ATF Official Caught Leaking Employee Data



CNN reports that an executive at the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) was sending personnel data to a personal email account.

The breach at the Office of Personnel Management (OPM) has the entire government on high alert for the actions of sophisticated, nation-state hackers. But a report by CNN reminds us that it isn’t just APTs that the government has to worry about.

According to this story, the U.S. Department of Justice (DOJ) is investigating whether an employee of the Department of Alcohol, Tobacco, Firearms and Explosives (ATF) transferred personnel files of fellow ATF employees to a home e-mail account. The report names Scott Sweetow, the deputy assistant director for strategic intelligence and information at ATF headquarters in Washington, as the target of the investigation, though Mr. Sweetow claims he is the victim of “character assassination.”

According to the CNN report, security officials began the probe after systems used by the DOJ to monitor the transfer of personally identifiable information noted the transfers outside the DOJ network. The Department's Justice Security Operations Center notified their counterparts in the ATF, which began an investigation.

That investigation is ongoing and it’s possible that nothing untoward happened. But it is also a reminder that trusted insiders are a major source of data theft and data leaks within organizations. Of over 2,100 confirmed data breaches that were analyzed in the latest Verizon Data Breach Investigations Report, for example, Insider Misuse accounted for close to 21 percent of them.

Those incidents often amount to inadvertent or well-intentioned errors – employees transfer work to a home- or personal cloud account so that they can continue to work after hours. But these incidents are often malicious or criminal in nature. Wayward employees, for example, might harvest sensitive data to resell it on the black market for use in identity theft. Or they may use the data to harass fellow employees anonymously or otherwise. As Verizon notes, many incidents of insider abuse simply go unnoticed, and are discovered during forensic examination of user devices after the individual left a company – when such examinations are done.

The question is what to do to stop insider leaks. A good place to start is with tight control and monitoring of user privileges. Many insider data leaks are a byproduct of loose internal controls that give employees access to systems and data that they don’t need to do their job. That access, combined with curiosity or greed, can lead to incidents.

The other thing organizations need to do is to develop normative patterns of employee behavior based on their role, or on specific user actions. Observing employee connections to systems during the normal course of business will create a certain predictive pattern of activity against which unusual forays to systems or data sources that are not required in their day to day work will stand out, providing a basis for further investigation by their employer.

Finally – as DOJ showed here – you need to monitor outbound communications for the presence of sensitive information such as personally identifiable information or intellectual property. Criminals need to get their data off your network somehow. By simply monitoring data flows, in concert with other detection means, you can spot suspicious or malicious activity at an early stage and prevent longer and more damaging breaches.

Paul F. Roberts is the Editor in Chief of The Security Ledger.

Paul Roberts

Please post your comments here

Dan Geer on How to Mitigate the Risk of Insider Threats

Dan Geer explains how to apply the reference monitor concept to mitigate the risks presented by insiders.

Get the whitepaper

Related Articles
Effectiveness of Identity Theft Services Limited

A congressional watchdog is reiterating its findings that identity theft services are rarely efficient at mitigating data breach risks.

June 2015: The Month of the Breach?

From the very large to the very small, the drumbeat of stolen data continues. This blog post lists the more – and less – notable data breaches announced in the last two weeks. While some of these breaches have received very little press attention, they are no less important for those people whose information has been stolen.

Judge in Anthem Case Rules That Breach Harmed Patients

The legal wrangling over whether data breaches cause harm to consumers continued this week, with a District Court ruling in a case involving health insurer Anthem.