The OPM Breach Gave a Rival Government the Files on Millions of Americans

Let me tell you how the biggest counterintelligence loss in modern American history got reported. It got reported as a computer problem. The coverage had the tone of a story about a clumsy software update: passwords, patches, a hotline for credit monitoring. Meanwhile a foreign government had walked out the door with the most intimate paperwork the United States keeps about the people it trusts with its secrets. If a burglar took the files from the CIA's front office, you would call it a spy case. When it was the Office of Personnel Management, we called it an "incident."

I want to tell the story in order, because the order is the argument. And then I want to say what it teaches, because the lesson is not really about computers. It is about a government that collects everything and protects almost nothing.

What the Office of Personnel Management is, and why it holds the keys

Most Americans have never heard of OPM, and that is the first part of the problem. It is the federal government's human-resources department. It handles retirement, health-benefit programs and hiring rules for the civilian workforce. It also ran, in those years, the background investigations that decide who gets a security clearance. Anyone who has applied for a position of trust, whether a soldier, a diplomat, an intelligence analyst, a contractor, or a clerk who needs access to a sensitive building, has passed through that process.

The centerpiece is a form called the SF-86, the Questionnaire for National Security Positions. It is long, and it is exhaustive on purpose. It asks about your addresses over the last several years, your employers, your relatives, your foreign contacts, your finances, your arrests, your drug use, and in some cases your mental-health counseling. It asks for names of references who know you. Investigators then interview neighbors, coworkers and friends, and those interviews go into the file too.

Think about what that adds up to. The government asked a person to confess every vulnerability a blackmailer could use, and promised to keep the confession safe. That is the bargain. If you want to serve in a sensitive job, you hand over your weaknesses to the government, on the understanding that the government is the one party that will never use them against you.

The story in order

2014. Intruders got into OPM's systems. Federal authorities learned of a first intrusion in March 2014, and in May of that year attackers got in by posing as an employee of a contractor that handled background investigations. It was the first sign of a larger problem.

April 2015. OPM discovered that its systems had been compromised again. In early June 2015 the agency announced that the personnel records of about 4.2 million current and former federal employees had been taken.

July 9, 2015. OPM disclosed the real number: a separate intrusion had taken background-investigation records. The agency put the figure at about 21.5 million people. Not all of them were applicants. The total included the spouses, partners and co-habitants whom applicants listed, because the form asks about them too. The stolen material included Social Security numbers, residence, employment, family, financial and criminal history, and the findings of investigators' interviews. In September 2015 OPM raised the number of people whose fingerprints were taken to about 5.6 million, up from an earlier estimate of 1.1 million.

July 10, 2015. OPM Director Katherine Archuleta resigned, the day after the larger number came out.

September 2016. The House Committee on Oversight and Government Reform, then chaired by Jason Chaffetz, issued a report on the breach. Its title said what its authors thought: the government had "jeopardized our national security for more than a generation." The committee found that OPM had been warned about its weaknesses, and that it had failed to adopt basic safeguards that its own inspector general had urged for years.

That is the sequence. Two intrusions, one agency, tens of millions of people, and an official resignation. No one went to jail in an American courtroom, because the people who did it were not in an American courtroom's reach.

Who did it

Here I want to be careful, because the case against the guilty party is about attribution, and attribution is a judgment, not a verdict. American officials publicly pointed to China. Director of National Intelligence James Clapper said in 2015 that China was the leading suspect, and other officials and later reports pointed the same way. The Chinese government denied involvement, and said hackers inside China were themselves victims of a larger problem of cybercrime. I do not need to settle every detail of that dispute to make the argument in this post. Whatever hand did it, a rival government's intelligence service is the only plausible consumer of this particular data. A criminal ring can sell credit-card numbers on a forum. It has no use for a list of everyone cleared to see American secrets and the sins that might make them pliable.

Now let me say what the thief gets from a trove like this, and let me be exact about it. He gets a map of the American national security apparatus: who works where, who has access to what, who has foreign relatives that could be leveraged, who owes money, who has an old arrest, who once saw a counselor. He can pick the people most open to pressure. He can identify undercover personnel by looking for the people whose records are missing. He can match fingerprints against the prints left at a crime scene or a safe house, which matters to anyone who works under cover. He can spot the relative abroad whose safety might buy a favor.

And remember: the data does not expire the way a credit card does. You can cancel a card. You cannot cancel your childhood address, your fingerprints, or your brother's name. The files of people who got clearances in the 1990s were taken in 2015, and the harm of that theft runs through their working lives and arguably beyond them.

The part that should make you angry

Here is what nobody in the room wants to say out loud: this was not a surprise. The failure was known, repeated and documented.

OPM's inspector general had issued audits for years that flagged weaknesses in the agency's information-security program. In November 2014 the inspector general's annual security audit reported that a number of OPM's major systems were running without a valid security authorization, and recommended that the director consider shutting down those in violation. The House Oversight report, in 2016, laid out a pattern: known vulnerabilities, deferred fixes, systems that could not be fully monitored, and an agency whose leadership did not treat security as a mission-critical priority.

Do you see the shape? The government collected more intimate data than it had ever collected, concentrated it in one place, and then guarded it like a county records office. If a private firm had done this, there would be fines, lawsuits and a congressional hearing starring the chief executive. When the government does it, the outcome is a year of free credit monitoring for the victims, a sheet of paper that tells them how to place a fraud alert. Credit monitoring for a spy's target. That is like handing a man a smoke detector after his house has been moved to the other side of the street.

