GovernmentExecutive.com

The Energy Department disclosed to Congress on Friday that it suffered a security breach from a hacker in September that compromised 1,500 personnel records.

The news broke just as a House Energy and Commerce Oversight and Investigations Subcommittee was supposed to start a hearing on how secure Energy Department computers are in light of recently reported data breaches at the Internal Revenue Service and Veterans Affairs Department.

Kentucky Republican Ed Whitfield, chairman of the Subcommittee, said there is no excuse for the department to have its current "F" in cyber-security compliance -- or for waiting eight months to tell the Energy secretary or his committee about the security breach.

"It's unbelievable [that] 1,500 personnel files can be compromised with Social Security numbers," Whitfield said. "The impact that can have on individuals is quite disturbing."

Full Energy and Commerce Committee Chairman Joe Barton, R-Texas, visited the hearing room to express his outrage at the data breach and later called Energy Secretary Samuel Bodman. "If the administration won't do something about this incident, this committee will," he said.

While most of the details of the hacking incident were discussed later in executive session, a government agency that tests the department by breaking into its computer system said the attack was at the National Nuclear Security Administration.

NNSA Administrator Linton Brooks said he learned of the "sophisticated" hacking incident in September. He said he did not know whose job it was to tell Bodman, but he wished he had.

"Mr. Brooks, I'm going to recommend you be removed from office, and I think you would do the country a service if you resigned," Barton said. Brooks said that because the breach was labeled a counterintelligence issue, the two sides of the organization each assumed the other had notified the secretary. Barton called that explanation "hogwash."

Energy Chief Information Officer Thomas Pyke said he was aware of various hacking incidents but only learned of the personnel data involved two days ago.

Pyke said the department faces hundreds of thousands of attacks each day. In the event where the records were exposed, he said the attack penetrated both a firewall and a detection system.

Glenn Podonsky, director of the office of security and safety performance assessment, told lawmakers that in November, his team successfully accessed Energy's unclassified computer system. He said they gained access to financial and personal data, and could have impersonated or monitored department executives.

"We basically had domain control," Podonsky said. He said with security improvements made since then that the office could break in but not gain domain control.

He said his office believes Energy is moving too slowly in making security improvements and noted that part of the problem is because of work done by outside contractors.

Whitfield also wanted to know why the Energy Department has failed to report 50 percent of attacks to its computer systems. Podonsky said he agreed they should be reported to help law enforcers track them.

COMMENTS

• I guess rds and the wise old owl never use credit cards. Because they do not use the cards they should have no fears if they have no cards. However, those who do have credit cards subject themselves to identity theft every time they use the card! In D.C. (and other places over time) waiter in restaurants stole the card numbers, expiration dates, security codes and names from credit card users every time a meal was charged. This is better identity theft than getting data from databases because you have everything immediately and can charge on line or elsewhere immediately. There is no safety in data security if you give your card to the most incompetent in society every day. We build our economy on trust and that trust is wearing thin. People steal about $35 billion in shoplifting each year that all of us pay for in higher prices. Credit card misuse is rampant and again we all pay for it in higher prices and card fees that are passed on to consumers. We are between a rock and a hard place because our economy runs on credit and credit cards are a large part of that payment mechanism. The cost of that credit is billions each year that we all pay in higher prices. Thou shall not steal is becoming obsolete! Taxpayer Posted June 20, 2006 7:55 AM
• There seems to be a pattern developing here. Government agencies are not securing the public’s information and when the information is lost the government fails to report it. After working on how they will spin the story they tell someone what happened. Now your information is stolen and the government spin machine is in full cycle. The bottom line is always the same, the government is not responsible and everything will be fine. How about the ole Bush doctrine: Just go shopping and don't worry about it. rds Posted June 12, 2006 11:26 AM
• Stuff like this comes from the culture. SSN's are used too much by government and the private sector. A cheap and easy substitute for employee ID and customer account numbers. The federal offices put them on everything, even partially on mailed pay stubs. I see no quick fix. Hollering and shouting will not help. GovExec.com reader Posted June 12, 2006 8:24 AM