“It was, indeed. It was found that the OPM did not even maintain a list of which servers, databases, and devices were in its inventory, so it was impossible to protect the data held there.
“Whoever accessed the OPM files, it was during the time the Indian company was working on internal security at the network. The credentials of a contract employee with the correct access were duplicated and these creds were used to create a new user with full admin access.”
Ryan drummed his fingers on the table. “This cache of files has information on everyone who has ever sought classified status. Everyone?”
“Well… since, as I said, 1984 to four years ago.”
“I’m no computer expert, but I’m pretty sure we didn’t have this network in ’84.”
“No, Mr. President. At that time this was all on microfiche. In a modernization plan in the nineties, all the microfiche from 1984 on was transferred to the computer files.”
“Terrific.” Ryan thought for a second. “I guess I’m in there.”
The briefer, who was already terrified, went white. “Ah… I don’t know. I didn’t look to see if any individuals—”
Ryan said, “It would have been a couple years before, but of course other checks were done on me as I moved up through the ranks at the Agency and then in the executive branch.”
The doctor suddenly seemed slightly more relaxed. “This is just the SF-86 form, along with fingerprints, so if you filled yours out prior, you would not be in there.”
Ryan shrugged. It didn’t really matter, this was one of the largest disasters he’d ever heard of. He looked at the nervous man down the table from him. “Dr. Banks, you aren’t on trial here. I’m royally pissed about all this, but I know better than to shoot the messenger.” He leaned forward a little. “You tend to get less clear messages that way.”
“Yes, Mr. President,” Banks said, but he didn’t seem any more at ease. He added, “We have incident-response teams working around the clock to identify who has taken this information, exactly when, and exactly how. We do feel it was a one-time data dump, and we have rescinded all admin access of the system until each person involved can be revetted, but clearly damage has been done in this case.”
Ryan turned to Andy Zilko. “Andy, I’ve seen the numbers. We’ve spent five billion on the National Cybersecurity Protection System to avoid just this sort of event. After the Chinese got into our intelligence network a couple of years back, people who are paid to watch these things assured us it would not happen again.”
Zilko’s unease was as obvious as Dr. Banks’s. “Yes, sir. I can say we have made strides to improve our cyberprotection systems in the past four years.”
“What strides?”
Zilko thought for a moment. “Well… since we’re discussing the OPM, for example. The new in-house personnel are in the process of making the security there more robust, but they haven’t been moving as fast as we would have liked.”
Ryan closed his eyes in utter frustration. The majority of his life had involved, in one form or another, dealing with government bureaucracies. He always thought he couldn’t be fazed, no matter the bureaucratic malfeasance. And he was always finding himself to be wrong on this point.
“How many currently holding clearance have been compromised?”
Zilko turned to Banks, who answered the question. “Right now, Mr. President, there are just over four and a half million people holding security clearances. The vast majority of these people would have filled out an SF-86 before the system was breached. I think we could be looking at a number of around four million men and women.”
Ryan said, “More than four million current government employees or contractors could be at risk from this breach. Military officers, elected officials, technical experts, those tasked with guarding our nuclear stockpiles.”
Dr. Banks said, “I’m afraid it is every bit as bad as that, Mr. President. The SF-86 won’t out someone as a CIA employee directly, in fact the CIA uses their own system for classified applications, but many if not most CIA officers had to fill out an SF-86 for their cover job, like working in an embassy with the State Department, or else they were former military or law enforcement with classified access, in which case they would be in there anyway. A top-flight data miner and ID intelligence specialist can look for certain anomalies to see things that don’t add up. You have a guy working in the embassy in Madrid, for example, who is a covered CIA officer. He works as a consular officer, but his SF-86 shows him spending eight years in Naval Intelligence, or serving as an Army Ranger or Green Beret. An interested party is going to determine pretty quickly that this guy is an Agency case officer, and not over in Madrid stamping passports.”
Ryan rubbed his nose under his glasses. “And now it appears Musa al-Matari has this information, as well as others. This is a complete nightmare. Even if we stop al-Matari and all his cell members, even if this misuse of the OPM data is halted, we can never be sure who has all this information that leaked out.”
“That is unfortunately correct, Mr. President.”
Ryan said, “We need the best in the business telling us how to mitigate this damn disaster. We owe that to the people who work for us or have worked for us in the past. That’s for tomorrow. For today… today we find the people using the intelligence to target our people, and we stop them.
“Mary Pat, we need to develop a full-spectrum counterintelligence plan to deal with this. All government employees and contractors are, at this point, potential human targets,” Ryan said. “It’s been made abundantly clear to a few of them. General Caldwell, for example. This needs to be communicated to every last one of those affected. Now.”
“Under way as we speak, Mr. President. As DNI, I can take the lead on this and integrate everyone we need to integrate to get the word out.”
DHS Secretary Zilko raised his hand. “Mr. President. I do want to stress that the breach happened during the previous administration.”
Ryan felt the boiling heat on his face, but he didn’t let his anger overtake him. He pointed at Zilko. “I don’t ever want to hear you say that again about this or any other crisis. We aren’t here to cover our asses. We’re here to serve the United States of America. For four damn years people in this administration have known that a company in India had access to sensitive material. Just because we didn’t know they took it is no reason to pat ourselves on the back. Just because you didn’t know personally, people you are responsible for did. And just because I didn’t know personally, I am responsible for you.”
Zilko looked away. Softly he said, “Of course, Mr. President.”
Ryan moved his pointed finger around the room. Everyone, even Mary Pat and Dan, got the finger and the intense eyes that came with it. “Everyone in here needs to take responsibility for finding our way out of this debacle. We need to accept that we bear significant responsibility for these deaths and injuries, because despite any excuses we might think we have, this all happened on our watch. Maybe not the initial breach, but the fallout from it.
“Now… let me explain what is going to happen. We will find Musa al-Matari, we will discover who was responsible for the breach and take them off the game board, and only then, when this is over, I will ask for a stack of resignation letters on my desk. Ladies and gentlemen, we owed our bravest citizens better than we gave them. We’ll fix it going forward, but I want a full accounting of the past.”
Ryan stood and stormed out of the room, as angry as he’d ever been in his life. America was endangered by innumerable outside threats. He had long ago learned to accept this. But he’d never been able to come to terms with the amount of self-inflicted damage the nation incurred because of poor job performance and those who did not take threats seriously.