Tag: officials
Cyberattacks On State Databases Escalate

Cyberattacks On State Databases Escalate

NASHVILLE, Tenn. — State governments are facing a daily barrage of cyberattacks from increasingly sophisticated computer hackers. The hackers’ rapidly changing tactics threaten the exposure of personal information of millions of people and can cost millions of dollars to fix.
“We see attacks on Texas’ system to the tune of millions a month,” said Karen Robinson, Texas’ state chief information officer.
Although breaches of Texas state computers are rare, Robinson said, the risks are high. They can result in the theft of Social Security numbers, dates of birth, driver’s license numbers and even personal and business financial information.
All states face a growing number of wide-ranging, quickly evolving attacks, according to a report from the National Association of State Chief Information Officers and the consulting firm Deloitte & Touche.
Despite the threat, the report found, state legislators often don’t give their technology and security officials enough money to fight it, and states struggle to retain technologically savvy cybersecurity personnel.
The report said the dangers of insufficient cybersecurity are high, not only for people citizens whose personal information can be compromised, but also for taxpayers and the public’s trust in government.
“These incidents have cost states millions of dollars in clean-up costs, as well as a loss of both revenues and public trust,” the report said. “The problem is not likely to go away any time soon, as cybercriminals continue to be drawn to the wealth of data residing in each state.”
State computers hold a treasure trove of personal information. Motor vehicle agencies have dates of birth and driver’s license numbers. Health agencies have people’s birth certificates and Social Security numbers. Tax records show what banks people and businesses have accounts with. States also have credit card numbers from people who have made payments to state agencies.
“You can get pretty much everything on someone out of state computers,” said Srini Subramanian, a state cybersecurity specialist with Deloitte who co-authored the report. “It makes them a very attractive target to cybercriminals.”

Recent breaches point up the dangers and the costs:
Montana notified 1.3 million people in June that their personal data was possibly exposed to hackers in a breach of state Department of Public Health and Human Services computers a year earlier. The state said there was no evidence that personal information was stolen, but offered free credit monitoring and insurance for a year to those they notified.

Washington state’s court system was hacked in February, exposing up to 160,000 Social Security numbers and a million driver’s license numbers. The courts’ administration office said some numbers in its computers had definitely been accessed.

California’s Department of Technology reported 7,345 data breaches at state departments and agencies from the beginning of 2013 through early November last year, KNTV television reported. The state had to notify 23,379 people that their personal information may have been compromised, and spent at least $5 million to fix the breaches.
Although not every state database has been badly breached, the threat is a daily one. Six out of 10 of the state chief information and security officers from 49 states pointed to greater sophistication in the attacks, the report said. That’s an increase from two years ago, when a similar report found that roughly half saw more sophisticated tactics.

“Everybody is getting hit daily,” said Michael Cockrill, chief information officer for Washington state.
Cockrill, who recently came to his new job from the private sector, said he’s seen reports that as many as 40 percent of cyberattacks launched in the U.S. originate from inside his state.
Thieves want the personal information stored by states because it helps enable identity theft that opens greater doors of financial opportunity, the information officers said. That’s more valuable than just credit card information, which can be damaging enough.
“Health records are valuable because they have so much information,” Cockrill said of the dates of birth and Social Security numbers they can contain. “Health records are worth $10 on the black market, credit cards a dollar.”

Although the report’s survey said the security officials’ biggest fear is the placement of malicious software code in state computers, other threats are on the rise that can compromise personal information.
Eight out 10 of the officers predict an increase in “phishing” and “pharming” for personal or business information, and 72 percent predict more “social engineering” of people — manipulating them into divulging personal information or tricking them into schemes to defraud them.
Phishing attacks usually involve fraudulent email messages that guide victims to fake websites that look legitimate, but which are designed to obtain personal information such as passwords to their financial accounts.
Pharming redirects people from legitimate websites that have been tampered with to other sites that are fake.
Also on the rise is “hacktivism,” the hacking into government computers to make social statements, cause mayhem or provide platforms for activist groups to gain exposure.

“They aren’t after financial gains,” Deloitte’s Subramanian said. “They want to make a statement. And what’s a better place to make a statement than on a state government site.”
One example, he said, is Ferguson, Mo., where police computers and those of police unions were attacked by activists seeking the identity of the officer involved in the racially charged shooting this summer that set off nights of civil unrest.
Only 24.5 percent of the information and security officers said they were “very confident” they could protect against cyberthreats, the report found. That’s little different from two years ago, when 24 percent said the same thing.
In contrast, 60 percent of officials in the state departments and agencies that the information technology officers serve say they are very confident in their states’ abilities to protect them.
That disconnection between the information technology people on the front lines and other state officials helps explain why states aren’t putting as much money into cybersecurity as they should, Subramanian said.

