RUTHFULLY YOURS

Once again the U.S. government has failed to protect sensitive personal information, this time highly sensitive information on 4,000 Air Force officers. This information, contained in extensive 127-page individual security questionnaires known as SF-86 were found on a backup hard drive that was neither password protected or encrypted. In addition, extensive information on high-profile visitors to sites in Afghanistan was also on the same drive along with gigabytes of Outlook emails whose content has yet to be assessed.

This follows a number of other similar cases, the most notorious was the highly successful penetration of SF-86 files and other data held by the Office of Personnel Management (OPM) in June, 2015. In that case, 21.5 million American’s personal data was compromised, again involving the SF-86 security questionnaire. On top of that, 5.6 million fingerprints were also stolen. In applying for a security clearance, the government collects fingerprint data and photos.

Full disclosure: my personal data was also compromised in the OPM hack and I received an OPM letter and some worthless “free for a year” coverage of my personal data going forward.

Does the government have any responsibility to protect sensitive information?

Apparently, anyone who believes that the government has this responsibility is sadly misguided. Not only does the government not protect personal information, it hands it around to other agencies routinely and gives it to private contractors for “processing.”

Like your passport! You go to a passport office, fill out all the information, provide a birth certificate and all the requisite contact information, and you give the passport office photos, one of which will wind up embossed into your passport. Then the Passport Office sends all that (how, by mail?) to a private contractor to “process.” Who has access to it is anyone’s guess. The information is not classified and therefore is not formally protected in any manner.

The same holds true for your tax return, which you send in to the IRS. nowadays electronically. Maybe it is semi-encrypted when you electronically transmit the form, or your accountant does it for you, but when it arrives at the IRS it is stored as an ordinary file with no protection.

The SF-86 form is an especially pernicious example because it contains a vast amount of information, everything from every place you may have worked, who your friends and colleagues are, to your business involvements and who your family members and relatives may be. All of this provides hugely valuable information to potential adversaries who may be nation-states, but who also could be terrorist organizations.

Everyone is shocked, shocked by WikiLeaks’ latest exposé that the Central Intelligence Agency (CIA) has been exploiting software vulnerabilities in our digital and electronic devices. All those “shocked” should have known better by now.

After the publications of files stolen by former National Security Agency’s contractor, Edward Snowden, on U.S. military capabilities, operations, tactics, techniques and procedures, and surveillance details, President Obama announced, “Nobody is listening to your telephone calls.”

In the spring of 2016 — months before Hillary Clinton’s and John Podesta’s emails were published by WikiLeaks — the Pew Research Center survey showed that many Americans “do not trust modern institutions to protect their personal data — even as they frequently neglect cybersecurity best practices in their own personal lives.”

For well over a decade, cyber experts have been testifying in open and closed Congressional hearings on the escalation of hacking into United States government agencies and private industries, communication, websites, and email. All without exception issued warnings on the short-term damages and the long-term threat posed by such hacking to U.S. national security and interests, and the American people by Chinese, Iranian, Russian, and other cybersavvy intelligence agencies, criminal and terrorist organizations. All the while very few, if any, warned of the proliferation of ground-based jammers and their growing interference with GPS timing and locations services, or data corruption and insertion.

In 2010, then Former Under Secretary of Defense for Policy Jim Miller lamented, “The scale of compromise, including the loss of sensitive and unclassified data, is staggering. We’re talking about terabytes of data, equivalent to multiple libraries of Congress.” (The Library of Congress is the world’s largest library, archiving millions of books, photographs, maps, and recordings.)

Successive governments and the private sector have failed to secure our communications, exposing our personal and national secrets, costing untold economic damage to individuals, companies, and our national security.

While the Obama administration oversaw the accelerated pace of moving to wireless communications — leaving very few alternatives, if any, for a time when those will be unavailable due to attack or natural disaster — it has adopted a slow knee-jerk cybersecurity policy. In 2014, the Obama administration was tasked by Congress to develop cyber countermeasure policies. But in response to Sen. John McCain’s (R-AZ) question “Is it correct that these are policy-decisions that have not been made?” U.S. Cyber Command Commander Admiral Michael S. Rogers responded: “The way I would describe it is, we clearly still are focused more on” an “event-by-event” approach to cyber incidents.” He urged to “accelerate debate on how to balance security and privacy in the ever-changing digital realm.” Otherwise, Rogers warned, “an enemy could change and manipulate data — rather than enter a computer system and steal — that action would be a threat to national security.”