OPM breaches impacts 18mn records: sources say
The number of records hacked is apparently north of 18mn: this according to sources present at a briefing to senators by FBI Director James Comey. Furthermore the FBI apparently confirmed that the hackers were the same group that had breached KeyPoint Government Solutions, adding to the evidence of a state-sponsored Chinese hack. &nbsp;More importantly it appears that the OPM breach may have started before the Keypoint incident was discovered, suggesting that the hackers had been combing through the OPM datasets for a year. &nbsp;It is thought that the hackers had built themselves a backdoor and were armed with "high-level system administrator access to the system". Meanwhile yesterday on the Hill, OPM chief Katherine Archuleta was still reticent about giving out numbers,&nbsp;"I don't have a number for you on that".
OPM breach keeps getting bigger — Archuleta’s gauntlet run begins Presented by

With help from Tal Kopan, Joe Marks, Shaun Waterman, Puja Murgai and Adam Sneed

OPM DATA BREACH KEEPS GETTING BIGGER — Database breaches at the Office of Personnel Management effect an estimated 18 million Americans, including current, former and prospective federal employees, and perhaps their families and friends, reports CNN. That’s the largest number to date and more than four times the 4.2 million figure OPM and the Obama administration have acknowledged. The number comes from a briefing FBI Director James Comey recently gave to senators, CNN says.

U.S. officials also told CNN the OPM hackers are the same as those who last year breached KeyPoint Government Solutions, a federal background investigations contractor. That point won’t be lost on Oversight Committee Democrats, who’ve already vowed to focus at this week’s hearing on contractors as an attack vector. However, the OPM breach may have pre-dated the penetration into KeyPoint. http://cnn.it/1JeY9jz

Meanwhile, the same hackers that breached OPM may have also pierced the National Archives and Records Administration, reports NextGov. A NARA cybersecurity system spotted indicators of compromise on three agency desktops after DHS published threat indicators related to the OPM hack. NARA “found no evidence intruders obtained ‘administrative access,’ or took control, of systems, but files were found in places they did not belong,” an investigator said. Aliya Sternstein has the scoop: http://bit.ly/1CplRSs

ARCHULETA’S GAUNTLET RUN BEGINS — OPM Director Katherine Archuleta testifies this morning before the Senate Appropriations Subcommittee on Financial Services and General Government, her first appearance on Capitol Hill since she was grilled by House Oversight last week. She’ll have that dubious honor again Wednesday, and will be back in the Senate Thursday to appear before Homeland Security.

Alongside her this morning will be Michael Esser from the agency’s office of inspector general. Also on the witness list is Richard Spires, a former chief information officer of DHS and the Internal Revenue Service.

Spires has no direct knowledge of what happened at OPM, but he’s expected to discuss the root causes of federal susceptibility to data breaches. They include a lack of good information technology infrastructure and software management, auditing controls that force a focus onto individual systems despite the inter-connectedness of computer networks, and a slow and cumbersome federal acquisition process. The hearing: http://1.usa.gov/1LoaQco

SENATORS GET A CLASSIFIED BRIEFING: And later this afternoon, Senators will hear from administration officials about the breach in a classified setting. House lawmakers emerged unimpressed from their secret-level briefing last week, with House Oversight and Government Reform Committee Chairman Jason Chaffetz saying he didn’t learn much more in a closed-door session than they did in the public hearing he held.

MORE OPM OVERSIGHT HEARINGS LIKELY — Rep. Don Beyer, ranking member on the House Science, Space, and Technology Committee’s oversight panel wants to hold a hearing on the OPM breach. “We still don’t have answers to many simple questions which are critical to federal employees and our national security,” Beyer noted in a letter to Chairman Lamar Smith yesterday. Beyer said SS&T could play a constructive role in the discussion, noting the committee’s jurisdiction over the National Institute of Standards and Technology. The letter: http://politico.pro/1H8ecO1

HAPPY TUESDAY! Welcome to Morning Cybersecurity, where your host this week is Dave, someone who always appreciates unexpected insights into how things work. Take my advice, spend the next 24 minutes (really!) to listen to this deconstruction of the Beatles song “While My Guitar Gently Weeps.” You’ll never listen to the entire song in the same way after its many components are individually revealed: http://bit.ly/1JfypU8. Share your Internet discoveries with [email protected] or tweet me at @ daveperera. Follow @ POLITICOPro and @ MorningCybersec. Full team info is below.

