FBI Hacker Awaits SentencingFBI Hacker Awaits Sentencing

If you think the only two security threats to your organization come from either your employees or your enemies, think again. The U.S. District Court for the District of Columbia next week could sentence Joseph Thomas Colon to up to 18 months in prison for poking around areas of the Federal Bureau of Investigation's network where he shouldn't have been. Colon is neither an FBI employee nor an outsider. He was a contractor working on the FBI's Trilogy project to upgrade the agency's aging IT infrastructure.

Although Colon was an employee of defense contractor BAE Systems and worked out of the FBI's Springfield, Ill., office, he in March pled guilty to four counts of "intentionally accessing a computer while exceeding authorized access and obtaining information from any department of the United States," in this case, the Justice Department, according to court documents. Colon was caught accessing "secret"-level information, which is at a clearance level higher than he was permitted to access.

Colon four times in 2004 accessed the FBI's Security Account Manager, a database on the FBI's classified network that contains encrypted user and group account password information for more than 38,000 user accounts. Lest anyone think Colon simply stumbled upon this information, he then used the L0phtcrack password decryption tool to make the encrypted passwords readable.

While external attacks, primarily in the form of network attacks, are a constant hazard for IT pros, this year has already seen several high-profile cases of laptops and data stolen from employee homes and cars. The most significant was the May theft of a Veterans Affairs Department laptop containing 26.5 million records from an employee's home. The laptop was later recovered, but the enormity of the missing data prompted the National Institute of Standards and Technology, or NIST, and the White House Office of Management and Budget, or OMB, to give federal agencies 45 days to improve the security of their data.

The FBI reacted to Colon's impropriety by last year demanding that all FBI employees and contractors complete information security awareness training on an annual basis. But much like the recent recommendations passed down from NIST and OMB and the Congressional hearings held in the wake of the VA laptop theft, the FBI's compulsory training program is a reactive measure to a problem it should already have addressed. Until both the public and private sector start acting to prevent the next big security challenge before it erupts, we'll continue to see measures designed to solve yesterday's problems.