I will go one step further than the usual commentary. Suppose a state were designing a perfect target: it would build a single database with every person who holds sensitive access, add their financial weaknesses, their foreign contacts, their fingerprints, and put the whole thing behind a system that its own auditors called deficient. Then it would publish the name of the agency. The OPM did that by accident. The only thing missing from the plan was a bow.

The constitutional anchor: what a government may gather, and what it owes

Conservatives have argued for generations that a government's power to collect is dangerous in itself. The Fourth Amendment says "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated." That text restrains searches. It does not address the question of what happens when a government lawfully collects your papers and then loses them.

But the principle underneath it applies, and it is the principle Madison put at the center of the whole American design. In Federalist No. 51 he wrote that in framing a government to be administered by men over men, "you must first enable the government to control the governed; and in the next place oblige it to control itself." The OPM breach is a failure of that second duty. The government demanded the confessions. It did not control itself to the point of protecting them.

The argument I am making is not that background checks are wrong. Clearances exist for good reasons, and no one wants an unvetted stranger handling secrets. The argument is that every power to collect carries a duty to guard, and that a government that cannot guard what it holds should hold less. Narrower collection, shorter retention, separate databases and stronger controls are not luxuries. They are the price of the power.

Four numbered lessons

One. Concentration is a vulnerability. A single database of everyone with a clearance is a single target. The government should split records by agency and by sensitivity, and should keep the most sensitive material in systems that are not connected to the internet. A thief with one key should not own the whole building.

Two. Accountability must have a name on it. In the private sector, a chief executive answers for a breach this size. In government, the Director resigned, the program went on, and the bureaucracy that had ignored years of warnings went on largely intact. A rule that says the official responsible for a system must be the one who signs its security certification, and answers for it, would change behavior faster than any new technology. See The Pentagon Has Never Passed an Audit, and Conservatives Should Mind for how the same culture shows up in the Defense Department's books.

Three. Treat theft of personnel files as the act of a hostile state, not a nuisance. The response to a rival's intelligence service stealing the files of the cleared workforce cannot be a press conference. It has to be a policy, with costs that the thief can see. The earlier post on Cyberwar Has No Declaration, So When Is a Hack an Act of War explains why we have trouble saying out loud where that line is. Espionage is old, and states will always do it, but the answer to espionage is counterintelligence, and counterintelligence is only as good as the secrecy of the people running it.

Four. Judge the thief's government by its conduct. The Chinese state's collection of American data was one chapter in a larger pattern that conservatives have long warned about, from stolen industrial secrets to pressure on every firm that wants to do business there. Our answer should be consistent. See The Thucydides Trap Is a Bad Excuse for Giving Ground to Beijing for why excuses for giving ground are weak, and CoCom Kept Western Technology from Moscow for Forty Years, a Model for China for the history of keeping sensitive technology out of rival hands.

The best defense of the government, answered

Fairness requires me to state the other side, and the best of it is this: no system is perfectly secure, and the most skilled state intelligence services can breach nearly anything. It is true, and nobody should demand perfection. Banks, retailers and even intelligence agencies have been breached.

But that argument proves less than it seems. The question is not whether a determined adversary can get in. It is whether the agency did the ordinary things that make it hard. The oversight record said that, on the key controls, it had not. Failing to stop a world-class burglar is forgivable. Leaving the door unlocked after the locksmith has warned you for years is not. A government that asks Americans to trust it with their most private histories should be held to the standard of a prudent steward, not an agency that hopes for the best.

There is a second defense: that the data, while sensitive, may be less usable than critics suggest, because a foreign service has to combine it with other material to exploit it. That is partly right, and it is an argument for caution about the worst predictions. But a state with patience and other data sources is exactly the kind of customer who can combine them. The sensible assumption is the prudent one.

What it teaches about size

I will close the argument on a point that goes beyond cybersecurity. The OPM breach is an example of a rule conservatives have been repeating for generations: the bigger the pile of data the government holds on you, the bigger the target and the bigger the risk. Programs that demand ever more information in the name of safety, from bulk records to centralized databases, ought to be judged against that risk, and not only against their promised benefits. The same question arises for the surveillance debates covered in The Patriot Act After Two Decades, Two Conservative Verdicts Compared. Every file the government keeps is a file someone else can steal, and the nation that gathers the most is the nation with the most to lose.

You can see the same instinct in the Founders' suspicion of concentrated power. The framers did not trust any institution with unlimited access to the citizen, and they did not trust it with unlimited custody, either. They wrote a Constitution on the assumption that officials are fallible and that the structure must work even when they fail. A database is a structure too, and it should be designed the same way.

The case in brief

1. In 2015 OPM disclosed that background-investigation files on about 21.5 million people, including the personal histories gathered through forms like the SF-86 and about 5.6 million sets of fingerprints, had been taken, in addition to a separate loss of records on about 4.2 million federal workers.
2. U.S. officials attributed the theft to China, and the data is useful mainly to a foreign intelligence service, which makes this a counterintelligence loss and not an ordinary breach.
3. The House Oversight report of 2016 showed the weaknesses were known, documented and left unfixed, which is a failure of stewardship and not of bad luck.
4. A government that demands the most intimate details from its people owes them a duty to guard what it collects, and one that cannot guard should collect less and spread what it keeps.
5. The remedy is smaller, split-up databases, named officials who answer for security, and a response to such theft that carries a real price.

What you can do: ask your House member and senators whether the agency that holds your records, or your family's, has passed its most recent security audit, and read the inspector general reports posted on that agency's website.