In a development that’s likely to add fuel to the fire of the anti-Federal Reserve Bank camp, and likely contribute to unsettled sleep for the rest of us, reports have recently surfaced that the Fed was breached, hacked, or otherwise electronically compromised over FIFTY times in the last 5 years, out of a pool of over 300 incidents, with at least some of those incidents being classified as ‘espionage,’ at least internally.
What’s equally troubling is the fact that none of this information was readily available to the public during that time until Reuters was able to obtain it through a Freedom of Information Act filing.
What’s MORE troubling is that the uncovered data represents just a fraction of the likely attacks on the Fed, as it just pertains to the Board of Governors, in the nation’s capital. This board is, in essence, a small subdivision of the Fed that is subject to public records laws. Thus these incidents don’t include other likely breaches at the Fed’s main location in New York, or any of the 12 regional banks across the country that make up the Federal Reserve System.
Now, if you’re the Federal Reserve Bank, tasked with planning and executing much of the fiscal policy of the United States and playing a major – some would say central – role in guiding global market behavior and the world economy, you would be forgiven for not wanting to panic the citizenry. Conversely, if large swaths of economic policy are being jeopardized (not to mention billions – if not trillions of dollars – being put in jeopardy), it seems that entities such as the FBI, the CIA, the NSA and the public at large should at least have been informed. And who knows, maybe they were? The records released to date are incomplete in many ways.
So far, Fed officials have had no official comment, and the reports themselves have been significantly redacted, ostensibly to protect the Fed’s security policies and systems (which clearly need as much protection as they can get). This makes it hard to discern the exact nature of the breaches, their severity, whether any funds were actually stolen, or whether the incidents in total were more about accessing classified information or more run-of-the-mill data theft. And, while the breaches have all been grouped as “unauthorized access” or “information disclosure” incidents, which can be as simple as a Fed email being accidentally sent to the wrong recipient, several have been malicious code or espionage incidents.
One of the many pieces in the sprawling Fed puzzle is the National Incident Response Team (NIRT), co-located at a fortified Fed location in New jersey, which responds to ‘higher impact’ incidents and cases, and where millions of physical dollars are processed each day. Former NIRT employees have commented that the Fed is attacked ‘about as often’ as other major financial institutions, which in and of itself is troubling on a rather fundamental level. They also reported that there were many late nights (in New Jersey) responding to breaches and fixing software vulnerabilities – in one notable incident, team members worked five straight days, around the clock, with occasional naps at their desks, to shore up the Fed’s defenses.
Worried yet? You should be.
Still unclear is whether these attacks were coordinated in any way with other breaches, such as the massive theft of 21 million background check records data at the Office of Personnel Management in 2014. Also unclear is the identity of the hackers, and whether they were individuals seeking money or information, or both, or state sponsored (aka espionage) agents from Russia, China or Iran, for example, looking for interest rate or global debt market strategy intelligence.
Either way, it seems the Fed’s cyberdefenses have been a bit more relaxed than we might have hoped or thought. With any luck this is a wake-up call, and ideally an opportunity to shore up this important institution’s perimeter defenses, before a truly disruptive, globally destabilizing or truly catastrophic breach happens there.
