US Congressional review considers impact of federal database hack
July 30, 2015 Leave a comment
A United States Congressional review into last month’s cyber theft of millions of government personnel records has concluded that its impact will go far “beyond mere theft of classified information”. Up to 21 million individual files were stolen in June, when hackers broke into the computer system of the Office of Personnel Management (OPM). Part of OPM’s job is to handle applications for security clearances for all agencies of the US federal government. Consequently, the breach gave the unidentified hackers access to the names and sensitive personal records of millions of Americans —including intelligence officers— who have filed applications for security clearances.
So far, however, there is no concrete proof in the public domain that the hack was perpetrated by agents of a foreign government for the purpose of espionage. Although there are strong suspicions in favor of the espionage theory, there are still some who believe that the cyber theft could have been the financially motivated work of a sophisticated criminal ring. But a new report produced by the Congressional Research Service, which is the research wing of the US Congress, seems to be favoring the view that “the OPM data were taken for espionage rather than for criminal purposes”. The report was completed on July 17 and circulated on a restricted basis. But it was acquired by the Secrecy News blog of the Federation of American Scientists, which published it on Tuesday.
The 10-page document points out that strictly financial reasons, such as identity theft or credit card fraud, cannot be ruled out as possible motivations of the massive data breach. But it points out that the stolen data have yet to appear in so-called “darknet” websites that are used by the criminal underworld to buy and sell such information. This is highly unusual, particularly when one considers the massive size of the data theft, which involves millions of Americans’ credit card and Social Security numbers. Experts doubt, therefore, that the OPM data “will ever appear for sale in the online black market”. This inevitably leads to the conclusion that the breach falls “in the category of intelligence-gathering, rather than commercial espionage”, according to the report.
The above conclusion could have far-reaching consequences, says the report. One such possible consequence is that high-resolution fingerprints that were contained in the OPM database could be used to blow the covers of American case officers posing as diplomats, and even deep-cover intelligence operatives working secretly abroad. Furthermore, the hackers that are in possession of the stolen files could use them to create high-quality forged documents, or even publish them in efforts to cause embarrassment to American intelligence agencies.
► Author: Ian Allen | Date: 30 July 2015 | Permalink: https://intelnews.org/2015/07/30/01-1746/
United States intelligence officials expressed concerns about a federal database containing details of security-clearance applications in the years prior to a massive cyber hacking incident that led to the theft of millions of personnel records. Up to
The Israeli government rejected reports yesterday that its spy agencies were behind a virus found on the computers of three European hotels, which hosted American and other diplomats during secret negotiations on Iran’s nuclear program. Cybersecurity firm Kaspersky Lab said on Wednesday that it first discovered the malware, which it dubbed “Duqu 2.0”, in its own systems. The Moscow-based firm said the sophisticated and highly aggressive virus had been designed to spy on its internal research-related processes. Once they detected the malicious software in their own systems, Kaspersky technicians set out to map Duqu’s other targets. They 

















Pakistani spies fear up to 100 million citizen records may have been stolen
September 15, 2015 by Ian Allen 5 Comments
Established in 1998 as the National Database Organization, NADRA operates under Pakistan’s Ministry of the Interior. Its main mission is to register and fingerprint every Pakistani citizen and supply every adult in the country with a secure Computerized National Identity Card. This has proven to be a Herculean task in a country of 182 million, of whom just over half are over the age of 18. Consequently, the NADRA electronic database contains files on over 96 million Pakistanis, making it one of the world’s largest centralized databases.
But the ISI warned in a recently authored report that the NADRA database may have been compromised through the software that the agency uses to digitize and store fingerprints. According to the Pakistani newspaper Express Tribune, which published a summary of the ISI report on Monday, “the thumb-digitiser system [used by NADRA] was purchased from a French company of Israeli origin”. The report refers to the Automatic Finger Print Identification System, known as AFIS, which NADRA has been using since 2004. The software was purchased for close to $10 million from Segem (now called Morpho), a leading global vendor of identity software. The company is based in France, but the ISI report states that has connections with Israel, a country that Pakistan does not officially recognize and has no diplomatic relations with. Because of that, says the ISI report, the entire content of NADRA’s database may have been accessed by the Israeli Mossad, the United States Central Intelligence Agency, India’s Research and Analysis Wing, and other spy agencies seen as “hostile” by Islamabad.
Officials from NADRA refused to respond to the Express Tribune’s allegations, or to acknowledge that the ISI had indeed contacted the agency with concerns about the AFIS database. But a NADRA senior technical expert, who spoke anonymously to the paper, claimed that the ISI’s concerns were unfounded, since NADRA’s servers were not connected to the World Wide Web and were therefore impossible to access from the outside. Another NADRA official told the Express Tribune that Segem was the only international vendor of fingerprint recognition systems in 2004, when NADRA purchased the software product. Additionally, the Ministry of the Interior successfully sought ISI’s approval prior to purchasing the software. Last but not least, NADRA officials pointed out that the Pakistani Armed Forces are also using Segem software products.
► Author: Ian Allen | Date: 15 September 2015 | Permalink
Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with Automatic Finger Print Identification System, cybersecurity, fingerprinting, ISI, Morpho, National Data base and Registration Authority (Pakistan), Pakistan, Segem