Questions About US Cyber Attack: Not Just Who, But Why

Molly McKitterick

The White House says it cannot say that China-based hackers carried out the massive cyber attack on the federal agency responsible for collecting background information on millions of government employees and issuing security clearances.

Spokesman Josh Earnest said Friday that he could not “get into any conclusions” about who or what country might be responsible while the government is investigating the matter. “We’re dealing with a persistent adversary and in some cases, the less they know about what we know about what they did, the better.”

But some officials and analysts believe China-based hackers, with possible links to the country’s government, are behind the attack that has targeted the personal information of as many as 4 million current and former federal government workers held by the government’s Office of Personnel Management [OPM].

Former FBI agent Brad Garrett is one: “The initial read that it is coming from the Chinese, the questions, is it state-sponsored.  It is a private entity?  Or are these just hackers?”

The Chinese government said this kind of speculation is jumping to conclusions. Chinese Foreign Ministry spokesman Hong Lei said Friday, it is irresponsible.

“We hope the U.S. can stop being constantly paranoid and making groundless accusations, but instead show more trust and cooperation in this field.”

Not Only Who, But Why

It would be somewhat uncommon for Chinese state-affiliated hackers to target the personal information of government employees, says Rob Pritchard, a cyber security specialist at the Royal United Services Institute.

"Typically, state-sponsored espionage has gone after technology and more traditional secrets - foreign policy decisions, things like that," Pritchard told VOA. "I think it's unusual for state-backed hackers to go after personnel details."

As the human resources office of the U.S. federal government, OPM might be seen as a high-value hacking target. Its computers store sensitive employee information such as social security numbers, payroll data, job descriptions, performance reviews and family information.

Such information could be of value either to criminals, who could sell the data for financial gain, or to state-sponsored hackers motivated by nationalistic concerns, says Pritchard.

Officials would not say what type of information was accessed or stolen. Nor was it clear if specific government employees were targeted, or if the hackers simply swept up large amounts of employee data for later use.

When asked about the speculation that the hackers may have been compiling a data base of Americans’ personal information, Earnest reiterated that the White House is viewing the attack as a threat to national security.

“We take this very seriously, and I think that’s why you’ve seen such a serious response from the federal government in reaction to it.”

OPM says it detected the security breach in April before it took what it calls an "aggressive effort" to implement tougher controls. It says the Federal Bureau of Investigation and Department of Homeland Security are investigating to determine the full extent of the damage.

OPM said it will notify all current and ex-federal employees whose information may have been compromised. The agency will offer those workers access to credit reports and monitoring, and identity theft recovery services at no cost.

US lawmakers react

The top Democrat on the House Intelligence Committee, California's Adam Schiff, said the OPM attack is most shocking "because Americans may expect that federal computer networks are maintained with state of the art defenses."

U.S. Senator Susan Collins, a Republican and a member of Senate Intelligence Committee, said the data breach amounted to a foreign power seeking information on U.S. employees who have security clearances for access to sensitive information.

Collins told ABC News from the information she has received, the attack was very sophisticated and bears the hallmark of either China, Russia or Iran. 

Cyber security specialist Pritchard said the attack "demonstrates that for all the money the government is spending on cyber security they're still not getting it right."

Other attacks

The OPM cyber attack may be the biggest, but is not the first time hackers gained access to federal government computer systems.

Unclassified computers at the White House and State Department have been hit. Some databases at OPM were struck by hackers nearly a year ago. And Twitter and YouTube accounts of the U.S. central military command were struck earlier this year.

The Internal Revenue Service, which is responsible for tax collection, said last month that hackers stole information on 100,000 U.S. taxpayers.

Cyber warriors have also attacked such commercial giants as the Sony Pictures movie studio, Target and Home Depot stores, the EBay on-line auction site and JP Morgan Chase bank.

Some of the attacks have been blamed on North Korea, Russia and China. Experts said China has shown a particular willingness to get its hands on U.S. industrial and trade secrets.