My data was hacked, and I'm mad as hell.

As anyone who reads Ars no doubt knows by now, the federal Office of Personnel Management (OPM) has been hacked hard—losing data on some 21.5 million people. The agency's director just resigned over the situation. But exactly why does the hack matter? What was exposed, and how sensitive was that information?

OPM is sort of (but not quite) like the government's human resources department. Most federal workers probably know OPM as the agency that tells them whether or not they've got a snow day. But OPM also handles background checks for sensitive positions, and this motherlode of data is now in the hands of whichever adversary broke in and stole it.

From 2009 until the beginning of June this year, I worked as a policy analyst at the National Institutes of Health. That position required a Public Trust clearance. This is defined on NIH's website as "those positions which require a high degree of integrity with public confidence in the individual occupying the position."

During the application process, I filled out form SF-85P. This required the usual stuff you'd expect: my name and address, date of birth, and social security number. But it also included:

Height

Weight

Hair color

Eye color

My citizenship status

Everywhere I'd lived during the previous seven years

The names of people who knew me at each of those addresses

Anywhere I went to school in the previous seven years

Every job I'd had in the previous seven years

The names, addresses, and phone numbers of three people who knew me well

My wife's name, address, social security number, date of birth, place of birth, the date we got married, and her citizenship status

My parents' names, addresses, places of birth, and citizenships

Every foreign trip I made in the previous seven years

My police record (if I had one)

Financial information

A knock at the door

Several months after I started working at NIH, a nice man knocked on the door to my office, introduced himself as an agent (or maybe a special agent, I can't quite remember) and spent the next 45 minutes asking me lots of questions about my background and about my answers on SF-85P and whether I knew anyone who worked for foreign governments.

I did know people in other governments, and the agent asked if they had ever asked me to obtain documents for them (they hadn't) and what I would say if they asked (no). He made lots of notes, we chatted about the lack of good BBQ in the DC area (that was true at the time, but now there's an excellent joint in my neighborhood ), and I heard no more about it for another few months until an e-mail arrived congratulating me for being someone the public could trust to do my job with integrity.

I took that seriously. I was working as a civil servant and often thought about my responsibility to the people that paid my salary—that's anyone who pays their taxes in the US. It meant doing the best job I could, not wasting resources, and being cognizant of the need for security when it came to sensitive information.

Sadly, people who ought to have had a similar attitude towards their jobs over at OPM didn't.

A June 4 e-mail blast from OPM announced the hack to those affected by it but felt grossly insufficient. The e-mail, from Acting Deputy Secretary Mary K. Wakefield, offered me... credit monitoring for 18 months. Big whoop.

It ended with this lovely reassurance:

Following this incident, OPM took immediate action to implement additional security measures in order to protect the sensitive personnel data it manages. I would like to take the opportunity to remind you of the seriousness of cyber threats and of the importance of vigilance in protecting our systems and data.

Thanks, guys.

It's really, really bad

Now, all of that personal information is in the hands of "the Adversary." Does that mean China? Russia? Is it now being sold on some darknet bazaar to whichever identity thief wants it? Who knows.

What makes all of this so, so much worse is that the data the Adversary got about me is chickenfeed compared to that found in the SF-86 forms (and investigations) of people whose national security jobs involve classified, secret, top secret, or compartmented information. The point of those investigations is to give the government anything that could be used to blackmail someone into treasonous activity. Not to mention their fingerprints.

Now the Adversary has it.

This data isn't mere credit card numbers that can be altered and reissued with minimal pain. It's our lives—histories, relationships, personal appearance, drug use, educational background, and much more—even biometrics. They can't be altered and reissued, and a few months of credit monitoring will do little to protect victims from those determined enough to pull off the heist in the first place.