Computer systems at the FAA, EPA, NRC, the departments of Justice, State, Defense, Treasury, and Commerce, and at least 16 other government agencies are still vulnerable to attacks, ranging from website defacements to sensitive information breaches. Security problems range from misuse of passwords to not even being able to detect a system break-in. System security in the U.S. Government is so poor that a recent GAO (General Accounting Office) report stated:
… A clear risk exists that terrorists or hostile foreign states could launch computer-based attacks on systems supporting critical infrastructures to severely damage or disrupt national defense or vital public operations or steal sensitive data.
The NSA believes that “foreign governments have already developed ways to attack U.S. computer systems” ranging from break-ins to deliberate computer virus infections that could affect functions like “FAA flight control system or those that support Pentagon war efforts.”
Attacks on government computer systems have proliferated in the last few years, leading to 586 reported incidents last year involving over half a million federal systems and almost 150 military systems. Those numbers, compiled by the Federal Computer Incident Response Center, only include reported problems and thus are almost certainly extremely low, since “the vast majority” of attacks aren't even detected. Government system vulnerabilities have been a concern for years, but even previous efforts to fix the situation have come up short. In 1998 the FBI created the National Infrastructure Protection Center but couldn't staff a 24-hour Internet monitoring unit because of budget constraints (in part); in addition, key positions were empty for over a year because specialists couldn't be found to take the jobs. The Defense Department's computer security efforts (see our May news item) were hampered by not having enough managers on staff, which produced missed deadlines. Thus, serious security problems abound: the FAA (Federal Aviation Administration) didn't do background checks on some auditors who had access to sensitive information and has “routinely failed to secure physical access” to computer systems; the EPA (Environmental Protection Agency) has a security program deemed “ineffective” due to “pervasive problems”; and 7 of the Department of Commerce's computer systems were seriously breached, giving full access rights to “sensitive economic, financial, personnel, and confidential business data” just by logging on as a sysadmin without a password!
Security analysts feel the government must coordinate its security efforts and establish accountability for problems. In light of September 11, the Bush administration plans to create “an office of cyber-security in the National Security Council office in the White House.”
For much more information, please see The Washington Post.
I think the most salient point in the entire article is that this has been a known–and addressed–problem for years, but it's only now, after the 9/11 tragedy, that we have a real possibility of fixing the holes that plague our government systems. It's totally unfortunate that a massive disaster has to happen to make us wake up to the severity of computer system vulnerabilities, but that's just human nature. Let's hope that a new Department of Homeland Security and this new Office of Cyber-Security can get our government's computer systems shored up and protected before the next sophisticated terrorist attack is preceded by a massive computer outage. If the FAA is still having problems keeping unauthorized people from accessing computers (most security plans do forget to address the key issue of a hacker changed Yahoo! News stories in an attempt to expose a system vulnerability; while the hacker didn't really intend to cause trouble, his exploits point out how subtle and devious a hack attack can be on the 'Net. We've already seen how malicious rumors in a chat room can cause a company's stock to tank … information can be a dangerous thing in unscrupulous hands, and the Internet's well-publi