About half the states allocate only 1 percent to 2 percent of their information technology budgets to security, the report said. The federal government, by contrast, allocates about 11 percent, Cockrill said.
States rely in large part on outside security software companies to help protect and police their computer systems. And despite their increased sophistication in surveillance, protection and response, most state officers said they are only somewhat confident in their cybersecurity.
States also have trouble getting and hanging onto trained cybersecurity personnel.
Fifty-nine percent of the officers surveyed for the report said they are short on trained people. That’s up from the 46 percent who said so two years ago.
The officers say states simply cannot pay as much as the private sector. That’s especially true in high-tech Washington state.
“We’ve been hiring people from Eastern Europe to provide security,” Cockrill said. “We’re a training ground for the private sector. They come, they get trained and get paid twice as much or more in the private sector.”

To recruit new security analysts, Cockrill is turning to military veterans. With some grant money, he’s seeking to give them computer skills to supplement the security and threat analysis experience they have from their military service. To retain them, he said, he’ll have to appeal to their sense of duty, because he can’t pay salaries nearly as high as what is available in the private sector.

AFP Photo/Greg Wood

Want more national news and analysis? Sign up for our daily email newsletter!

U.S. Officials Frustrated By Nigeria’s Response To Girls’ Kidnapping

U.S. Officials Frustrated By Nigeria’s Response To Girls’ Kidnapping

By Brian Bennett, Tribune Washington Bureau

WASHINGTON — As American military and intelligence specialists joined the hunt for Nigeria’s missing schoolgirls, U.S. officials expressed frustration Thursday with the country’s inability to act on fresh intelligence about the Boko Haram extremists who took more than 200 teenagers captive and threatened to sell them into slavery.

Imagery from U.S. surveillance drones and satellites over the last week has shown suspected bands of Boko Haram militants setting up temporary camps and moving through isolated villages and along dirt tracks in northeastern Nigeria, according to U.S. officials.

The Obama administration has shared the imagery with Nigerian President Goodluck Jonathan’s government in Abuja. But Nigeria’s security forces are hampered by poor equipment and training and have failed to respond quickly, said a U.S. official familiar with the growing search operation.

U.S. defense officials believe militants from Boko Haram, a militant Islamic sect, split the girls into several groups after the April 14 kidnapping from a government-run school in Chibok village. The leader of the militants, Abubakar Shekau, said this week that he would release some of the girls in exchange for imprisoned members of his group.

Bolstered by international help, the Nigerian-led search has now expanded to include an ungoverned area of desert and scrub roughly the size of West Virginia that crosses the porous borders into neighboring Chad, Niger and Cameroon, according to U.S. officials. The girls’ locations are still unknown, however.

Mounting U.S. frustration about the case spilled into the open at a Senate hearing Thursday.

“It is impossible to fathom that we might have actionable intelligence and we would not have the wherewithal — whether by the Nigerians themselves or by other entities helping the Nigerians — to be able to conduct a rescue mission,” said Sen. Robert Menendez, D-N.J., chairman of the Senate Foreign Relations Committee.

“In general, Nigeria has failed to mount an effective campaign against Boko Haram,” Alice Friend, the Pentagon’s principal director for Africa, told committee members. “In the face of a new and more sophisticated threat than it has faced before, its security forces have been slow to adapt with new strategies, new doctrines and new tactics.”

Parents of the abducted girls have complained that they reported the location of the militants and the girls days after the kidnapping but that security forces did not respond. Jonathan reportedly plans to fly to Chibok on Friday for the first time since the girls were seized.

In addition to the U.S. drones and satellite coverage, a manned U.S. surveillance plane has been flying sorties over Nigeria this week. The British government has pledged to send a surveillance aircraft, and France, Israel and China have offered to share intelligence and satellite imagery, officials said.

The U.S team of about 30 advisers includes military experts in logistics, communications and information sharing. The White House has said it has no plan to send troops to take active part in search-and-rescue operations.

U.S. options are limited. A 1997 law prohibits American forces from working with foreign military units that have been accused of chronic human rights violations. The law has prevented U.S. officials from dealing with a Nigerian counter-terrorism unit that has experience tracking Boko Haram, officials said.

Boko Haram’s brutal insurgency has created widespread fear in northeast Nigeria, but the military’s harsh operations have left many villagers distrustful of authorities and unwilling to pass on tips, U.S. experts say.

Human rights groups have documented widespread abuses by Nigerian forces over the last few years, including the burning of homes and farm buildings, shooting suspected Boko Haram members as revenge for attacks on police, and detaining young men indefinitely without trial.

The army and police “are not disciplined and are very abusive,” Sarah Margon, the Washington director of Human Rights Watch, said Thursday.