NOW AVAILABLE: POLITICO PRO’S LEGISLATIVE TRACKER — This first-of-its kind tool, driven by the feedback of both the market and of our own POLITICO Pros, enables influencers to navigate the legislative process faster and easier. In addition to an intuitive user interface, the tool also includes a virtual whip count that compares Member voting histories, easy note sharing capabilities enabling internal and external stakeholder collaboration and instant bill analysis that will reduce time spent on manual research. To schedule your demo email us at [email protected].

OFFICIALS PLAN TO TALK OPM WITH CHINA IN BOTH TRACKS AT S&ED — The U.S. China Strategic and Economic Dialogue kicks off in earnest today and officials plan to raise the issue of Chinese hacking and the OPM breach in “in very direct terms ... both in the strategic track of the S&ED but also in the economic track,” a senior State Department official said in a Monday press call. The goal is “making sure we have clear communication with the Chinese on our concerns about cybersecurity … for both security and economic officials on the Chinese Government,” the official said, adding “we want to make sure that we’re getting through to both of those sides.” Here’s the transcript: http://1.usa.gov/1FxjD3w. And more on the dialogue from SFP: http://bit.ly/1e0Jzyy

China watchers say it would be smart to try to leverage the divergent priorities of different elements of Beijing’s byzantine governmental structure. But the OPM hack is a bad test case.

The State Department official also noted that U.S. and Chinese officials are meeting as part of a United Nations Group of Governmental Experts in New York this week where the U.S. is pressing for agreement on a slate of global norms in cyberspace, including nations refraining from intentionally hacking each other’s critical infrastructure and assisting with cybercrime investigations on each other’s territory. That dialogue, which is in its final stages this week, may temper U.S. interest in making waves over the OPM breach that — if it was aimed at gathering foreign intelligence — would not violate any of the norms the U.S. is pressing. Background: http://politico.pro/1Rr5w6G

** A message from BSA | The Software Alliance: With software, you are able to create, connect and collaborate like never before. Software is advancing our everyday lives in ways we used to only imagine. You can do amazing things with software. Learn more at withsoftware.org. **

2016 WATCH: RUBIO TALKS TOUGH ABOUT CHINA: Republican presidential candidate and Florida Sen. Marco Rubio wants the White House to use the S&ED to send a strong message to China about consequences for the OPM breach, according to a letter he sent President Barack Obama yesterday. That includes “immediately impos[ing] financial sanctions and pursu[ing] criminal charges against individual hackers implicated” in the attack and “instruct[ing] Treasury Secretary [Jack] Lew to convey to his counterpart … that as additional evidence comes to light the U.S. will consider imposing sanctions against any Chinese government agencies or commercial enterprise found to have been involved.” The letter: http://1.usa.gov/1CpF3j1

JEB HITS OBAMA ON CYBER — GOP presidential contender Jeb Bush took advantage of the OPM breach Monday to criticize Obama’s cyber efforts. “The president can issue an executive order or give a speech about cybersecurity, but without sustained leadership and determined implementation?—?including a concerted effort to work with the Congress?—?we will not adapt to meet the growing threats,” Bush wrote. He called on Obama to support cyber threat information sharing legislation and lambasted stonewalling Senate Democrats [MC full service: The White House put out supportive statements of administration policies on the House bills]. The post: http://bit.ly/1FwM8OP

HISTORICAL IRONY NOTE: Last year’s S&ED in Beijing, which convened in the wake of the U.S. indictment of five People’s Liberation Army officers for hacking U.S. companies, concluded the same day news broke of an earlier OPM hack, also linked to China. Here’s the flashback: http://politico.pro/1Cpo54q

DOJ PANS LEADS ACT IN HILL BRIEFING — The Justice Department has serious concerns with a Microsoft, Apple and Verizon-backed bill that would better protect foreigners’ data stored outside United States from the federal government’s reach, agency officials told congressional aides late last week. The LEADS Act, first introduced last year, would block American law enforcement from serving a domestic tech company with a warrant for foreign customers’ data if the data is stored abroad. Justice and Microsoft are locked in a legal battle over what current law allows, which has prompted congressional debate over whether to update the law.

