Foreign hackers seek a soft target at VA

gloved hands

The personal information of veterans is at risk from foreign hackers, who have succeeded in breaching VA's IT security in the past and continue to try. (Stock image)

At least eight foreign state-sponsored hackers may have compromised IT systems at the Veterans Affairs Department, putting the personal information and medical records of veterans at risk, according to the June 4 congressional testimony of former VA Chief Information Security Officer Jerry Davis.

Davis, who is now the CIO of NASA's Ames Research Center, painted a picture of a security environment in shambles at VA, the result of what he described as "15 continuous years of unattended and undocumented material weakness in IT security controls."

The attacks were possible, Davis said, because of inadequate technical controls, including lack of encryption, weak authentication and easily exploited web applications. Attacks from foreign cyber-espionage units "continue at VA to this very day," he said.

Members of the Oversight and Investigations panel of the House Veterans Affairs Committee blasted the VA's conduct and aggressively questioned acting CIO Stephen Warren about alleged mismanagement of IT security. "The entire veteran database in VA, containing personally identifiable information on roughly 20 million veterans, is not encrypted, and evidence suggests that it has repeatedly been compromised since 2010 by foreign actors, including in China and possibly in Russia," said Subcommittee Chairman Mike Coffman (R-Colo.)

Later this month, the VA's inspector general will release a report that includes 32 recommendations for improvements to security policy. Testifying at the hearing, Linda Halliday, the assistant inspector general for audits and evaluations, said that VA's systems are inconsistently managed. In March 2013, she said, her department found that the agency was "transmitting sensitive data including [personally identifiable information] and internal network routing information over an unencrypted telecommunications carrier network."

Network trespassers compromised the domain controller of the network, according to Michael Bowman, the director of IT and security audits for the inspector general's office. The intruders gained access to email, taking information from the senior leadership at VA. Perhaps most damning, Coffman said in his opening statement, is that VA leaders are aware that foreign hackers have compromised the network, but are not sure what was stolen because the intruders encrypted the data they took.

Against this backdrop, Warren offered context about the size and scale of IT at Veterans Affairs, with 400,000 users and 750,000 devices. However, committee Republicans pounded on Warren when he wouldn't specify the extent to which VA systems had been compromised by foreign intruders, where those intruders were based, and what data might have been stolen. Warren did offer to discuss such matters in more detail in a closed session of the subcommittee, citing the sensitivity of the information.

Warren was also called on the carpet for allegedly hounding Davis to sign authority to operate (ATO) certifications for more than 250 systems, before he was cleared to leave VA and take up his new post at NASA -- a conflict that FCW reported on May 1.

A memo from VA secretary Eric Shinseki assured the committee that "VA's security posture was never at risk" as a result of the extension of these ATO certifications. Warren, who ghost-wrote the memo on Shinseki's behalf, told lawmakers that the statement was accurate within the context of ATO certifications, but was not accurate with regard to the overall vulnerability of VA systems.

Republican members on the panel did not have much patience for such fine distinctions, frequently interrupting Warren's testimony with pointed yes-or-no questions and reminding him that his testimony was being given under penalty of perjury.

Stephen Warren testifying

VA acting CIO Stephen Warren testifies at a June 4 hearing.

Warren said that he has accepted the recommendations of the Inspector General's report, and is putting into place all of its recommendations. Based on prior internal and external evaluations, the VA in 2012 adopted a system called Continuous Readiness in Information Security Program (CRISP), and this will be fully phased in across VA networks by the end of 2013. Over the past year, the VA has trained 98 percent of staffers on information security, and the agency is only prevented from reaching 100 percent because of turnover in personnel, Warren said. He also cautioned against conflating risk with actual vulnerability.

"When a review takes place, the review is of what could happen. The existence of risk is not the same as removal of information out of the network," Warren said. While he could not guarantee that the VA systems or any computer system is 100 percent secure, he cautioned against panicking veterans about the vulnerability of their data.

"I believe we would be doing veterans a disservice by telling them there's a disproportionate risk. I would hate for this to drive folks away from taking advantage of the benefits they've earned and they need," Warren said.

About the Author

Adam Mazmanian is executive editor of FCW.

Before joining the editing team, Mazmanian was an FCW staff writer covering Congress, government-wide technology policy and the Department of Veterans Affairs. Prior to joining FCW, Mazmanian was technology correspondent for National Journal and served in a variety of editorial roles at B2B news service SmartBrief. Mazmanian has contributed reviews and articles to the Washington Post, the Washington City Paper, Newsday, New York Press, Architect Magazine and other publications.

Click here for previous articles by Mazmanian. Connect with him on Twitter at @thisismaz.

Cyber. Covered.

Government Cyber Insider tracks the technologies, policies, threats and emerging solutions that shape the cybersecurity landscape.


Reader comments

Tue, Aug 27, 2013

And guess what, Warren's still here... That's all you need to know about congress, Warren is still running VA's IT group.

Fri, Jun 14, 2013

@VAOITTruths.... After today, you could get your wish. If Mr. Warren suvives this it'll be amazing. For the sake of the veterans, let's hope not. at best he should be made a IRM Chief at a small hospital for an undetermined period of time.

Tue, Jun 11, 2013 VAOITTruths

Well, Mr. Warren and Mr. Lowe did themselves no favors in their weak, conflicting (possibly purgurous) and awkward testimony. I, for one, certainly hope that this puts to rest any ideas in the minds of our leadership that Mr. Warren should replace Mr. Baker as the CIO. Furthermore, one hopes that Mr. Warren will be taken out of if his position as PDAS since that position is really the defacto CIO position. Neither should he be placed in charge of Service Delivery and Engineering (the largest portion of VA OIT). He has already positioned himself to do so as a fallback and has yet to fill that vacant position (probably waiting to see what happens to the VA CIO position).

Sun, Jun 9, 2013

LOL, at the IPv6 comment; that's just brilliant. IPv6, the great saviour.

Sun, Jun 9, 2013

Somehow I suspect this will result in the VA having more ISOs (who do nothing but tell others they need to do something (else), but could neither do it themselves nor can explain what they've just asked for in detail) than IT staff. Don't confuse ISOs with being IT, they're anything but an IT professional. The other things that might be missed in this because it's just too obvious, is that VA's IT department needs a lot more money to accomplish the gold standard and an accompanying culture change in its non-IT employees (good luck!). VA needs a budget that allows for every cool security toy to be implemented, the security folks what them all, and the people who are subject to the challenges those toys introduce, to embrace those difficulties. So THE SECRETARY needs to make sure that every time a Doctor's life is made harder in the name of security, they don't complain but instead they rejoice at the added levels of security their patient's information enjoys. He might want to start with shock collars... Might I opine that the Secretary, the head of IT, and the heads of the other parts of the agency, visit no less than 15 high-security facilities of other agencies around the nation and see what the gold standard really is; then mastermind a plan how to implement those best practices into each VA facility around the nation. See, it's simple... Don't forget, every ounce of computing convenience introduces ten pounds of computing risk. You betcha....

Show All Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group