Category Archives: China aggression

Cyber-attack on Power Grid Paralysis

Posted on by

Cyber Attacks on the Power Grid: The Specter of Total Paralysis

Posted in General Security, Hacking, Incident Response on July 27, 2015

The Incidents

Imagine that one day you wake up and trading is halted on the New York Stock Exchange (NYSE) floor; meanwhile systems at United Airlines and the Wall Street Journal newspaper appear out of order.

It is not a scene from a movie; it happened on July 8, when trading at the NYSE stopped around 11:30 a.m. ET.

According the media, the temporary interruption of the services mentioned was a fateful coincidence and the events are unrelated, but the incidents have raised once again the question of the real security of critical infrastructure.

White House spokesperson Josh Earnest confirmed that the incidents weren’t caused by cyber-attacks. President Obama had briefed on the glitch at NYSE by White House counterterrorism and Homeland Security adviser Lisa Monaco as well as Chief Of Staff Denis McDonough.

“It appears from what we know at this stage that the malfunctions at United and at the stock exchange were not the result of any nefarious actor,” said Department of Homeland Security Secretary Jeh Johnson. “We know less about the Wall Street Journal at this point except that their system is back up again as is the United Airline system.”

Which is the impact of a cyber-attack on a critical infrastructure? Are critical infrastructure actually secure?

A major attack on a critical infrastructure like a power grid would cause chaos in the country by interrupting vital services for the population.

The current scenario

The Stock Exchange, transportation, and media are critical to the infrastructure of a country. A contemporary failure of these systems could cause serious problems to the nation, especially when the incident is caused by a cyber-attack.

“I think the Wall Street Journal piece is connected to people flooding their web site in response to the New York Exchange to find out what’s going on.” FBI Director James Comey told the Senate Intelligence committee. “In my business we don’t love coincidences, but it does appear that there is not a cyber-intrusion involved.”

Sen. Bill Nelson, D-FL, the top Democrat on the cyber-security subcommittee, told Fox News that the NYSE incident has “the appearance” of a cyber-attack and noted the coordination of multiple sites.

Thus far, the temporary outage at the New York Stock Exchange, United Airlines and the Wall Street Journal’s website were the results of tech glitches, but we have to consider the US infrastructure remains vulnerable to cyber-attacks that would cause serious problems and would be costly.

To compound the scenario, there is the rapid increase in the number of cyber-attacks, at least of those we fail to detect, and its complexity.

The DHS’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) has issued its new ICS-CERT MONITOR report related to the period September 2014 – February 2015. The ICS-CERT MONITOR report

According to the report, the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) received and responded to 245 incidents in Fiscal Year 2014, more than half of the incidents reported by asset owners and industry partners involved sophisticated APT. ICS/SCADA system were also targeted by other categories of threat actors, including cyber criminals, insider threats and hacktivists.

“Of the total number of incidents reported to ICS-CERT, roughly 55 percent involved advanced persistent threats (APT) or sophisticated actors. Other actor types included hacktivists, insider threats, and criminals. In many cases, the threat actors were unknown due to a lack of attributional data.” states the report.

Analyzing incidents reported by sector, it is possible to note that the majority of the attacks involved entities in the Energy Sector followed by Critical Manufacturing. About 30 percent of the incidents hit infrastructures in the energy sector, meanwhile Critical Manufacturing (i.e. manufacturing of vehicles and aviation and aerospace components) accounted for 27 percent.

The threat actors used a significant number of zero-day vulnerabilities to compromise industrial control systems through the exploitation of web application flaws.

The most common flaws exploited by attackers include authentication, buffer overflow, and denial-of-service . Noteworthy among ICS-CERT’s activities included the multi-vendor coordination that was conducted for the ”

“Noteworthy among ICS-CERT’s activities included the multi-vendor coordination that was conducted for the “Heartbleed” OpenSSL vulnerability. The team worked with the ICS vendor community to release multiple advisories, in addition to conducting briefings and webinars in an effort to raise awareness of the vulnerability and the mitigation strategies for preventing exploitation” states the ICS-CERT report to explain the coordination activities sustained by the agency to address principal vulnerabilities.

The ICS-CERT MONITOR report confirmed that the attackers used a vast range of methods for attempting to compromise control systems infrastructure, including:

Figure 1 – ICS -CERT Attack Methods

Unfortunately, it is quite difficult to attribute an incident to a specific threat actor. In the majority of cases, these offensives have gone under the radar over the years due to high level of sophistication of the Tactics, Techniques, and Procedures (TTPs).

The victims were not able to identify the threat actors. Neither the attack vector exploited by hackers for 38 percent of the reported incidents,

“Many more incidents occur in critical infrastructure that go unreported,” states the ICS-CERT MONITOR report. “Forensic evidence did not point to a method used for intrusion because of a lack of detection and monitoring capabilities within the compromised network”.

US power grid vulnerable to cyber attacks

The US power grid is a privileged target for various categories of attackers, terrorists, cyber criminals, and state-sponsored hackers. Daily, they threaten the backbone of the American society. Security experts and US politicians are aware that the national power grid is vulnerable to a terrorist attack.