Speaking to around 20 congressional staffers last week as part of a broader discussion on email privacy, Justice officials argued the bill complicates an already murky legal framework for accessing data across borders. Further, DOJ staffers criticized the bill’s mutual legal assistance treaty reforms, which are designed to modernize how foreign governments can get data from U.S. firms. Top House bill sponsor Tom Marino reacted this way: “It is no surprise that as our bill builds momentum with over 70 cosponsors and counting, that resistance will also begin to build.”

INSTAGRAM USERS IN NORTH KOREA GET BLACKLIST WARNING — Instagram users in North Korea are being denied access to their accounts and receiving alerts in English and Korean that the photo-sharing app has been blacklisted, the AP reports from Pyongyang. Both the mobile app and the website are warning users who attempt to log on through the North Korean carrier Koryolink. While the alerts in both languages are similar, the “notice in Korean says the site contains harmful content,” which the English warning doesn’t mention. The alerts have been appearing “on and off for at least five days,” and some mobile devices have been able to access the app. Koryolink’s tech support says “they were not aware of any changes in policy regarding Instagram.” More: http://apne.ws/1K7oBKK

REPORT WATCH:

— The manufacturing sector leads in density of software flaws and in remediation of found flaws, finds Veracode in its annual “State of Software Security report” due out today at 8 a.m. Look for it here: http://vera.cd/1NfS8ls

QUICK BYTES

— A computer hardware failure has prevented the State Department from issuing visas for two weeks now. New York Times: http://nyti.ms/1BxO6Dg

— Sunday’s hacker-instigated grounding of state-owned Polish LOT airplanes exposed an industry-wide vulnerability, warns Kim Zetter. Wired: http://wrd.cm/1TIDO9o

— In the Astro’s hack case, the FBI is finding that attribution to a particular computer doesn’t equal a case against a particular person. New York Times: http://bit.ly/1e0Jzyy

— Toshiba plans to commercialize quantum cryptography as early as 2020. Wall Street Journal: http://on.wsj.com/1CpIGFM

— Microsoft paid $125,000 for an Internet Explorer bug but hasn’t patched it. The Register: http://bit.ly/1Ha2Mv3

— Companies facing cyberattacks from nation-states need better legal protection, argues attorney Brian Finch. Wall Street Journal: http://on.wsj.com/1QMAHyk

— A researcher exploits bad server configuration to reveal the IP addresses of hidden websites. Motherboard: http://bit.ly/1dbvQnD

— History today: Seven hackers told a Capitol Hill panel in 1998 the Internet lacked security, notes the WaPo in the third of a multi-part series on the long history of Internet vulnerabilities. The Washington Post: http://wapo.st/1IvBoCf

— Check out your free proxies, to see if they really are free, advises The Register: http://bit.ly/1JfHa0x

— Israel’s establishment of a National Cyber Defense Authority threatens its citizens’ privacy. Al-Monitor: http://bit.ly/1TJtWfA

— The U.S. Navy signed up with Microsoft for specially extended support for Windows XP and other obsolete software. IDG via ComputerWorld: http://bit.ly/1FxOxbW

That’s all for today. Take George Harrison’s advice and avoid getting diverted or inverted today, if possible.

Stay in touch with the whole team: Tal Kopan ( [email protected] , @ TalKopan ; Joseph Marks ( [email protected] , @ Joseph_Marks_ ); David Perera ( [email protected] , @ daveperera ); and Shaun Waterman ( [email protected] , @ WatermanReports ).

** A message from BSA | The Software Alliance: With software, you are able to create, connect and collaborate like never before. Software is advancing our everyday lives in ways we used to only imagine. You can do amazing things with software. Learn more at withsoftware.org. **

Follow us on Twitter Heidi Vogt @HeidiVogt



Maggie Miller @magmill95



John Sakellariadis @johnnysaks130



Joseph Gedeon @JGedeon1