Government Employees' Online Personal Info Presents Unmitigated Risk Vector

simarik/iStock.com

Today, 1 in 15 government workers is exposed to social engineering attacks.

In 2018, The Atlantic published an article on the dangers of email, saying, “Electronic mail as we know it is drowning in spam, forged phishing mails, and other scams and hacks. It’s going to get worse before it gets better.” Well, it just got worse. In large part due to the increase in telework, targeted phishing emails tripled in frequency in 2020 compared to 2019, making it the most common cyber crime last year. As if that wasn’t scary enough, in the first quarter of this year, phishing has again surged by nearly 50% versus Q1 of 2020. 

Today, 1 in 15 government workers is exposed to social engineering attacks, and across the nation, local government employees are constantly facilitating ransomware attacks by inadvertently clicking on malicious links or attachments within emails. From incidents that are somewhat humorous (hackers trying to lure federal workers with fake free fast food offers) to downright scary (phishers gaining access to the sensitive information, including Social Security numbers, of thousands of state employees), no government employee today can afford to feel at ease when it comes to the threats lurking in their inbox. 

As a result, understanding what enables phishing and other social engineering attacks is key to ensuring employees at federal agencies don’t accidentally join the long list of victims. 

Publicly Available Personally Identifiable Information Is Largely to Blame 

The reason so many government employees fall for social engineering scams is that, over the years, attacks have gotten more personal and sophisticated. Instead of relying on mass email blasts as happened in the past, modern cyber criminals typically research everything they can about an individual—whether through social media or other sources—before sending a customized email, text message or even call. These insidious phishing lures typically use details only those close to the target—be it an employer, colleague, friend or family member—should know. 

Unfortunately, while the threat from social engineering attacks is universal, when it comes to publicly available personally identifiable information (PII), federal employees are particularly overexposed. For many public employees, certain information, such as their name, position title, grade, salary, professional qualifications, membership in professional groups, and even duty stations (i.e., location details like room number), must be made available to the public routinely. Websites like FederalPay.org and FedsDataCenter also allow individuals to easily find out how much a particular state employee earns. 

The public's ability to access this information online is vital for the sake of transparency. However, this same transparency also gives bad actors new ways to trick federal employees into downloading malware, sharing confidential information or credentials, and making unauthorized payment transfers. In 2016, for example, a hacker used social engineering tactics to gain access to and leak information on thousands of Department of Homeland Security employees.

Moreover, while information about federal employees’ private life, including their home address, phone number, age, marital status and prior employment (if it doesn’t relate to current occupation) is supposed to be off-limits to the public, data brokers, such as Acxiom, which has profiles on at least 500 million people worldwide and about 1,500 data points per person, fill in these gaps. 

How to Keep Government Employees Safe

Although reporting on government employees’ and contractors’ personal data is mandatory, the disclosure of certain information, like employee whereabouts, may not be. Accordingly, organizations should establish procedures and policies to determine when to share certain information and when to withhold it, taking into account how the information was obtained in the first place (i.e., is it publicly accessible) and weighing up the potential invasion of privacy versus the public benefit of disclosing sensitive data. 

On the other hand, to protect workers’ PII sold by data brokers, agencies can encourage employees to take the time to opt-out of data brokers. Alternatively, since the process of opting out is tedious and time-consuming, agencies can provide staff with access to a data privacy service that will do so for them. Removing employee information from data brokers will not only help keep government employees safe from harassers and identity thieves but will also protect the organization from cyberattacks that exploit employee vulnerability. 

Employee training is also important and should include both information on how individuals can reduce their digital footprint (for example, by making their social media profiles private) and identify social engineering attacks, with a focus on the latest scams. 

PII Is Being Weaponized But Employees Can Fight Back

Already one of the biggest threats to government organizations, social engineering scams are not going to go away anytime soon. With attacks growing increasingly more clever, being careful about whom agencies give out staff PII to is vital, as is educating employees on the importance of data privacy and trends in social engineering. However, as cyber criminals learn to personalize their scams, evading the threat completely is going to get more difficult. The only way out is to remove federal employee information from data brokers.

Rob Shavell is co-founder and chief executive officer of Abine/DeleteMe.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.