HackingRampant insider hacking at U.S. immigration agency

Bin Text a readily available email hacking tool // Source: ngra.de

A yearlong investigation by the DHS Inspector General has revealed multiple instances of insider hacking at U.S. Citizenship and Immigration Services (USCIS). The inspector general found that employees had accessed management-level email and other confidential files.

The audit focused on a USCIS Texas Service Center, which was initially brought to the attention of DHS officials in 2008 when employees reported that fellow personnel had violated federal security rules. The Texas Service Center is one of four regional centers that handle a variety of immigration-related petitions and applications.According to the report, employees and supervisors abused logon privileges, gained unauthorized access, and even allegedly altered audit logs to delete any record of their activities. The inspector general’s investigation focused on seventeen individuals in particular, all of who were information technology specialists.

Investigators also found “hackware” on several computer drives – software that allows users to intercept sensitive information passing through the agency’s network.

With their illegally obtained access, the IT specialists were capable of granting citizenship rights as well as reading files containing sensitive information on contract awards, immigration reform, and other policy decisions.

The revelation of insider hacking at USCIS is not the first, as the agency has had a string of similar breaches in the past several years.

In 2008, USCIS officials found that employees at the Fraud Detection and National Security Directorate in Vermont had hooked up a non-government computer to an external Internet connection, allowing them to potentially import or export data for committing identity theft.

Most recently a former USCIS was convicted of falsifying files to help illegal immigrants receive passports. In May the Department of Justice sentenced Richard Abapo Quidilla to five and half years in prison after he pleaded guilty to computer fraud and other charges. Quidilla deleted the names, birth dates and other personal data of naturalized citizens in a secure database and substituted the corresponding information of illegal immigrants.

USCIS officials did not comment on the recent DHS investigation but released a statement that read, “USCIS demands that our employees maintain the highest ethical standards. When allegations of misconduct are made, USCIS takes immediate action to protect the integrity of the workplace and to ensure that the facts are investigated fully. USCIS is committed to taking full and appropriate disciplinary action against any employee who is found to have violated our standards.”

The inspector general warned that USCIS could be putting itself at greater risk from insider threats as a result of the poorly planned $2.4 billion project to automate immigration paperwork. USCIS Transformation is designed to be an online system for the agency’s immigration records that will improve fraud detection, but the inspector general said the program is missing controls to prevent internal hacking.

Frank Deffer, the assistant inspector general for information technology audits, wrote that based on a “review of the requirements for fraud detection and national security issues, it appears there are no requirements to address insider threats” in the program.

Deffer went on to caution, “Insiders at USCIS have perpetrated fraud in the past” and internal staff “are capable of granting legal residency or citizenship status to someone who poses a national security risk to the United States.”