WASHINGTON — Hackers thought to be working for the Russian government breached the unclassified White House computer networks in recent weeks, sources said, resulting in temporary disruptions to some services while cyber teams worked to contain the intrusion.
WASHINGTON — Hackers thought to be working for the Russian government breached the unclassified White House computer networks in recent weeks, sources said, resulting in temporary disruptions to some services while cyber teams worked to contain the intrusion.
White House officials, speaking on condition of anonymity to discuss an ongoing investigation, said the intruders did not damage any of the systems, and to date, there is no evidence that the classified network was hacked.
“In the course of assessing recent threats, we identified activity of concern on the unclassified Executive Office of the President network,” said one White House official. “We took immediate measures to evaluate and mitigate the activity….Unfortunately, some of that resulted in the disruption of regular services to users. But people were on it and are dealing with it.”
The FBI, Secret Service and National Security Agency are all involved in the investigation. White House officials are not commenting on who was behind the intrusion or how much data, if any, was taken.
“Certainly a variety of actors find our networks to be attractive targets and seek access to sensitive information,” the White House official said. “We are still assessing the activity of concern.”
U.S. officials were alerted to the breach by an ally, sources said.
Recent reports by security firms have identified cyber espionage campaigns by Russian hackers thought to be working for the government. Targets have included NATO, the Ukrainian government and U.S. defense contractors. Russia is regarded by U.S. officials as being in the top tier of states with cyber capabilities.
In the case of the White House, the nature of the target is consistent with a state-sponsored campaign, sources said.
The breach was discovered two to three weeks ago, sources said. Some staffers were asked to change their passwords. Intranet or VPN access was shut off for awhile, but the email system, apart from some minor delays, was never down, sources said.
White House officials said that such an intrusion was not unexpected. “On a regular basis, there are bad actors out there who are attempting to achieve intrusions into our system,” said a second White House official. “This is a constant battle for the government and our sensitive government computer systems, so it’s always a concern for us that individuals are trying to compromise systems and get access to our networks.”
The Russian intelligence service was believed to have been behind a breach of the U.S. military’s classified networks, which was discovered in 2008. The operation to contain the intrusion and clean up the computers, called Buckshot Yankee, took months.
That incident helped galvanize the effort to create U.S. Cyber Command, a military cyber organization dedicated to defending the country’s critical computer systems — including those in the private sector — against foreign cyber attack, as well as helping combatant commanders in operations against adversaries. The command is expected to have some 6,000 personnel by 2016, officials said.
When directed by the president or defense secretary, Cyber Command can undertake offensive operations.
– – –
Washington Post staff writer Craig Whitlock contributed to this report.