Watchdog: Treasury’s intelligence network open to hackers

A Treasury Department network used by U.S. spies to swap confidential information on foreign countries and militant groups could be vulnerable to cyberattacks, according to a government audit prepared in late 2014.

Investigators found that up to 29 percent of devices connected to the Treasury Foreign Intelligence Network did not adhere to federal cybersecurity guidelines. 

{mosads}Reuters obtained the document through a Freedom of Information Act request.

“Devices may not be protected with the most secure recommended configurations, increasing the risk of being compromised,” the inspector general said.

There was no evidence, however, that hackers had exploited the vulnerabilities, according to the report.

Treasury on Thursday said it had fixed the flaw. 

“The inspector general’s 2014 audit identified a minor issue on a very secure system,” an official said in a statement. “Since the release of the audit, Treasury has remedied this matter.”

Agencies’ network security has come under a bright spotlight in the wake of devastating breaches at the Office of Personnel Management (OPM). Two separate intrusions at the agency laid bare more than 22 million people’s sensitive data.

The watchdog audit revealed Thursday adds to the mounting evidence that the OPM is not the only agency with lacking cyber defenses.

The Treasury’s intelligence network has been a valuable tracking and communications tool for the government for over a decade.

Intelligence officials use the system to suss out foreign threats to the U.S. economy, often from militant groups such as Hezbollah. It also monitors sanctions the U.S. has imposed on countries like Iran and Russia.

The Obama administration recently agreed to a deal with Iran that would lift some of the country’s economic sanctions in exchange for reductions in Tehran’s nuclear weapons program.

According to the report, Treasury’s intelligence officials agreed with the findings and had put a plan in place to eradicate the security shortcomings by April 2015.

— Updated 6:53 p.m.