1.1 Million Fingerprints Stolen in Fed Govt Hack… Ex-NSA official: ‘Biggest counterintelligence threat in my lifetime’
How Much Damage Can the OPM Hackers Do With a Million Fingerprints?
The pilfering of 1.1 million fingerprints is “probably the biggest counterintelligence threat in my lifetime,” one former NSA official said.
July 14, 2015 The Office of Personnel Management announced last week that the personal data for 21.5 million people had been stolen. But for national security professionals and cybersecurity experts, the more troubling issue is the theft of 1.1 million fingerprints.
Much of their concern rests with the permanent nature of fingerprints and the uncertainty about just how the hackers intend to use them. Unlike a Social Security number, address, or password, fingerprints cannot be changed—once they are hacked, they’re hacked for good. And government officials have less understanding about what adversaries could do or want to do with fingerprints, a knowledge gap that undergirds just how frightening many view the mass lifting of them from OPM.
“It’s probably the biggest counterintelligence threat in my lifetime,” said Jim Penrose, former chief of the Operational Discovery Center at the National Security Agency and now an executive vice president at the cybersecurity company Darktrace. “There’s no situation we’ve had like this before, the compromise of our fingerprints. And it doesn’t have any easy remedy or fix in the world of intelligence.”
(RELATED: OPM Announces More Than 21 Million Affected by Second Data Breach)
Though the idea of hacked fingerprints conjures up troubling scenarios gleaned from Hollywood’s panoply of espionage capers, not much is currently known about those that OPM said were swiped in the data breach, which began last year and has been privately linked by officials to China. In fact, the agency said it didn’t even know yet specifically which personnel have had their prints compromised.
“We do not have that information at this time,” said Sam Schumach, an OPM spokesman, explaining that the agency is still assessing the breach and has not yet performed a “deep dive” into the data to assess whose fingerprints are now in the hands of hackers.
Questions also remain about what the ultimate goal of the OPM hackers is, and the administration so far continues to refuse to publicly blame China for the intrusion. Some have likened the breach to an enormous surveillance operation, one that Beijing conducted in order to build databases on the ins and out of the U.S. government and to potentially coerce, blackmail, or bribe officials into divulging closely guarded secrets.
Whatever the motives, the stolen fingerprints are viewed as a uniquely important and unprecedented data heist—one that could reap huge rewards for the hackers for decades to come.
http://www.nationaljournal.com/tech/opm-hack-fingerprints-china-20150714
