Business & Finance
05:50 PM
Connect Directly

FBI Hacker Awaits Sentencing

An FBI contractor faces up to 18 months imprisonment after pleading guilty to illegally accessing the bureau's computers in one of several insider security breaches the U.S. government is facing.

If you think the only two security threats to your organization come from either your employees or your enemies, think again. The U.S. District Court for the District of Columbia next week could sentence Joseph Thomas Colon to up to 18 months in prison for poking around areas of the Federal Bureau of Investigation's network where he shouldn't have been. Colon is neither an FBI employee nor an outsider. He was a contractor working on the FBI's Trilogy project to upgrade the agency's aging IT infrastructure.

Although Colon was an employee of defense contractor BAE Systems and worked out of the FBI's Springfield, Ill., office, he in March pled guilty to four counts of "intentionally accessing a computer while exceeding authorized access and obtaining information from any department of the United States," in this case, the Justice Department, according to court documents. Colon was caught accessing "secret"-level information, which is at a clearance level higher than he was permitted to access.

Colon four times in 2004 accessed the FBI's Security Account Manager, a database on the FBI's classified network that contains encrypted user and group account password information for more than 38,000 user accounts. Lest anyone think Colon simply stumbled upon this information, he then used the L0phtcrack password decryption tool to make the encrypted passwords readable.

While external attacks, primarily in the form of network attacks, are a constant hazard for IT pros, this year has already seen several high-profile cases of laptops and data stolen from employee homes and cars. The most significant was the May theft of a Veterans Affairs Department laptop containing 26.5 million records from an employee's home. The laptop was later recovered, but the enormity of the missing data prompted the National Institute of Standards and Technology, or NIST, and the White House Office of Management and Budget, or OMB, to give federal agencies 45 days to improve the security of their data.

The FBI reacted to Colon's impropriety by last year demanding that all FBI employees and contractors complete information security awareness training on an annual basis. But much like the recent recommendations passed down from NIST and OMB and the Congressional hearings held in the wake of the VA laptop theft, the FBI's compulsory training program is a reactive measure to a problem it should already have addressed. Until both the public and private sector start acting to prevent the next big security challenge before it erupts, we'll continue to see measures designed to solve yesterday's problems.

Comment  | 
Print  | 
More Insights
The Business of Going Digital
The Business of Going Digital
Digital business isn't about changing code; it's about changing what legacy sales, distribution, customer service, and product groups do in the new digital age. It's about bringing big data analytics, mobile, social, marketing automation, cloud computing, and the app economy together to launch new products and services. We're seeing new titles in this digital revolution, new responsibilities, new business models, and major shifts in technology spending.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest - August 20, 2014
CIOs need people who know the ins and outs of cloud software stacks and security, and, most of all, can break through cultural resistance.
Flash Poll
Twitter Feed
InformationWeek Radio
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.