How many forum members have been affected by these data breaches?

Page 2 - Seeking answers? Join the AnandTech community: where nearly half-a-million members share solutions and discuss the latest tech.

hal2kilo

Lifer
Feb 24, 2009
24,137
10,825
136
?...
:rolleyes: Maybe some government employees are there because they can't make the private sector, but that's a rather moronic argument to make. Plenty of highly skilled people work for the government that could work in the private sector - people in OMB, the FDA, the NIH, the USPTO...



The DMV lately has actually been pretty good. NYS allows you to make many changes online - with one login, I can pay my estimated taxes, change my DL's address, update other relevant DMV info, etc...

This gets me everytime. I've moved around alot in my career. For the most part, I've never had a problem with a DMV except for.........wait for it!....
California. It's as bad as the movies depict.
 

rudeguy

Lifer
Dec 27, 2001
47,351
14
61
My guess (and it's just a guess) is that a lot of the systems are designed and implemented by outside security contractors and the agencies themselves have some staff to keep them running, etc.

That's totally how I would have thought before reading that ARS article. Its a long read but its really worth reading. It doesn't take sides, it doesn't bash anyone. It just points out the flaws. Here is a tidbit:

It's no secret that information security at agencies like OPM needs to improve. OPM's security practices were labelled as a "material weakness" by the OPM Inspector General's (IG) office as far back as 2007. A November 2014 report upgraded the IG's evaluation to merely a "significant deficiency," but that was before a hack of contractor KeyPoint Government Solutions was discovered in 2014. The current OPM breached was discovered partially while following up on the KeyPoint situation.

Even before the KeyPoint attack, OPM was moving to correct its deficiencies. Until 2013, the agency had no internal IT staff with "professional IT security experience and certifications." By November of 2014, seven such professionals had been hired and four more were in the pipeline. But only a fraction of the agency's systems had been brought under the control of a central IT security organization.

The IG report noted that just 75 percent of OPM's systems had valid authorizations to operate under Federal Information Security Managenent Act (FISMA) regulations. This was symptomatic of the way OPM handled its IT programs—a tangle of division-level projects with poor central oversight. Many of them were operated by agency contractors outside direct control of OPM's IT staff. And as the IG report noted, "several information security agreements between OPM and contractor-operated information systems have expired."

The mess continued. The IG noted that OPM wasn't even sure of what it had on its network. "OPM does not maintain a comprehensive inventory of servers, databases, and network devices. In addition, we are unable to independently attest that OPM has a mature vulnerability scanning program."

It sounds like a huge clusterfark. And the details of how the IT departments are ran and staffed shows that this is just one weak link in a chain that is bound to have many more weak links.

Bush tried to fix it, Obama tried to fix it, lots of people have tried to fix it. But it comes down to these agencies not taking security as the number one priority.
 

fskimospy

Elite Member
Mar 10, 2006
85,498
50,651
136
That's totally how I would have thought before reading that ARS article. Its a long read but its really worth reading. It doesn't take sides, it doesn't bash anyone. It just points out the flaws. Here is a tidbit:

It sounds like a huge clusterfark. And the details of how the IT departments are ran and staffed shows that this is just one weak link in a chain that is bound to have many more weak links.

Bush tried to fix it, Obama tried to fix it, lots of people have tried to fix it. But it comes down to these agencies not taking security as the number one priority.

It certainly does sound like a huge clusterfuck, I agree.
 

PokerGuy

Lifer
Jul 2, 2005
13,650
201
101
Ideally, yes, but in reality, it also creates a strong incentive to circumvent the rules of the competitive event itself. Wall Street has certainly taught us that.

No doubt that is true as well. Competitive pressure has the benefit of forcing improvement and efficiency, but it can also create an incentive to go over the line.
 

TheSlamma

Diamond Member
Sep 6, 2005
7,625
5
81
:rolleyes: Maybe some government employees are there because they can't make the private sector, but that's a rather moronic argument to make. Plenty of highly skilled people work for the government that could work in the private sector - people in OMB, the FDA, the NIH, the USPTO...

The DMV lately has actually been pretty good. NYS allows you to make many changes online - with one login, I can pay my estimated taxes, change my DL's address, update other relevant DMV info, etc...
OMB seriously? Enron ran better numbers

FDA.. oh the guys who approve all those wonderful drugs. My fav is the one that has "LESS MAJOR bleeding"

USPTO, the guys who continue to allow companies to make a living out of patent trolling?

