Phishing Scams Aren’t Likely to End Federal Careers Anytime Soon

Love online coupons? Can't get enough gaming from your work PC? Do you click every interesting link that lands in your inbox? The chief information security officer at the Homeland Security Department wants those who fall victim to multiple phishing attacks to lose not just their pride — but their security clearances, as well.

During a cybersecurity summit held last week in Washington, Paul Beckman said he regularly sends phishing emails to test his senior staff — and far too many of them fail the test.

"Someone who fails every single phishing campaign in the world should not be holding a TS SCI with the federal government," he said. "You have clearly demonstrated that you are not responsible enough to responsibly handle that information."

Guideline M: Misuse of Information Technology Systems

When it comes to losing your security clearance for carelessness online, the government does have one angle it can take. Guideline M: Misuse of Information Technology Systems addresses misuse of IT systems and is one of the adjudicative criteria used in a clearance determination. This guideline has almost exclusively been used in cases where pornography has been viewed on a government or workplace computer system, but it also includes sending inappropriate email or other workplace misconduct. Is clicking on a phishing email in the same category? That would be difficult to argue. The main principle used in a misuse of IT systems determination is the "knowing and willful" rule violation. It's difficult to ascertain if an individual "knew" a phishing email was malicious.

It Feels Good to Be Bad

The primary issue the DHS CISO was pointing to is the current lack of incentive for adhering to government security policies. Outside of annual security training, little is made of how government IT systems should or shouldn't be used (which was made clear by the 15,000 or so .gov and .mil email addresses found in the Ashley Madison database). While it's good practice not to mix business with pleasure, the practicality of that often falls by the wayside for government professionals who may not even be allowed to access personal email from their government offices. When you want to spend your lunch hour looking at Aunt Betsy's vacation pics or doing a bit of online shopping, it's a slippery slope between acceptable personal use and an erroneous mis-click that could open the gates between your PC and China.

But Wait — Didn't OPM Make Me Easier to Scam?

Yet another problem that won't go away is the Office of Personnel Management breach. OPM announced last week, "Whoops, we lost 5.6 million fingerprints, not the 1.1 million originally reported." With the federal personnel files and security clearance records of 20 million now in China's hands, the quality of phishing attacks is going to increase exponentially.

Recent reports indicate China is gathering together the information from the OPM, Anthem insurance, IRS and OPM hacks. Security experts say Chinese intelligence is putting together a "Facebook" of government employees. What do you think they plan to do with it?

Spear phishers now know intimate details about your friends, family, criminal histories and habits. They will be able to put together very sophisticated phishing attacks and target them individually. The burden of responsibility remains on the user, but a security clearance holder now makes a good argument that he doesn't just have himself to blame — Uncle Sam has his fair share, too.

Government employees and clearance holders won't end their careers by clicking on a spear phishing email anytime soon. But Beckman's comment is a reminder that in a dangerous Web world (the OPM breach originated with a phishing email), users will be held more accountable, and current IT policies will need to change. These changes will likely be manifold — including more restrictions on accessing personal websites from work, user privileges, and maybe a revamp of what that annual security refresher training looks like (and that is one change I can definitely approve of).

Lindy Kyzer is the editor of ClearanceJobs.com and a former Defense Department employee.

(Image via wk1003mike/Shutterstock.com)