4 ms·

> usernames and passwords that background investigation applicants used if this is correct, I guess that means passwords were stored in cleartext or reversibly

by adzicg 11y ago

> usernames and passwords that background investigation applicants used if this is correct, I guess that means passwords were stored in cleartext or reversibly encrypted. that is either epic stupidity, or someone wanted to keep passwords of potential employees so they could use them elsewhere

eli 11y ago
Malice is very unlikely. If I had to guess, maintaining interoperability with legacy systems probably played a role.
- r00fus 11y ago
  Which points to corruption and inability to control your vendors (i.e., regulatory capture). Ultimately in large organizations like this that are arguably well funded, the answer often lies in corruption (and not necessarily just the bureaucracy, but also the legislators who earmark crazy stuff like specific vendors and specifications that are handpicked for their favorite funders).
  - cordite 11y ago
    Sounds like the DoD asking for bids for a support for a product, which can only be legally fulfilled by the authors of the product--instead of considering replacing the product where more than one can actually bid for it.
    - icebraining 11y ago
      Sounds like the DoD asking for bids for a support for a product, which can only be legally fulfilled by the authors of the product Why can it only be fulfilled by the authors?
      - cordite 11y ago
        Because the authors don't have a contract licensing program for consultants
- kevin_thibedeau 11y ago
  There wasn't that much legacy. The first web based form was rolled out in 2000-2001. Candidates wouldn't need to have credentials that worked on the legacy back end services. I wouldn't put it past them that they did this on purpose to have an easy route into online accounts since EO12333 gives them a blank check to do whatever they want when conducting a background investigation. They don't even have to line up for a rubber stamp from FISA.
  - dredmorbius 11y ago
    You're assuming there are no legacy back-end systems that those Web systems interact with. Not a particularly valid assumption.
    - kevin_thibedeau 11y ago
      OPM couldn't produce my paper SF-86 submitted from right before the switch to the web based system when I requested it a couple years ago. i.e. they never transcribed it for electronic storage, meaning there was no critical back end legacy in place to begin with. Candidates would never have credentials to a back end system in any case and wouldn't need to be recorded in a global "users" table. The process only requires logging into the front end for editing, review, and submission. Once that is complete there's nothing more to do. That doesn't require any sort of integration.
Spooky23 11y ago
It is what happens when you let contractors run everything. Nobody knows anything. When Republicans let slogans like "we need smaller government" define governance, this is a big part of what happens.
- ams6110 11y ago
  Democrats have been running the show for the past 8 years.
  - Spooky23 11y ago
    The House of Representatives controls the purse strings, and is aggressive in their wielding of that power.
  - dredmorbius 11y ago
    Democrats have controlled the executive branch for the past 7 years. The Democrats had a filibuster-proof majority in the Senate -- for four months. From September 24, 2009, to February 4, 2010. Prior to then, the Deomocrats nominally had 60 seats in the Senate, but: Edward Kennedy was ill from the night of Obama's inaguration. Senator Al Franken's election was disputed for months. Arlen Specter switched from Republican to Democrat, in order to hold his seat, but didn't support the Democrats for filibusters. Senator Byrd was in hospital for much of 2009. Absent a filibuster-proof majority, the GOP could and did effectively block any legislative action, at will, to the point of shutting down the Federal government of the United States for two and a half weeks. http://cjonline.com/blog-post/lucinda/2012-10-15/obama-has-never-had-control-over-senate-%E2%80%93-not-once http://cjonline.com/blog-post/lucinda/2012-10-15/obama-has-n... No, the Democrats haven't been "running the show for the past 8 years."
- adventured 11y ago
  In what way does the Federal Government lack the resources to secure OPM data? Whether we're talking about OPM's $2.x billion budget, or the NSA's budget, or a dozen other agencies that supposedly have something to do with security. The US spends more on domestic security theater than Germany or France spend on their entire military.
KMag 11y ago
My information is likely in the dump, due to some contractor work I did back in 2003-2005. My best guess is the leaked passwords are the passwords needed to decrypt the most confidential portions of the security clearance questionaires, which was (is?) distributed as a DOS binary. The protected data generally contains people's deepest darkest secrets, and information on where to begin digging for more information that could be used to blackmail them into working for a foreign power. This information is collected in order to estimate how succeptable the applicant would be to blackmail, but is also the perfect starting point for starting a campaign to blackmail current security clearance holders into spying for a foreign power. At least the way it worked in 2003 was that a security officer emailed you an old 16-color DOS application called EPSQ 2.2. As I remember, the application actually saved its data back into the binary, so people wouldn't be confused about what to email back to the security officer when they were done. The EPSQ questionaire had two sections... one contained some basic data that your employer needed to see, and one contained drug use, alcohol abuse, mental health, financial problems, legal problems, etc. You picked two passwords that were used to encrypt the two sections, filled out the questionire, and emailed it back. You then gave the less sensitive password to the security officer. I don't remember if I sent the more sensitive password to the OPM or if EPSQ 2.2 contained public key crypto/obfuscation so that the OPM could recover the sensitive information encryption key. In any case, the human-picked password/encryption key most definitely could be used to decrypt the most sensitive data (blackmail information) in order to facilitate saving a partially completed questionaire and finishing it up at a later date. These days, I really hope EPSQ is a web app that's accessed via a binary with a single TLS certificate authority hard-coded (and using perfect forward security), so copies of super-sensitive data aren't left in several mail queues protected only by (generally low-entropy) human-generated encryption keys.