“It’s possible; and whether it’s likely to happen soon remains to be seen,” explained by the former Secretary of Defense William Cohen“ on “The Steve Malzberg Show.”

Attackers have several options to hit a power grid, from a cyber-attack on SCADA systems to an EMP attack, according to Cohen.

“You can do it through cyber-attacks, and that’s the real threat coming up as well. We have to look at cyber-attacks being able to shut down our power grid, which you have to remember is in the private sector’s hands, not the government’s. And we’re vulnerable,” Cohen added. “It’s possible and whether it’s likely to happen soon remains to be seen.”

“That’s because the technology continues to expand and terrorism has become democratized. Many, many people across the globe now have access to information that allows them to be able to put together a very destructive means of carrying out their terrorist plans. We’re better at detecting than we were in the past. We’re much more focused in integrating and sharing the information that we have, but we’re still vulnerable and we’ll continue to be vulnerable as long as groups can operate either on the margins or covertly to build these kind of campaigns of terror.” said Cohen.

Former Department of Homeland Security Secretary Janet Napolitano shared Cohen’s concerns. A major cyber-attack the power grid was a matter of “when,” not “if.”

State-sponsored hackers, cyber terrorists are the main threat actors, but as confirmed by a recent research conducted by TrendMicro, also the cybercrime represents a serious menace.

Former senior CIA analyst and EMP Task Force On National Homeland Security Director, Dr. Peter Vincent Pry, told Newsmax TV that that a cyber attack against the power grid could cause serious destruction and loss of life.

Not only US power grid are under attack. In January 2015, the British Parliament revealed that UK Power Grid is under cyber-attack from foreign hackers, but the emergency is for critical infrastructure worldwide.\

Figure 2 – SCADA control room

Arbuthnot confirmed the incessant attacks on national critical infrastructure and he doesn’t exclude a major incident, despite the enormous effort spent at the National Grid.

“Our National Grid is coming under cyber-attack not just day-by-day but minute-by-minute,” Arbuthnot, whose committee scrutinized the country’s security policy, told a conference in London last year. “There are, at National Grid, people of very high quality who recognize the risks that these attacks pose, and who are fighting them off,” he said, “but we can’t expect them to win forever.”

The power grid is a vital system for our society and the cyber strategy of every government must consider its protection a high priority, a terror attack would leave entire countries sitting in the dark.

A hypothetical attack scenario and estimation of the losses

What will happen in case of a cyber-attack on a critical infrastructure in the US? Which is the economic impact of a cyber-attack against a power grid?

According to a poll conducted by researchers at the Morning Consult firm from May 29 to May 31, cyber-attacks are just behind terrorism attacks on the list of biggest threats to US. The research allowed the experts to estimate that the insurance industry could face losses of about $21 billion. That poll was conducted by interviewing a national sample of 2,173 registered voters.

Nearly 36 percent of voters consider acts of terrorism at the top of a list of major security threats, followed by cyber-attacks at 32 percent.

Figure 3- Morning Consult firm poll results

The Lloyd’s of London has conducted a very interesting study, Business Blackout, that describes the impacts of a cyber-attack on the national power grid.

It is the first time that the insurance industry has elaborated on a similar report. Obviously, the estimates provided are merely indicative due to the large number of factors that can influence the costs.

According to the report prepared by Lloyd’s of London in a joint effort with the University of Cambridge’s Centre for Risk Studies, cyber-attacks would have a catastrophic impact on multiple types of insurance.

The attack scenario described by Business Blackout illustrates the effects of a malware-based attack on systems that controls the national power grid. The attack causes an electrical blackout that plunges 15 US states and principal cities, including New York City and Washington DC, into darkness. Nearly 93 million people will remain without power in the scenario hypothesized by the study.

The attackers spread the ‘Erebos’ Trojan through the network with the effect of compromising the electricity generation control rooms in several locations in the Northeastern United States.

According to the researchers, the attack will cause health and safety systems to fail, disrupting water supplies as electric pumps fail. The chaos will reign causing the failure of main services, including transportation. The malware is able to infect the Internet and search and compromise 50 generators that it will destroy, causing prolonged outages in the region.

The total of claims paid by the insurance industry has been estimated to be included in the interval comprised between $21.4b and $71.1b, depending on the evolution of the scenarios designed by the researchers.

The researchers involved in the simulation have calculated the economic losses could range from $243 million to $1 trillion, depending on the number of components in the power grid compromised by the attack.

“Economic impacts include direct damage to assets and infrastructure, decline in sales revenue to electricity supply companies, loss of sales revenue to business and disruption to the supply chain. The total impact to the US economy is estimated at $243bn, rising to more than $1trn in the most extreme version of the scenario.” states the report.

The experts analyzed the historical outages, estimating that currently the power interruptions, most of which last five minutes or less, already cost the US about $96 billion. The cost related to a prolonged outage is likely to be included in the range of $36 billion to $156 billion. The Commercial and industrial sectors are the sectors most impacted by the attack on the power grid due to their dependency on the electricity supply.

