The background checks of 21.5 million U.S. federal employees with security clearances are the crown jewels in the Chinese regime’s new system to spy on Americans. The files were allegedly stolen by Chinese hackers who breached the U.S. Office of Personnel Management, which the American public learned about in June.
Using software capable of processing massive amounts of data, the Chinese regime could use the acquired insights from these files to recruit spies, hack companies, or breach systems of critical U.S. infrastructure.
Here are 3 ways China can exploit the data:
1. Identify Potential Spies
While recruiting spies, Chinese agents look for four moral weaknesses that can be exploited. These are fame, profit, lust, and anger.
The Office of Personnel breach gave them a roadmap of these weaknesses, through its SF86 forms that include seven years of background on each federal employee with security clearance.
After identifying the moral weaknesses of a targeted person, that individual may be exploited by Chinese agents using methods such as sexual advances, business offers, or high-level invites to China.
2. Cross-Reference to Unveil Secrets
Stolen documents from the Office of Personnel are just the tip of the iceberg. Chinese hackers are accused of hitting many other targets, including Anthem BlueCross and BlueShield, where they allegedly stole 80 million records.
Many Americans may appear in more than one database stolen by Chinese hackers. By using software to draw connections between this data, the Chinese regime could gain a more complete picture of each individual.
If they were targeting a federal employee, they may be able to look at the health insurance databases and find individuals that have family members in hospitals, and are in need of money. They could also find information on individuals they failed to disclose in the federal files.
3. Tailor Emails With Malware
The federal database has information on individuals dating back to 1985, and it’s likely many people now work in different industries, offering an endless array of pathways for potential economic espionage.
Since the information discloses family members and even the hobbies of each individual, Chinese hackers could more effectively write fake emails designed to infect the individual’s computer.
Cyberattacks such as this, known as spearphishing attacks, are a favorite of Chinese hackers. It typically involves sending a personally tailored email to the targeted individual, with an infected file attached. If the individual opens the file, it can then infect the company’s computer network.