Many Nigerians believe the military responds only when Boko Haram fighters attack government facilities, not when they kill civilians, said Lauren Ploch, an Africa specialist at the Congressional Research Service.

Boko Haram, meanwhile, has built up an arsenal of weapons and a fleet of trucks stolen from police stations and military barracks.

Robert Jackson, a State Department specialist on Africa, told the Senate hearing Thursday that militants had killed more than 1,000 people this year in attacks on churches, mosques, schools and security outposts. The group drew little international attention until it vowed to sell the kidnapped girls as slaves.

Boko Haram initially styled itself after the Taliban in Afghanistan, claiming it wanted to create a strict Islamic state in Nigeria.

Boko Haram was added to the U.S. list of foreign terrorist organizations last year.

U.S. officials say some of its fighters received training and weapons from the group al-Qaida in the Islamic Maghreb, a North African offshoot of al-Qaida. French troops destroyed training camps in Mali early last year, however, defense officials said. Since then, outside financial and training support for Boko Haram has waned.

Partly as a result, Boko Haram intensified a kidnapping campaign that has generated large ransoms, said a U.S. counterterrorism official who spoke on condition of anonymity to discuss sensitive information.

U.S. officials say intelligence on Boko Haram is sketchy. They estimate that 300 trained fighters have joined the group. The total swells to about 3,000 if financial and other supporters are included.

AFP Screenshot

High-Ranking Egyptian Police Official Killed By Car Bomb

High-Ranking Egyptian Police Official Killed By Car Bomb

By Laura King, Los Angeles Times

CAIRO — In the latest strike by suspected militants against a senior Egyptian security official, a police brigadier general was killed by a bomb planted under his car on Wednesday, state media reported.

The attack in a western suburb of Cairo, again demonstrated extremists’ ability to target high-ranking officials, often by pinpointing the location of their homes or learning details of their daily routines so as to stage ambushes. Wednesday’s bomb went off as the general was setting out for work.

Two police conscripts were also hurt in the blast, officials said.

Egypt has been hit by a wave of attacks, most targeting police, soldiers or security installations, in the nearly 10 months since Islamist president Mohamed Morsi was toppled by the army following mass protests demanding his removal.

The military-backed interim government has engaged in a sweeping crackdown on supporters of Morsi, whose Muslim Brotherhood was designated a terrorist organization late last year.

The government is currently weighing two measures that would broaden the scope of existing terrorism laws — a move that has drawn criticism from human rights groups who say they could be used as a pretext to arrest political opponents. Egyptian authorities have already used a range of measures to suppress dissent, not only among Islamists but among some secular liberals as well.

Egypt is due to hold presidential elections a little over a month from now. Field Marshal Abdel Fattah Sisi, who led the coup against Morsi, is expected to win the he May 26-27 vote.

Although the United States expressed misgivings about the ousting of a democratically elected leader and the arrest or killing of thousands of his backers, the Obama administration is poised to resume at least some of the military aid that was suspended after Morsi was deposed.

The Pentagon said Tuesday that Egypt would receive 10 Apache helicopters, meant to be used in the fight against Islamist militants in the Sinai peninsula.

Image grab from Al-Masriya 

SEC Leaders Leaving To Coach Private Sector On Reforms

Two experienced Securities and Exchange Commission officials who helped oversee reforms resulting from the 2008 financial crisis announced today that they are leaving the SEC for private sector jobs. James Brigagliano–the former deputy director of the SEC’s trading and markets division–is leaving after 25 years at the SEC to work for the law firm Sidley Austin LLP. John H. Walsh–the former associate director and chief counsel in the office of compliance inspections and examinations—is quitting after 23 years to work for Sutherland, Asbill & Brennan LLP.

In their new roles, both men will help clients navigate the new financial reforms of the Dodd-Frank Act, which was created while they held leadership positions at the federal government’s top regulatory institution. Both men served as acting director of the SEC in 2009, when the Dodd-Frank Act was being written and debated.

“As the line between compliance and enforcement increasingly blurs, I look forward to using my extensive knowledge to help counsel clients on some of their most critical matters and help them navigate today’s new regulatory and compliance hurdles,” Walsh said in a statement.”

“I look forward to assisting clients in navigating the ever-changing regulatory landscape and joining former colleagues from the SEC,” Brigagliano said.”

The Dodd-Frank Act has widely been criticized as being toothless, and the news that former SEC leaders are now contributing to the efforts to work around it doesn’t figure to inspire confidence in the reforms. The fact that the line between compliance and enforcement is blurred, as Walsh puts it, is exactly the problem: regulatory reforms will be effective as long as the revolving door between lobbyists and the federal government continues to operate unchecked.

Brigagliano and Walsh’s decisions underscore this basic truth: if we are in the midst of class warfare, as many Republican officials like to claim, then it is clear which class is winning.