Contractor Faulted in DHS Data Breaches
233402
The FBI is investigating a major information technology firm with a $1.7 billion Department of Homeland Security contract after it allegedly failed to detect cyber break-ins traced to a Chinese-language Web site and then tried to cover up its deficiencies, according to congressional investigators.
224580
(InfoWorld) - IT systems integrator Unisys Corp. is under fire for allegedly failing to detect the hacking of U.S. Department of Homeland Security computers, an incident that resulted in data being sent to a Chinese-language Web site. Unisys is now under investigation by the U.S. Federal Bureau of Investigation, according to an aide for the House of Representatives' Committee on Homeland Security, which started investigating the DHS and Unisys in April. The committee sent a letter to the DHS on Friday asking for its inspector general to open an investigation, the aide said. The letter said DHS had 844 "cybersecurity incidents" during fiscal 2005 and 2006, which the committee called "high and unacceptable." The data breach adds to the growing chorus of complaints from countries such as France, Germany and the U.K. thatÂ hackers in China have stepped up their game, hunting for sensitive information on government computer systems. In 2002, Unisys won a US$1 billion contract to manage computer systems belonging to the DHS and the Transportation Security Administration, which were created after the Sept. 11, 2001, terrorist attacks to shore up the nation's defense. Unisys received a $750 million contract in early 2006 to continue the work. Under the contracts, Unisys installed six intrusion-protection devices, said Lisa Meyer, Unisys spokeswoman. Those devices, which can detect unauthorized activity on a network, were not installed properly, alleges the committee. Three months passed before clues emerged that malicious software capable of copying and transferring files had been installed on 150 DHS computers. The data, although unclassified, was transferred late at night or early in the morning to a Chinese-language Web site, according to committee evidence and testimony. Two U.S. representatives also accused the DHS and Unisys of ignoring warning signs of the hacking. In a statement , Unisys denied the intrusion protection devices were improperly installed and that the company reported security incidents. Meyer said Unisys has not been notified by either the FBI or the committee of an investigation. She said she could not comment further on specific security incidents. The FBI referred questions to DHS officials, who could not immediately be reached. Â
649408
The mutual fund information provider receives a Wells Notice over incorrect data.
748665
Online portal says bugs could have let attackers alter appearance of pages and access a victim's data.
348378
In February 2005, an auditor at the General Services Administration presented evidence to agency leaders that one of the government's top technology contractors was overcharging taxpayers.
576139
eTrust Antivirus mistook a critical security process for malware.
597364
U.S. officials are investigating the deaths of two American contractors who were ambushed last month in Iraq after one of them told government officials he was concerned about his financial dealings with the Iraqi Ministry of Defense.
96421
We advise skepticism The Department of Homeland Security (DHS) is ditching a controversial data-mining program, the Associated Press revealed today.â¦
595977
Pentagon contractor SAIC Inc. may have compromised personal information about more than half a million military personnel and their relatives because it did not encrypt data transmitted online.
637030
(InfoWorld) - The U.S. Department of Homeland Security's (DHS)Â CIO was on the hot seat Wednesday on Capitol Hill after an independent audit found that a database that screens U.S. visitors lacked security controls. The chairman of the U.S. House of Representatives Homeland Security Committee called on DHS CIO Scott Charbo to explain why he should keep his job after persistent cybersecurity problems at the agency. "What happened to leadership?" Representative Bennie Thompson, the committee chairman and a Mississippi Democrat, said during a hearing of the Subcommittee on Emerging Threats, Cybersecurity, and Science, and Technology. "What happened to accountability?" Lawmakers also said they were concerned that the agency reported 844 cybersecurity incidents in 2005 and 2006. "Although we still have a ways to go, we've made measurable improvements in the management of information security at the department," Charbo said. "Certainly, we need to increase our vigilance to ensure that such incidents do not happen again." Many of the 844 incidents were minor, and the agency has taken major steps to fix past cybersecurity issues, Charbo said. Many of the reported cybersecurity incidents related to problems like lost laptops that did not result in data breaches, he added. The subcommittee did not have a breakdown of the incidents Wednesday. Asked about reports of bots installed on DHS computers that could send information out to hackers, Charbo said he had "no evidence" that the bots caused a breach. Thompson's comments came as the U.S. Government Accountability Office (GAO) issued a report saying DHS continues to have "significant weaknesses in computer security controls that threaten the confidentiality, integrity, and availability of key ... systems." GAO investigators found no security controls on the US-VISIT database, the system that screens people who want to visit the U.S. for potential terrorists and criminals. Lawmakers are concerned whether terrorists could get into the database "and change or alter their names to allow them access to this country, and we wouldn't even know that they're doing it," said Representative Bob Etheridge, a North Carolina Democrat. A contractor provides IT security for US-VISIT, but DHS has its own security controls in place to protect the database, Charbo said. He didn't disclose specific security measures. The GAO doesn't have evidence that the US-VISIT database was breached, said Keith Rhodes, chief technologist and director of the GAO's Center for Technology and Engineering. "I did not see controls in place that would prevent it," Rhodes said. "I did not see defensive perimeters, and I did not see detection systems in place whether it had or had not [been breached]." GAO started a cybersecurity review of DHS a year ago but curtailed its efforts because it kept finding "more and more" problems, Rhodes said. "If we had continued to this day, I would argue we'd still be finding things," he said. "The problems were pervasive. The problems were systemic." Charbo outlined recent measures DHS has taken to improve cybersecurity there. The agency is collapsing multiple legacy WANs into a single WAN, and it is standardizing all e-mail and directory services onto a single platform, he said. The agency had 13 separate e-mail systems when it was formed out of 22 U.S. agencies in 2002, he said. DHS also is combining multiple data centers into a shared center, he said. Thompson asked how DHS officials can preach cybersecurity practices to other agencies and private companies while continuing to have its own problems. Among the incidents DHS reported were employees sending out classified documents on unclassified networks and contractors attaching unauthorized laptops to the DHS network, he said. "How can the Department of Homeland Security be a real advocate of sound cybersecurity practices without following some of its own advice?" he said. "What the department is doing on its own network speaks so loud that the message isn't getting across to anyone else."
509482
Houston: After HR, Finance and Accounting and supply chain Management, large corporations and government agencies are turning to outside contractors for security.
316888
A slain American contractor feared for his life after turning whistleblower
46168
House committee demands answers from the agency after investigators turn up dozens of intrusions last year with ties to Chinese Web servers; IT contractor says it wasn't at fault.
336917
A wide-area network operated by an unnamed contractor has dozens of weaknesses that threaten data used in the government's Medicare and Medicaid programs, according to a report released Tuesday by the GAO.
7000
(InfoWorld) - A stolen laptop at The Boeing Co. has pushed a widely watched tally of U.S. data breach victims past the 100 million mark. On Tuesday, Boeing disclosed that files containing Social Security numbers, names and home addresses of 382,000 current and former employees were compromised in early December when an unencrypted laptop was stolen from an employee's car. That disclosure pushed the total number of data breach victims on the Privacy Rights Clearinghouse Web site to 100,152,801, said Beth Givens, director of the consumer advocacy group. Privacy Rights Clearinghouse has been tracking data breaches since February 2005, whenÂ ChoicePoint disclosedÂ that thieves had stolen information on 163,000 victims from the company's database. The ChoicePoint incident was remarkable because although the data broker was obligated to disclose the theft to victims living in California -- the only state with a beach notification law on the books -- it decided to notify everyone, Givens said. "That was the first time, to the best of our knowledge, that a breached entity decided to disclose the event to individuals nationwide," she said. "That was a watershed event," she added, "because other entities that had experienced breaches started disclosing the situation to individuals nationwide" Since the ChoicePoint incident, data security has been in the spotlight, andÂ breaches at the U.S. Department of Veteran's AffairsÂ and, most recently, Boeing and theÂ University of California-Los Angeles, have received national attention. Givens believes that the actual number of names that have been compromised since ChoicePoint is probably much higher than her tally. "I think the number 100 million is largely a fictional number, but what it really indicates is that this is a very significant problem," she said. She couldn't say whether all the publicity has made consumers any more secure. "It's quite obvious from the listing that we've compiled that we're in a very leaky boat when it comes to data security," she said. "I don't think that consumers can feel confident about the protection that their personal information receives."
210711
Human error led to a January security breach at the Los Alamos National Laboratories that may have exposed nuclear secrets, according to a letter from Energy Secretary Samuel Bodman to Rep. John Dingell.
279618
A state government intern in Ohio last week lost a backup device that contained personal data on more than 64,000 state workers and tens of thousands of other people.