit if something bad does happen, so they could conceivably effectively be doing nothing. > “...unauthorized unauthorized transfer of data.” Am I being dense or is this unintended?
- fjsolwmv 9y agoProbably a typo, but in the CIA world, there is a lot of 'authorized unauthorized' "off the books" activity.
- dsfyu404ed 9y ago>Probably a typo, but in large and slow moving bureaucracies, there is a lot of 'authorized unauthorized' "off the books" activity. FTFY. It's actually a pretty good way to explain speculative execution. You know you might need to so something so you just do it using the slush fund and if it isn't useful you toss the result and if it is useful you keep doing it while papers are shuffled around and authorization happens. Certainly not ideal but not unheard of either.