Secret Service digital security flaws threaten US authorities

Inadequate cybersecurity practices by Secret Service agents left their phones vulnerable to hacking, according to a new report from the inspector general of the US Department of Homeland Security.

This situation has put the lives of high-ranking U.S. officials they are supposed to protect at risk.

Foreign "adversaries" - a term that can encompass spies and terrorists - "could have intercepted and exploited Secret Service information, putting our nation's leaders, other protected persons and employees at risk," said a report released Thursday by the inspector general.

The findings reignite long-standing concerns about Secret Service security practices, two years after the attempted assassination of President Donald Trump in Butler, Pennsylvania.

In this case, failures and insecurity in communications led to one of the most serious episodes in the agency's recent history.

Much of the problem is related to the fact that Secret Service employees often use their less secure personal phones instead of government-issued devices during protective missions, the inspector general's new report found.

If someone hacked into an agent's personal phone, they could steal "mission-related data, including contacts, usage history, geolocation and photos" and then use that sensitive information to "plan attacks against Secret Service personnel or personnel," the official concluded.

The investigation also found that the Secret Service did not clean data from employees' phones after returning from international travel and that the agency did not have a policy for testing software before installing it on staff devices.

For years, agents at the agency have complained that their phones did not allow them to use certain applications to communicate with foreign officials or to send certain types of text messages to each other.

Shortly before the July 13, 2024, assassination attempt on Trump in Butler, a Secret Service employee "used his personal device to receive a photo of the alleged shooter from local law enforcement authorities due to concerns about the reliability" of his working phone, according to the document.

At the time of this attack, the US had intelligence information about an Iranian plan to assassinate Trump. The Iranian regime has a history of resorting to cyberattacks to aid in its assassination and kidnapping attempts.

Cell phone network problems hampered security during the rally in Butler, where the shooter, Thomas Crooks, managed to fly a drone to map the area without being detected and climb onto the roof of a nearby building carrying a rifle, despite being spotted by local security officials minutes before he opened fire.

While some Secret Service agents and local police officers relied on small group chats on their cell phones to relay information that day, others used radio channels and two separate command posts.

According to several reports from the Department of Homeland Security and Congress, failures related to the use of cell phones by agents contributed significantly to the failures that occurred that day.

The lack of cell phone signal in the rural area where the rally was held also delayed the use of anti-drone technology that could have located Crooks' drone - and the shooter himself - hours before the shooting.

Since then, the agency has made mobile cell phone coverage available to agents during events of this type.

Improvements Have Been Implemented, Secret Service Says
In response to the inspector general's draft report, the Secret Service reported that it had met - or was in the process of meeting - the security recommendations made by the oversight agency.

The agency has implemented "several comprehensive improvements to the Secret Service's communications policies and protocols, both to mitigate the potential for adversaries to intercept and exploit agency information and to further strengthen the protective environment," said director Sean Curran.

The Secret Service declined to comment on the findings, referring CNN to Curran's letter included in the inspector general's report.

The agency manages about 8,000 mobile devices that provide access to sensitive systems and applications - such as one that provides agents with information about emergency relocation locations -, the report said.

The risk that hacking a government phone could lead to murder is not hypothetical.

A Mexican drug cartel hired a hacker to monitor the movements of a senior FBI official in Mexico City in 2018 or earlier, collecting information from the city's camera system that allowed the cartel to kill potential FBI informants, according to a Justice Department inspector general report released last year.

The new Secret Service document cited this example.

"Until the Secret Service improves security controls for mobile devices used abroad, sensitive information on employee devices and communications with those under protection will be exposed to similar risks," he said.

Remember other attacks against Donald Trump

Source: CNN