DMV lately has been better? Is this a troll post or is my sarcasm meter created by gov workers?
 

Bowfinger

Lifer
Nov 17, 2002
15,776
392
126
[ ... ] Competition creates an incentive for efficiency and improvement. Government agencies have no competition ...
Yes, I'm quite familiar with the right-wing dogma behind the talking point. It is highly naive, at best. It misses at least two important realities:

1. Competition is overrated as a driver of efficiency and improvement, especially in larger organizations. First, there are other, often easier ways to handle competition (e.g., buy them, use deep pockets to drive them out of business, bury them in court, legislative changes, etc.) Second, while competitive pressures may ideally drive executives, the workers (including low- and mid-level managers) are driven by their paycheck. There is usually no more than a weak, indirect connection between external competition and their paychecks, so their main drivers are more mundane things like workloads and staying out of trouble. There are exceptions, of course, examples where company leaders really drive that connection down to the ranks. They are exceptions, however.

2. It is a right-wing myth that government workers feel little pressure to perform well and be efficient. First, most government agencies feel tremendous budget pressure. While they may not have a competitor nipping at their heels, they do have a Congress or legislature that won't provide full funding. Government workers are usually under pressure to do more with less, just like their private sector peers. Second, government workers are largely motivated by the same drivers as private workers, things like workloads and staying out of trouble.

In short, the reality is that government and private sector organizations are more alike than different. Regardless of simplistic theories about competition being a magic driver, in the real world it's just one small factor out of many. It depends a lot more on individual leaders and the culture they create.


I figured you or eskimo would come to the 'rescue' and defend the highly efficient and customer friendly government ...
I'm not defending government inefficiency or incompetence. I'm challenging the simple-minded dogma that government is automatically less efficient and more incompetent than the private sector. As I clearly stated, the federal government failed to secure this data properly. My challenge is your insinuation that this is because it's government. There are countless private sector counterexamples that blow holes in your dogma.



it's not a private / public thing, it's competition or lack of it. ...
You are right it's not a private/public thing. I'm glad you recognize this. The next step is to understand that competition isn't nearly the magical driver that you've been trained to believe. It's a simple theory that works much better on paper than it does in the real world.
 
Last edited:

Bowfinger

Lifer
Nov 17, 2002
15,776
392
126
My guess (and it's just a guess) is that a lot of the systems are designed and implemented by outside security contractors and the agencies themselves have some staff to keep them running, etc.
I would expect it's a mix of both internal and external, and that it varies tremendously from agency to agency. I imagine it even varies significantly within some agencies, where some divisions use mostly internal resources while other divisions mostly contract with external vendors. That's the thing so many people don't understand. They envision the government (and other large organizations) as homogeneous wholes when in reality they're usually a loosely connected collection of smaller groups.
 

rudeguy

Lifer
Dec 27, 2001
47,351
14
61
I would expect it's a mix of both internal and external, and that it varies tremendously from agency to agency. I imagine it even varies significantly within some agencies, where some divisions use mostly internal resources while other divisions mostly contract with external vendors. That's the thing so many people don't understand. They envision the government (and other large organizations) as homogeneous wholes when in reality they're usually a loosely connected collection of smaller groups.

Did you even bother to read the link I posted?

You are posting a bunch of things you "imagine" and are ignoring the facts.

The facts are that the government didn't even have anyone qualified or certified in security working there. They didn't keep track or even know what was connected to their network.

Its you who doesn't understand. And its not because the data isn't there, you are just choosing to ignore it because it doesn't agree with your pre-conceived notions.
 

Bowfinger

Lifer
Nov 17, 2002
15,776
392
126
Did you even bother to read the link I posted?

You are posting a bunch of things you "imagine" and are ignoring the facts.

The facts are that the government didn't even have anyone qualified or certified in security working there. They didn't keep track or even know what was connected to their network.

Its you who doesn't understand. And its not because the data isn't there, you are just choosing to ignore it because it doesn't agree with your pre-conceived notions.
You're doing it again. Your article was specifically about one federal agency, the Office of Personnel Management (OPM). My comment, Eskimospy's comment, and even your own comment above (see bolded) all talk about government generally, agencies (plural), etc. I said, for example, that it "varies tremendously from agency to agency." OPM is not the whole government, not even close.

Would you care to withdraw your attack, or is this going to be another one of those where you run away and ignore the fact you were wrong again?

Edit: And you might want to reread the ARS piece with the new (to you) knowledge that OPM is just one agency within the giant federal government. It makes a difference.
 
