System breach draws attention in Congress

Congress may be in recess, but lawmakers are paying attention to the latest government cybersecurity breach, this one in an Air Force online personnel system.Senate and House officials are keeping a close eye on how the service handles the concerns of more than 33,000 airmen, mostly officers, whose personnel records were accessed by an unauthorized user in May and June.Sen. Bill Nelson (D-Fla.), who serves on both the Armed Services and the Commerce, Science and Transportation committees'and is the minority lead co-sponsor of S. 1408, the Identity Theft Protection Act'has been 'pretty aggressive in [his] oversight whenever something like this happens,' said his spokesman, Bryan Gulley. 'We're going to continue to monitor the situation and ... check back with the Air Force to make sure that none of the personnel had their identities stolen.'Acting Air Force secretary Pete Geren sent Nelson a letter Aug. 18 advising him of the security breach and outlining measures to remedy the lapse and protect airmen.Geren said the service notified the Army, Navy and Marine Corps so they could audit their systems for vulnerabilities and check for similar intrusions, but nothing turned up.Also on Aug. 18, the Air Force began notifying affected personnel by letter and e-mail.Rep. Tom Davis (R-Va.), chairman of the House Government Reform Committee, found the news 'distressing,' said committee spokesman David Marin.'On the one hand, they're obviously not unique in terms of vulnerability; this type of information is getting hacked into all over the place,' Marin said. 'But on the other, we have a duty to do all we can to make sure these employees' personal information is as protected as it possibly can be.'He said Davis is asking for a briefing on the matter. 'We're reaching out to Air Force officials this week to ask a very simple question: What have you done, and what will you now do, to make sure your data is protected?' Marin said.There have been a number of highly publicized security failures involving personal and financial information over the past few months, several affecting government employees. In February, for instance, Bank of America lost personal data, including social security numbers, for 1.2 million federal credit card holders.Ari Schwartz, associate director of the Center for Democracy and Technology, a Washington think tank specializing in free speech and privacy issues, called the Air Force incident 'a serious breach.'Concerns over whether the federal government takes cybersecurity seriously enough are justified by this type of attack, he said.Air Force officers 'are at higher risk because the military has so much more information about them,' Schwartz said. 'That's part of the agreement in serving the country. That means the military has to watch over the data very carefully, but there are a lot of new threats out there.'In the meantime, the investigation is continuing into who was responsible for the incursion into the online Assignment Management System (AMS).Capt. Regen Wilson, spokesman for the Air Force Office of Special Investigations, said between mid-May and mid-June an individual or individuals viewed personnel records of approximately 33,300 airmen, only a handful of them noncommissioned officers.Air Force Personnel Center officials at Randolph Air Force Base in Texas alerted investigators in June to unusually high activity on a single user's AMS account. The incident was not a hacker exploiting a flaw to break into the system, said AFPC spokeswoman Lt. Col. Michele DeWerth, but a malicious user who managed to acquire a legitimate user ID and password.AMS is an online program used for assignment preferences and career management. It contains career information on officers and enlisted personnel, as well as some personal information such as birthdates and Social Security numbers. It does not contain personal addresses, phone numbers or specific information on dependents.Once the breach was identified, the special investigations office started looking into the matter, and the personnel center closed access to the online service to conduct a security review. AMS now is back online, DeWerth said, with unspecified security improvements now in place.The service delayed contacting airmen until the investigation was well under way.'We notified airmen as quickly as we could while still following criminal investigation procedures,' said Maj. Gen. Tony Przybyslawski, commander of AFPC, in a written statement. 'We notified the individuals involved, outlining what happened and how they can best insulate themselves from this potential risk.'Przybyslawski said no incidents of identity theft have been linked to the breach, but he urged officers to take precautions to guard against misuse of their information.OSI's Wilson said the Air Force is vigorously pursuing the perpetrator.'It's OSI's mission to protect the Air Force and all of its assets, and to look out for its interests,' he said. 'With something like this, a system of this importance that has been compromised, it's the epitome of the kind of case that we're going to pursue to the ends of the Earth."