China hackers target data on U.S. workers

Thursday, July 10, 2014

WASHINGTON -- Chinese hackers in March broke into the computer networks of the U.S. government agency that houses the personal information of all federal employees, apparently targeting files on tens of thousands of employees who have applied for top-secret security clearances, senior U.S. officials said.

The hackers gained access to some of the databases of the Office of Personnel Management before the federal authorities detected the threat and blocked them from the network, the officials said. It is not yet clear how far the hackers penetrated the agency's systems, in which applicants for security clearances list their foreign contacts, previous jobs and personal information, like past drug use.

In response to questions about the matter, a senior Department of Homeland Security official confirmed that the attack had occurred but said that, "at this time," neither the personnel agency nor Homeland Security had "identified any loss of personally identifiable information."

The official said an emergency response team had been assigned "to assess and mitigate any risks identified."

One senior U.S. official said the attack was traced to China, although it was not clear if the hackers were part of the government. Senior U.S. officials, led by Secretary of State John Kerry, are in Beijing this week for the annual Strategic and Economic Dialogue, the leading forum for discussion between the United States and China on their commercial relationships and their efforts to work together on economic and defense issues.

Computer intrusions have been a major source of discussion and disagreement between the countries, and the Chinese can point to evidence, revealed by Edward Snowden, that the National Security Agency went deep into the computer systems of Huawei, a major maker of computer network equipment, and ran many programs to intercept the conversations of Chinese leaders and the military.

U.S. officials said the attack on the Office of Personnel Management was notable because hackers try to breach U.S. government servers nearly every day, but they rarely succeed.

One of the last attacks the government acknowledged occurred last year at the Department of Energy. In that case, hackers made off with employees' and contractors' personal data. The agency was forced to reveal the attack because state disclosure laws force entities to report breaches in cases where personally identifiable information is compromised.

Government agencies do not have to disclose breaches in which sensitive government secrets but no personally identifiable information has been stolen.

Just a month ago, the Justice Department indicted a group of Chinese hackers who work for the People's Liberation Army Unit 61398 and charged them with stealing corporate secrets. The same unit, and others linked to the Chinese military, have been accused in the past of intrusions into U.S. government computer systems, including in the office of the secretary of defense.

But private security researchers said the indictments have hardly deterred the Chinese military from hacking foreign targets, and U.S. officials are increasingly concerned that they have failed in their effort to deter computer attacks from China or elsewhere.

The indictments have been criticized as long on symbolism and short on real punishment: There is very little chance that the Chinese military members would ever see the inside of an U.S. courtroom, even if the FBI has put their pictures on wanted posters.

"There's no price to pay for the Chinese," one senior intelligence official said recently, "and nothing will change until that changes."

Information for this article was contributed by Richard A. Oppel Jr. of The New York Times.

A Section on 07/10/2014