Last edited:

rudeguy

Lifer
Dec 27, 2001
47,351
14
61
You're doing it again. Your article was specifically about one federal agency, the Office of Personnel Management (OPM). My comment, Eskimospy's comment, and even your own comment above (see bolded) all talk about government generally, agencies (plural), etc. I said, for example, that it "varies tremendously from agency to agency." OPM is not the whole government, not even close.

Would you care to withdraw your attack, or is this going to be another one of those where you run away and ignore the fact you were wrong again?

Edit: And you might want to reread the ARS piece with the new (to you) knowledge that OPM is just one agency within the giant federal government. It makes a difference.

OK great.

Show me any data that backs up what you "imagined".
 

PokerGuy

Lifer
Jul 2, 2005
13,650
201
101
Yes, I'm quite familiar with the right-wing dogma behind the talking point. It is highly naive, at best. It misses at least two important realities:

lol, "right wing dogma". Apparently you've never been to an economics class? Beyond the "duh, water is wet, competition drives improvement" aspect, I can provide links to many studies that conclusively show that competition drives increased efficiency, not just in small companies, but also in large ones. Surely you have data and facts to back up your contention that such a notion is "naive at best" right?

You seriously want to argue that without competition from Samsung, Apple would have the same product improvements? (and Samsung without Apple would be the same?). You seriously want people to believe that without competition there would be as much incentive to improve on the product?

1. Competition is overrated as a driver of efficiency and improvement, especially in larger organizations.
And your basis for this knowledge is....? This http://onlinelibrary.wiley.com/doi/...sCustomisedMessage=&userIsAuthenticated=false says differently. Granted, the research was done in the UK, but there is no reason to assume it doesn't apply in the US as well. Also, someone should tell The Economist that their "right wing dogma" theory on the link between competition and innovation is completely wrong http://forums.anandtech.com/“...ou can take business from is yourself?” . Nice quote from that one:
“what’s the point of focusing on making the product even better when the only company you can take business from is yourself?”
Why the heck would you spend a lot of resources on innovation or efficiency when the customer is already captive and has no other options?

First, there are other, often easier ways to handle competition (e.g., buy them, use deep pockets to drive them out of business, bury them in court, legislative changes, etc.)
Large organizations with deep pockets have to compete against others in the marketplace that also include similar deep pockets. As long as there is competition in a marketplace, everyone faces competition, so no, there are not "easier ways to handle competition" in a competitive marketplace. All participants are driven to get more efficient and innovate, or they will get pushed out of the market (or to extinction) by those that do.

Second, while competitive pressures may ideally drive executives, the workers (including low- and mid-level managers) are driven by their paycheck. There is usually no more than a weak, indirect connection between external competition and their paychecks, so their main drivers are more mundane things like workloads and staying out of trouble. There are exceptions, of course, examples where company leaders really drive that connection down to the ranks. They are exceptions, however.
Again, completely delusional. Have you ever worked in a large company? Leadership sets the direction, and puts in place policies to get them in that direction - which includes training, compensation etc. Leadership has a strong incentive to have the business be successful, and that will be reflected in their decisions that drive the activities of the business. Without the buy-in from associates, the business goes nowhere.

2. It is a right-wing myth that government workers feel little pressure to perform well and be efficient.
Yeah, "logic" is a "right wing myth" apparently :D

First, most government agencies feel tremendous budget pressure.
No more so than their private sector counterparts. In fact, less so because <gasp> there is no competition and 'customers' can't go to another 'provider' if you don't get the job done to their satisfaction.

While they may not have a competitor nipping at their heels, they do have a Congress or legislature that won't provide full funding.
lol, Congress and their hyper vigilance will drive efficiency. We all know how tremendously vigilant Congress is with spending levels! Now there's a good one. Can you say that with a straight face?

Government workers are usually under pressure to do more with less, just like their private sector peers.
Again, no more so than their private sector peers. No difference... except private sectors have to worry about losing their job when customers go to their competition if they are unhappy.

Second, government workers are largely motivated by the same drivers as private workers, things like workloads and staying out of trouble.
With one CRITICAL problem: the feedback loop is, to a large extent, broken. Customers voting with their wallet and heading to the competition is the feedback loop that companies use. It drives them to do things to avoid losing customers and to gain new ones. Since government doesn't have the threat of competition, there is very little in terms of a feedback loop, and there is no need to deliver a better product to win over customers.

