recommended reading

Thousands of Weather Satellite Bugs Won’t Be Fixed For Years

The Joint Polar Satellite System

The Joint Polar Satellite System // NOAA

The Commerce Department inspector general is blasting a federal climate-satellite program and its supporting contractor, Raytheon, for ignoring tens of thousands of major cyber vulnerabilities.

The weaknesses identified in a new IG memo could impair machines controlling the Joint Polar Satellite System, the nation's next-generation fleet of polar orbiting environmental satellites. 

The ground system routes information for the National Oceanic and Atmospheric Administration and the Pentagon, as well as other U.S. and foreign government agencies. NOAA, part of Commerce, manages the information technology system. 

The system’s critical vulnerabilities have spiked by more than 60 percent since 2012, increasing from 14,486 security holes to 23,868 holes. 

High-Risk Vulnerabilities Persist

In 2010, NOAA began modifying the ground system to support satellite upgrades. But, “until 2014, the program did not require the ground system contractor to begin full implementation of the majority of the security controls for the system," Allen Crawley, assistant IG for systems acquisition and IT security, said in the memo. As a result, "many high-risk vulnerabilities exist within the system."

The government increased Raytheon's now-$1.7 billion contract by $185 million in February to strengthen information security and speed data delivery, company officials said at the time. 

The "high-risk vulnerabilities" cited by the IG refer to system weaknesses that make it relatively easy for hackers to gain control of computer components.

"If exploited, these vulnerabilities may make it possible for attackers to significantly disrupt the JPSS mission of providing critical data used in weather forecasting and climate monitoring," Crawley said in the memo, which was released Tuesday.

The satellites controlled by the system track data on oceans, ozone, snow, vegetation and other environmental indicators to help scientists discern changes in the Earth's atmosphere. 

But hacker tools are already available on the Web to exploit several of the weaknesses, Crawley noted. 

The security problems listed include:

  • More than 9,100 instances of high-risk flaws discovered during vulnerability scans, such as outdated software versions, programs that were missing bug fixes, incorrectly configured software, and excessive user privileges for accessing operating systems and software. 
  • More than 3,600 cases where password and audit settings were misconfigured.
  • Unnecessary software applications that need to be removed or disabled.

"The majority of these issues will not be remediated for another two years," Crawley said. 

The good news is that some of the vulnerabilities could be mended immediately, if NOAA demanded faster response times from Raytheon.

"Urgent updates to the JPSS ground system were not performed because the program did not require that the ground system contractor remediate vulnerabilities in a timely manner," Crawley said. 

NOAA Behind in Applying Security Patches

Agency policies mandate that high-risk issues be fixed within 30 days but in practice, patches were only applied about once a year. 

NOAA officials told the IG updates were delayed because of the 2011 liftoff of the program's first satellite -- Suomi National Polar-orbiting Partnership -- and an audit of Raytheon's work.

The agency is on schedule for a launch of a second satellite, JPSS-1, in early 2017, NOAA officials said in June. 

Tuesday's memo follows a scathing IG assessment of NOAA's overall satellite security posture in July.

Among the blunders detailed: a hacker stole satellite data from a contractor's personal computer, after which the employee refused to turn over the machine for investigation. Unauthorized smartphone use on critical systems also turned up during the audit. 

IG: Security Concerns Justify Special Attention

On Tuesday, Clark Reid, the Commerce IG's legislative and external affairs officer, said in an email significant security concerns involving the Joint Polar Satellite System ground system "justified special and separate attention” in a new memo.  

In written remarks responding to a draft memo, NOAA officials said they already are working to address the IG’s findings by, for example, neutralizing the Heartbleed superbug, a vulnerability in widely-used encryption software. 

The agency "successfully used expedited processes to enable remediation of Heartbleed in an accelerated manner" between April and June, Vice Adm. Michael Devany, NOAA deputy undersecretary for operations, said in the July 25 correspondence.

Raytheon officials told Nextgov they had not read the report and referred questions to NOAA. Agency officials Tuesday said they had no additional comment. 

Threatwatch Alert

Thousands of cyber attacks occur each day

See the latest threats


Close [ x ] More from Nextgov

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • It’s Time for the Federal Government to Embrace Wireless and Mobility

    The United States has turned a corner on the adoption of mobile phones, tablets and other smart devices, outpacing traditional desktop and laptop sales by a wide margin. This issue brief discusses the state of wireless and mobility in federal government and outlines why now is the time to embrace these technologies in government.

  • Featured Content from RSA Conference: Dissed by NIST

    Learn more about the latest draft of the U.S. National Institute of Standards and Technology guidance document on authentication and lifecycle management.

  • A New Security Architecture for Federal Networks

    Federal government networks are under constant attack, and the number of those attacks is increasing. This issue brief discusses today's threats and a new model for the future.

  • Going Agile:Revolutionizing Federal Digital Services Delivery

    Here’s one indication that times have changed: Harriet Tubman is going to be the next face of the twenty dollar bill. Another sign of change? The way in which the federal government arrived at that decision.

  • Software-Defined Networking

    So many demands are being placed on federal information technology networks, which must handle vast amounts of data, accommodate voice and video, and cope with a multitude of highly connected devices while keeping government information secure from cyber threats. This issue brief discusses the state of SDN in the federal government and the path forward.

  • The New IP: Moving Government Agencies Toward the Network of The Future

    Federal IT managers are looking to modernize legacy network infrastructures that are taxed by growing demands from mobile devices, video, vast amounts of data, and more. This issue brief discusses the federal government network landscape, as well as market, financial force drivers for network modernization.


When you download a report, your information may be shared with the underwriters of that document.