DS Ops, LLC

President Barack Obama wants to spend his last 18 months in office turning government technology on its head. Obama says government’s procurement systems are broken, but he believes organizations like the U.S. Digital Service can change the way people develop, buy and use new technology. Tom Shoop is editor-in-chief at Government Executive magazine. He tells In Depth with Francis Rose about the likelihood of a major systemic change in the way government buys and implements new technology.

Agencies now have 30 days to sprint to new cybersecurity standards after multiple data breaches at the Office of Personnel Management. But some chief information security officers say they are more concerned about what impact a cyber attack will have on their organization’s reputation than the data itself that’s at risk. That’s according to a new report from the RAND Corporation, “The Defender’s Dilemma: Charting a Course Toward Cybersecurity.” Martin Libicki, a senior management scientist and professor at the Pardee RAND Graduate School, is a co-author of the report. He tells In Depth with Francis Rose what he heard from 18 CISOs about their cybersecurity operations.

Sen. Mark Warner (D-Va.) joins in the questioning of how OPM made the decision to award a contract to Winvale for credit monitoring services. The senator and AFGE are hearing from current and former federal employees complaining about the services provided under the $20.7 million deal.

As saying goes, ever dark cloud has a silver lining. That’s true for the recent OPM cyber breach. You just have to look very, very, very hard to find it, says Senior Correspondent Mike Causey.

news/announcements/frequently-asked-questions/” target=”_blank”>Frequently
Asked Questions section of its website Thursday with a few more details
about the files hackers accessed. OPM previously stated that
the breach affected 4 million current and former federal employees. It now
says that estimate includes employees of any branch of the government whose
organizations sent records to OPM for retirement purposes, regardless of
whether the employee’s full personnel file
is stored on OPM’s network.

“These records include service history records (such as the SF
2806), court orders, and other records and information that pertain to
annuity calculations,” OPM said on the website.

Those records include sensitive information such as names, Social Security
numbers and birth dates. They may also contain an employee’s job assignments,
training records and benefit selections, OPM says.

OPM maintains personnel records for most, but not all, civilian agencies.
Other federal organizations may submit an employee’s service-history
documentation to OPM on certain occasions, the agency warned. Those include
when an employee transfers from one agency to another, leaves an agency, or
when the agency changes its payroll service center.

OPM said it believes active military personnel were not affected, although
current and former Defense Department civilian employees were. It cautioned
that it is still investigating the incidents, and new information might cause
it to revise those statements.

Victims should receive notices by email or post from CSID, a company that OPM
has contracted with to provide identity-
protection services. OPM said it will finish sending those notices out
today, but it may take a few more days to arrive.

In comparison to the details shared about this data breach, OPM has
said little about a more recently announced breach reported to put 14 million
people at risk.

Investigators discovered that breach in the course of investigating the
first attack. The larger breach compromised security-clearance holders and
applicants’ records. OPM said it is still determining the scope of that
intrusion. It expects to notify victims at some point, it said.

“The investigation is still ongoing, and we will notify affected individuals
as soon as is practicable. As with any such event, it takes time to conduct a
thorough investigation and to identify the affected individuals,” it said.

OPM has tried to reassure those going through background investigations now
that their data is secure. It still is processing those files. It said it is
working closely with the White House, Homeland Security Department and others
to safeguard that data.

“Protecting the security and integrity of the information entrusted to OPM is
central to our mission, and we will continue to keep you apprised as the
investigation continues,” OPM said.

OPM has been criticized by federal employee groups and members of Congress for
the lack of information it has shared with the public about the two breaches.

OPM Director Katherine Archuleta refused to answer many questions posed by
lawmakers at a congressional hearing earlier this week. She said those
questions were best discussed in a classified setting.

Since then, a number of lawmakers have called on Archuleta to step down.

RELATED STORIES:

– The Obama administration is increasingly confident that China’s government, not criminal hackers, was responsible for the extraordinary theft of personal information about as many as 14 million current and former federal employees and others, The Associated Press has learned. One sign: None of the data has been credibly offered for sale on underground markets popular among professional identity thieves.

The letters sent to those affected by the Office of Personnel Management cyber breach contain a certain sentence that attempts to indemnify the government from any liability surrounding the breach. But that sentence alone may not protect the government from someone who wants to sue it for damages. Federal employment attorney Heidi Burakiewicz, a partner at the law firm Mehri and Skalet, joined Tom Temin on the Federal Drive with an insider’s look at how the 1974 Privacy Act could cover recent cyber attacks and let lawsuits fly.

While the number of people in Congress calling for the OPM director to resign grows, the White House is voicing support for Katherine Archuleta. NTEU and NARFE have sent letters to OPM asking for more details on the second breach.

Federal News Radio asked readers how they rated the performance of the Office of Personnel Management in communicating information about the recent data breaches. An overwhelming number rated the information as “poor” and many still didn’t understand what happened or what they should do next.

The DoD CIO wants to focus on the “basics” to shore up Pentagon’s cybersecurity posture, including increased accountability for users of military networks.