by adzicg 11y ago

eli 11y ago

Malice is very unlikely. If I had to guess, maintaining interoperability with legacy systems probably played a role.

r00fus 11y ago
Which points to corruption and inability to control your vendors (i.e., regulatory capture). Ultimately in large organizations like this that are arguably well funded, the answer often lies in corruption (and not necessarily just the bureaucracy, but also the legislators who earmark crazy stuff like specific vendors and specifications that are handpicked for their favorite funders).
- cordite 11y ago
  Sounds like the DoD asking for bids for a support for a product, which can only be legally fulfilled by the authors of the product--instead of considering replacing the product where more than one can actually bid for it.
  - icebraining 11y ago
    Sounds like the DoD asking for bids for a support for a product, which can only be legally fulfilled by the authors of the product Why can it only be fulfilled by the authors?
    - cordite 11y ago
      Because the authors don't have a contract licensing program for consultants
kevin_thibedeau 11y ago
There wasn't that much legacy. The first web based form was rolled out in 2000-2001. Candidates wouldn't need to have credentials that worked on the legacy back end services. I wouldn't put it past them that they did this on purpose to have an easy route into online accounts since EO12333 gives them a blank check to do whatever they want when conducting a background investigation. They don't even have to line up for a rubber stamp from FISA.
- dredmorbius 11y ago
  You're assuming there are no legacy back-end systems that those Web systems interact with. Not a particularly valid assumption.
  - kevin_thibedeau 11y ago
    OPM couldn't produce my paper SF-86 submitted from right before the switch to the web based system when I requested it a couple years ago. i.e. they never transcribed it for electronic storage, meaning there was no critical back end legacy in place to begin with. Candidates would never have credentials to a back end system in any case and wouldn't need to be recorded in a global "users" table. The process only requires logging into the front end for editing, review, and submission. Once that is complete there's nothing more to do. That doesn't require any sort of integration.

Spooky23 11y ago

It is what happens when you let contractors run everything. Nobody knows anything. When Republicans let slogans like "we need smaller government" define governance, this is a big part of what happens.

ams6110 11y ago
Democrats have been running the show for the past 8 years.
- Spooky23 11y ago
  The House of Representatives controls the purse strings, and is aggressive in their wielding of that power.
- dredmorbius 11y ago
  Democrats have controlled the executive branch for the past 7 years. The Democrats had a filibuster-proof majority in the Senate -- for four months. From September 24, 2009, to February 4, 2010. Prior to then, the Deomocrats nominally had 60 seats in the Senate, but: Edward Kennedy was ill from the night of Obama's inaguration. Senator Al Franken's election was disputed for months. Arlen Specter switched from Republican to Democrat, in order to hold his seat, but didn't support the Democrats for filibusters. Senator Byrd was in hospital for much of 2009. Absent a filibuster-proof majority, the GOP could and did effectively block any legislative action, at will, to the point of shutting down the Federal government of the United States for two and a half weeks. http://cjonline.com/blog-post/lucinda/2012-10-15/obama-has-never-had-control-over-senate-%E2%80%93-not-once http://cjonline.com/blog-post/lucinda/2012-10-15/obama-has-n... No, the Democrats haven't been "running the show for the past 8 years."
adventured 11y ago
In what way does the Federal Government lack the resources to secure OPM data? Whether we're talking about OPM's $2.x billion budget, or the NSA's budget, or a dozen other agencies that supposedly have something to do with security. The US spends more on domestic security theater than Germany or France spend on their entire military.

KMag 11y ago

My information is likely in the dump, due to some contractor work I did back in 2003-2005. My best guess is the leaked passwords are the passwords needed to decrypt the most confidential portions of the security clearance questionaires, which was (is?) distributed as a DOS binary. The protected data generally contains people's deepest darkest secrets, and information on where to begin digging for more information that could be used to blackmail them into working for a foreign power. This information is collected in order to estimate how succeptable the applicant would be to blackmail, but is also the perfect starting point for starting a campaign to blackmail current security clearance holders into spying for a foreign power. At least the way it worked in 2003 was that a security officer emailed you an old 16-color DOS application called EPSQ 2.2. As I remember, the application actually saved its data back into the binary, so people wouldn't be confused about what to email back to the security officer when they were done. The EPSQ questionaire had two sections... one contained some basic data that your employer needed to see, and one contained drug use, alcohol abuse, mental health, financial problems, legal problems, etc. You picked two passwords that were used to encrypt the two sections, filled out the questionire, and emailed it back. You then gave the less sensitive password to the security officer. I don't remember if I sent the more sensitive password to the OPM or if EPSQ 2.2 contained public key crypto/obfuscation so that the OPM could recover the sensitive information encryption key. In any case, the human-picked password/encryption key most definitely could be used to decrypt the most sensitive data (blackmail information) in order to facilitate saving a partially completed questionaire and finishing it up at a later date. These days, I really hope EPSQ is a web app that's accessed via a binary with a single TLS certificate authority hard-coded (and using perfect forward security), so copies of super-sensitive data aren't left in several mail queues protected only by (generally low-entropy) human-generated encryption keys.