Chinese Hack of U.S. Personnel Records and Potential Exploitation of Sensitive Clearance Data

The Chinese Puzzle | 237 at the Office of Personnel Management traced back to 2009. Even- tually, by 2015, according to U.S. estimates, the cyber attack had harvested over twenty million personnel files of past and present federal government employees. In addition, it reaped over fourteen million background checks of intelligence workers done by the Fed- eral Investigative Services. All intelligence workers with a sensitive compartmented informa- tion clearance, such as Snowden, were required to provide informa- tion on these forms about all their foreign acquaintances, including any non-U.S. officials whom the applicant knew or had had rela- tionships with in the past. They also had to list their foreign travel, family members, police encounters, mental health issues, and credit history. For good measure, Chinese hackers obtained the confiden- tial medical histories of government employees by hacking into the computers of Anthem and other giant health-care companies. If China’s intelligence services consolidated the fruits of these hack- ing attacks, it would have a searchable database of almost everyone working in the American defense and intelligence complex. From © this database, it could track individuals with high security clearances © vulnerable to being bribed, blackmailed, or tricked into cooperating. No one doubted that the Chinese would use their cyber capabilities to take advantage of opportunities presented in foreign computer systems. General Hayden said of the massive theft of intelligence person- nel records, “Those records are a legitimate foreign intelligence tar- get.” He added, “If I, as director of the NSA or CIA, would have had the opportunity to grab the equivalent in the Chinese system, I would not have thought twice.” If that opportunity did not arise for the NSA or the CIA during Hayden’s tenure, it might have been because no insider in the Chinese intelligence services provided U.S. intelligence with a road map to it. Cyber espionage was not the Chinese intelligence service’s only powerful resource in the intelligence war. To get both electronic intelligence and human intelligence about the United States, China also had a highly productive intelligence-sharing treaty with Russia. It was signed in 1992 after the Soviet Union was dissolved. Although the terms of this exchange remain secret, defectors from the Rus- | | Epst_9780451494566_2p_all_r.indd 237 ® 9/30/16 8:13AM | | HOUSE_OVERSIGHT_019725