Regardless of simplistic theories about competition being a magic driver
I look forward to seeing all that evidence supporting your theories that competition doesn't actually drive efficiency, innovation and improvements. This oughta be good!

I'm challenging the simple-minded dogma that government is automatically less efficient and more incompetent than the private sector.
Again that "simple-minded dogma" = "logic". Absent competition, any organization (not just government) will tend to be less efficient and innovate less, because there is less incentive to do so.

My challenge is your insinuation that this is because it's government.
Reading comprehension fail. I did not say they got hacked because it's government, as private companies get hacked as well. My point was that if private companies get hacked, government agencies are most certainly going to be in even more danger as they are even slower to react to the market and are even less efficient.

The next step is to understand that competition isn't nearly the magical driver that you've been trained to believe. It's a simple theory that works much better on paper than it does in the real world.
Again, looking forward to all the evidence supporting your "competition doesn't drive innovation, efficiency or customer service" theories.
 

blastingcap

Diamond Member
Sep 16, 2010
6,654
5
76
Why aren't we contracting out security of all sensitive (national security and personal security) system to highly qualified companies?

We already do. These idiot blowhards whining about how the private sector would have done better need to shut up because the govt does already contract with private companies for security in many cases.

Hacking is like war: there is no such thing as a perfect defense. They kept trying to make armored knights more heavily armored vs arrows and stuff but in the end, nothing could stop bullets and cannons. If Iran wanted to empty its entire arsenal into Israel, Israel's "Iron Dome" could not stop it. The "defense" in modern warfare is more like offense--if you hit me, I can't stop it, but I can hit you back. I.e., Israel nukes Tehran in response to Iranian invasion.

In this situation, the US govt and companies can't stop all breaches. But it can strike back. Rest assured the US govt is already gearing up for retaliation vs. China. It's just not publicized.
 

rudeguy

Lifer
Dec 27, 2001
47,351
14
61
We already do. These idiot blowhards whining about how the private sector would have done better need to shut up because the govt does already contract with private companies for security in many cases.

Hacking is like war: there is no such thing as a perfect defense. They kept trying to make armored knights more heavily armored vs arrows and stuff but in the end, nothing could stop bullets and cannons. If Iran wanted to empty its entire arsenal into Israel, Israel's "Iron Dome" could not stop it. The "defense" in modern warfare is more like offense--if you hit me, I can't stop it, but I can hit you back. I.e., Israel nukes Tehran in response to Iranian invasion.

In this situation, the US govt and companies can't stop all breaches. But it can strike back. Rest assured the US govt is already gearing up for retaliation vs. China. It's just not publicized.

Can you please provide data to back that up?
 

rudeguy

Lifer
Dec 27, 2001
47,351
14
61

blastingcap

Diamond Member
Sep 16, 2010
6,654
5
76
I know this reading thing is hard.

My quote that you quoted:

You said:

Not some. All.

I said IN MANY CASES. Not literally all, but the point that some people are trying to make is that slovenly overpaid public sector workers can't do it so farm it out to lean efficient private sector workers. But we already do outsource a lot and the results aren't necessarily any better than what you get with internal workers. I know some people have done studies on this and it appears to be a myth.. there can be a lot of inefficiency in government contractors as well. To say the least.

So you can drop the snark.

Edited to add: here's my exact words. I never said "all."

...the govt does already contract with private companies for security in many cases.
 
Last edited:

rudeguy

Lifer
Dec 27, 2001
47,351
14
61
Sigh. Fine, not literally all, but the point that some people are trying to make is that slovenly overpaid public sector workers can't do it so farm it out to lean efficient private sector workers. But we already do outsource a lot and the results aren't necessarily any better than what you get with internal workers. I know some people have done studies on this and it appears to be a myth.. there is a lot of inefficiency in government contractors as well. To say the least.

I don't doubt that at all. Also, I wasn't setting a trap or trying to troll you...I thought maybe I was dead wrong in my rant. I also don't think the problem is government workers. The problem is the government is so big, there are so many agencies with so many employees, each with their own focus, that I don't think they could focus on data security and still do their jobs.

No system is going to be perfect and maybe its the right wing nut job in me, but I am just not seeing the government as being able to handle this. I keep using "government" on purpose because even if you plug this hole, another is going to pop up.

