Are Federal Employees the Bull in the China Shop When it Comes to Cybersecurity?

Federal employees -- not Chinese cyber spies or overzealous hacktivists -- may pose the greatest threat to securing federal computer networks.

Employees of Uncle Sam, unwitting or not, account for at least half of all the federal cyber breaches reported annually since 2010, according to a new analysis of federal records by The Associated Press.

Federal workers “have clicked links in bogus phishing emails, opened malware-laden websites and been tricked by scammers into sharing information,” according to the report.

Call these employee-triggered breaches “own-goal” cyberincidents, and they stem from a variety of security and policy breakdowns, according to a White House review dug up by the AP:

• 21 percent of breaches resulted from feds who violated policies
• 16 percent resulted from lost or stolen devices
• 12 percent resulted from employees improperly handling sensitive information
• 8 percent resulted from employees who installed malicious software
• 6 percent resulted from employees “who were enticed to share private information”

The AP report was based on dozens of Freedom of Information Act requests and other documents obtained by the news service as well as interviews with hackers, government officials and cybersecurity experts.

Officials know they have a problem on their hands.

The National Initiative for Cybersecurity Education -- known as NICE -- is just a tiny piece of governmentwide cybersecurity response efforts, which in toto amount to about $10 billion. NICE specifically aims to improve training of both cybersecurity professionals as well as rank-and-file employees.

“Certainly, mistakes happen all the time,” NICE Director Ernest McDuffie told Nextgov in September. “We're all human beings and everybody's guilty clicking of that bad email … So, the best mitigation factors against those types of activities are constant training and awareness. What do you do with your workforce to make sure that they understand what the threats are that are out there and what they can do to mitigate against those threats?”

Still, cyberincidents are on the rise.

The number of breaches reported specifically on federal networks increased more than 40 percent between 2009 and 2013 -- from 26,942 to 46,605, according to statistics from the U.S. Computer Emergency Readiness Team cited by AP.

When you throw in contractors and companies that operate critical infrastructure, the total number of incidents last year, alone, total 228,000 -- more than double the number reported in 2009.

(Image via Cartoonresource/Shutterstock.com)