This content was created by Robert Siciliano. This content was uploaded by Robert Siciliano. This is a YouTube interview clip titled "Federal Government Office of Personell Management Hacked @HotspotShield" (posted June 12, 2015). The excerpt is a recorded discussion between a host (Speaker A) and Robert Siciliano, an identity-theft expert, about the U.S. Office of Personnel Management data breach — covering the scale of stolen employee data, risks such as new-account fraud and security-clearance compromise, phishing as an attack vector, the timing and public disclosure of the breach, and potential geopolitical implications ahead of U.S.–China talks.
Chapters
—take you further on the topic of hacking. I spoke earlier with Robert Siciliano, an identity theft expert, and I asked him about the targets and the significance of the size of this attack.
It's the— one of the largest breaches of employee data in a government agency of its kind. We are aware that there have been other breaches that have occurred here in the U.S. that were the fault of actual U.S. federal government employees. Which in some cases totaled more data stolen or lost in some cases. But attacks from a foreign land targeting U.S.
employees, this is a big deal. Well, let's discuss some of the data involved here. It's not necessarily the kind where identities are stolen to run up or to use banking and credit cards, is it?
Well, when a Social Security number is part of the stolen data, That can result in what's called new account fraud, which is the most purest form of identity theft, when criminals open up new lines of credit under that victim's name, generally getting credit cards or loans and turning, obviously, that data into cash.
Well, there have been reports that maybe the target of this information was for information regarding security clearances. What do you make of that? And how can that be used, or will it be used?
Well, certainly, whenever data is compromised that involves sensitive information for employees that have certain security clearances, that can very well give access to anyone into databases and even into facilities. That is certainly alarming.
Were you surprised at all when you heard this news, that the U.S. federal government doesn't have more secure cyber protection on its systems, that something could happen?
So the U.S., like any major corporation, has actually a tremendous amount of security in place. They do generally a pretty good job of preventing these things from happening. However, it's important that we all understand that there's no such thing as 100% security. And the most vulnerable assets are actually the employees themselves. So you can have all kinds of security in place, but if you can send a phishing email to an employee who clicks a link and gives the criminal backdoor access via that link, that's generally the path of least resistance.
What do you make of all these accusations, the timing of this announcement? Why do you think the U.S. would make this announcement? This so public? There were also reports that this actually happened several weeks ago.
Often when governments or corporations are making the information stolen publicly available or to the press, it's because it might have been leaked. And when it's leaked, they want to get it out before the press does. But in some cases, if it involves, you know, meetings with a foreign government, They want to bring attention to it, basically to make those aware, those responsible, that the U.S. is paying attention and they won't tolerate it, and that, you know, that the government agencies will come after them as a result.
And indeed, this comes ahead of a major dialogue between the U.S. and China just next week. All right, Robert Siciliano, thank you so much for joining us.
