Exposed. Naked (and not in any good way). Vulnerable. Powerless. Adrift. Apprehensive. Anxious. Frustrated. Overwhelmed. And definitely mad as hell. These are some of the things I’ve felt since learning that I’m among the millions whose precious personal data was lost when the federal Office of Personnel Management got hacked.
When the story broke I figured it was just a matter of time, and sure enough, I now have an email from OPM: “The data compromised in this incident may have included your personal information, such as your name, Social Security number, date and place of birth, and current or former address.” It goes on to offer credit monitoring and ID theft insurance, and claims OPM has made “an aggressive effort to update its cybersecurity posture.” All well and good – but a textbook case of locking the barn after the horse is out. The systems are so old they can’t even be encrypted. Didn’t anybody understand the risk?
I’ve had similar problems before, starting the first time I bought something online and had my credit card number hijacked. But you can fix that with a new card, usually with no liability. It’s pretty frightening to think that my SSN, 30+ years of federal employment records, and who knows what else are out there in a hostile cyber-wilderness. As my former boss, National Taxpayer Advocate Nina Olson, has said in her battle against tax-related ID theft, “Identity theft is an invasive crime that can have a traumatic emotional impact,” including symptoms similar to those of post-traumatic stress disorder.
I know there are many, many others facing much more danger than me, especially those in the military, the State Department, intelligence agencies, and other sensitive jobs. I just have no confidence that OPM will right the ship, or that its leaders even grasp the magnitude of their failures and incompetence. That email was signed by the chief information officer. Why not the director? Why can’t she take responsibility?
Update and correction: In the earlier version of this post, I described the security feature on the credit monitoring site, which says “Please confirm that you are human and not a robot by checking the box below” as likely to be ineffective. I’ve since learned that it works like the traditional captcha feature. Sorry for the error.
1 thought on “Diary of a hacking victim, chapter 1”