I don't know man...I just feel like something has to change and I don't believe that throwing money at this one will fix it.
 

blastingcap

Diamond Member
Sep 16, 2010
6,654
5
76
I don't doubt that at all. Also, I wasn't setting a trap or trying to troll you...I thought maybe I was dead wrong in my rant. I also don't think the problem is government workers. The problem is the government is so big, there are so many agencies with so many employees, each with their own focus, that I don't think they could focus on data security and still do their jobs.

No system is going to be perfect and maybe its the right wing nut job in me, but I am just not seeing the government as being able to handle this. I keep using "government" on purpose because even if you plug this hole, another is going to pop up.

I don't know man...I just feel like something has to change and I don't believe that throwing money at this one will fix it.

Look at the rest of my post that you didn't quote, about war. Cyberdefense is like trying to defend in war. It can't really be done.

The "solution" to real-life (nuclear) war, which of course isn't a true solution, is to have a credible threat of counterattack to dissuade anyone from messing with us. We've survived the first 70 years of nuclear weapons based on Mutually Assured Destruction.

I think the "solution" to cyberattacks will look similar MAD. Like, "If you hack us again, we're taking down your electric grid for a day." Unfortunately that only goes so far. The USA has lots of allies--are we supposed to put them under our cyberattack umbrella like our nuclear umbrella? Where does it all end?
 

blankslate

Diamond Member
Jun 16, 2008
8,702
507
126
The government has a problem just obtaining new systems.

Nevermind the fact that the economic policies of past presidents on both sides of the aisle have made it so that those organizations almost certainly cannot put together an, entirely manufactured in the U.S., IT infrastructure without spending money that would make the budget members of Congress defecate in their pants.

Any system not entirely made in the U.S. has more of a chance of being compromised imo.


.....
 

cabri

Diamond Member
Nov 3, 2012
3,616
1
81
Officials: Second hack exposed military and intel data

WASHINGTON (AP) — Hackers linked to China appear to have gained access to the sensitive background information submitted by intelligence and military personnel for security clearances, several U.S. officials said Friday, describing a second cyberbreach of federal records that could dramatically compound the potential damage.

The forms authorities believed to have been accessed, known as Standard Form 86, require applicants to fill out deeply personal information about mental illnesses, drug and alcohol use, past arrests and bankruptcies. They also require the listing of contacts and relatives, potentially exposing any foreign relatives of U.S. intelligence employees to coercion. Both the applicant's Social Security number and that of his or her cohabitant is required.

The officials spoke on condition of anonymity because the security clearance material is classified.

The security-clearance records provide "a very complete overview of a person," said Evan Lesser, managing director of ClearanceJobs.com, a website that matches security-clearance holders to available slots. "You don't need these records to blackmail or exploit someone, but it would sure make the job easier."

The Office of Personnel Management, which was the target of the hack, has not officially notified military or intelligence personnel whose security clearance data was breached, but news of the second hack was starting to circulate in both the Pentagon and the CIA.

The officials said they believe the hack into the security clearance database was separate from the breach of federal personnel data announced last week — a breach that is itself appearing far worse than first believed. It could not be learned whether the security database breach happened when an OPM contractor was hacked in 2013, an attack that was discovered last year. Members of Congress received classified briefings about that breach in September, but there was no mention of security clearance information being exposed.

...

10 years ago, OPM took over security clearance processing from the DIA because DIA was taking to long.

Did the OPM contractor breach damage impact get filtered/covered up and subsequently led to this?

Inquiring minds will want to know and OPM will be on the hot seat here.
 

Triumph

Lifer
Oct 9, 1999
15,031
13
81
Thread has devolved into a typical right wing/left wing argument, just like the rest of this forum. How about discussing something relevant, like what exactly people who are affected by this do to further protect themselves?
 

allisolm

Elite Member
Administrator
Jan 2, 2001
25,056
4,493
136
Thread has devolved into a typical right wing/left wing argument, just like the rest of this forum. How about discussing something relevant, like what exactly people who are affected by this do to further protect themselves?

Or even what the title asks - " How many forum members have been affected by these data breaches?"

I know that, despite breaches at Target, Home Depot and the like, I have yet to receive a single letter telling me that my information appears to have been stolen. Nothing indicating that I will get a free year of credit monitoring. Nothing at all. So far.
 

Londo_Jowo

Lifer
Jan 31, 2010
17,303
158
106
londojowo.hypermart.net
I was not affected by the Home Depot breach but did get a new ATM/Debit card from Wells Fargo after the Target breach. I was told by a Wells Fargo financial agent once the Target breach became known they immediately canceled the affected credit and ATM/debit cards and issued new ones.