U.S. Marshals Served With Major Cyber Security Incident

Even law enforcement isn’t immune to cyber-attacks. In February, the U.S. Marshals Service (USMS) announced it had been the victim of what it’s calling a “major incident” involving cyber security. Ironically, this happened the same day as the CISA director noted that cyber intrusions "can do real damage to our nation--leading to theft of our intellectual property and personal information." I guess the attackers really showed them.

On a more positive note, according to the spokesperson for the USMS, the system was not connected to any other federal system but stood on its own. However, it did contain some pretty significant personally identifiable information (PII). For example, it did store information on criminal fugitives and law enforcement legal proceedings, as well as some personal information on some employees. So, although it was separate from the other parts of the network, it was not an insignificant system.

Securing all systems is important, as we now know after a DNA company’s server was breached because the company “forgot” about a database with a lot of DNA information on it. They didn’t remember to secure it. And keeping it separate, but not secured is also risky. All systems, especially those that store PII or confidential information should be secured and even if they are not actively used, should still be checked from time to time. They also need to be patched and updated.

According to Presidential Policy Directive 41, “all major incidents are also considered significant cyber incidents, meaning they are likely to result in demonstrable harm to the national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties or public health and safety of the American people.” These must be reported to Congress within seven days of identification.

The USMS has completely disconnected the affected system and is still investigating what happened. In the meantime, it has found another way to investigate the fugitives without using the affected system.