“Evidence from historical outages and indicative modelling suggests that power interruptions already cost the US economy roughly $96bn8 annually.9 However, uncertainty and sensitivity analysis suggest this figure may range from $36b to $156b.” continues the report. “Currently over 95% of outage costs are borne by the commercial and industrial sectors due to the high dependence on electricity as an input factor of production.”

As explained in the report, it is important to identify the risks related to a possible cyber-attack and adopt all the necessary measures to mitigate them. The protection of critical infrastructure like a power grid is an essential part of the cyber strategy of any Government.

Advances and Secret Information on Hacking of Classified Systems

Posted on by

Hacking never has the sizzle when it comes to terror or scandals, yet it is the cheapest and most effective means of destruction.

So, below are some items you cannot overlook.

A few weeks ago, the unclassified email and information system at the Pentagon, mostly used by the Joint Chiefs of Staff was taken offline due to suspicious malware activity. That system is back online as of this week after all clues pointed to the hack by Russians which led to up to 4000 Pentagon employees losing access to email.

***

Then it has been determined the Chinese have accessed top government officials private emails since 2010.

Chinese hackers have been accessing the private mails of some top United States officials since April of 2010, which coincides with Hillary Clinton’s tenure as secretary of state and her decision to use a private email server, Morning Joe’s Willie Geist reported Tuesday.

“The email grab, first code-named Dancing Panda, targeted top national security and trade officials,” Geist said. “It continued as late as 2014. The timing does overlap with Hillary Clinton’s time as secretary of state and her use of a private email server.”

“Many” top officials have been hacked, according to a high-level intelligence source and a top-secret document obtained by NBC News.

***

Now comes a global network of hacking and their successful and criminal activities.

Exposing a new front in cybercrime, U.S. authorities broke up an alleged insider trading ring that relied on computer hackers to pilfer corporate press announcements and then profited by trading on the sensitive information before it became public.

In morning raids in Georgia and Pennsylvania, federal agents arrested five men in the plot, while four others indicted on hacking and securities fraud charges remain at large.

The hackers, who are thought to be in Ukraine and possibly Russia, allegedly infiltrated the computer servers of PRNewswire Association LLC, Marketwired and Business Wire, a unit of Warren Buffett’s Berkshire Hathaway Inc., over a five-year period.

They siphoned more than 100,000 press releases including corporate data on earnings that could be used to anticipate stock market moves and make profitable trades. The hackers passed the information to associates in the U.S., who allegedly used it to buy and sell shares of dozens of companies, including Panera Bread Co., Boeing Co., Hewlett-Packard Co., Caterpillar Inc. and Oracle Corp., through retail brokerage accounts. A must read for the rest of the details is here.

***

Most chilling of all is the forward leaning and creative uses of drones.

LAS VEGAS, Nev. – Forget Facebook drones that broadcast Wifi. The future is drones that hack from above. A company called Aerial Assault has turned a quadcopter into a flying hacker that scans the world below for insecure devices and vulnerable Wifi ports. Its makers say they built the tool for penetration testing — to help “good guys” diagnose their own weaknesses — but they concede that with a bit of modification, it could be used to exploit those vulnerabilities and install malware from the air. This is why it’s paramount to get your I.T. network looked at by a penetration testing company, you may think this is a scary thing for your company to undergo however, it will actually prevent people (hackers) from stealing your companies information as all of the weak spots would of been identified and then rectified.

The unnamed drone, which may be the first unmanned aerial penetration tool for sale to the public, was on display at the DEF CON hacker conference here last week. It uses a small Raspberry Pi computer running the Kali Linux penetration tester software with the broadcast range extended by alpha radio antennas. It will retail for $2,500 when the Web site goes up in a few days, its makers say.

“We’ve set it up so it does some basic [penetration] testing stuff and coordinates all that data with GPS coordinates from the flight controller. From that, you can extend it with every type of capability that you want Kali Linux to do,” said David Jordan, a representative from Aerial Assault who was selling it on the floor at the DEF CON conference in Las Vegas, Nevada on Sunday.

While the drone isn’t specifically designed to distribute malware, Jordan acknowledged it could be modified to do so. “It is up to the user to decide what they do with it. If the user, they have Raspberry Pi with Kali on it, they can reprogram custom scripts. That’s good for doing more extensive [penetration] testing. But, you know, scripts can be whatever they are,” he said. “Our intended use is for pentesters to be able to diagnose vulnerabilities and help people understand what their Wifi accessibility is, even up in the air.”

 

Every U.S. Corporation Hacked by China

Posted on by

From the Former NSA Director McConnell via CNN:

“The Chinese have penetrated every major corporation of any consequence in the United States and taken information,” he said. “We’ve never, ever not found Chinese malware.”
He said the malware lets Chinese spies extract information whenever they want. McConnell, who also led the NSA from 1992 until 1996, continues to investigate hacks as a high-ranking adviser to Booz Allen Hamilton (BAH).
He listed victims he has come across during his investigations: U.S. Congress, Department of Defense, State Department (which is currently dealing with Russian hackers) and major corporations.
The U.S. government has said it has caught Chinese spies stealing blueprints and business plans. Last year, federal prosecutors took the unprecedented step of filing formal criminal charges against five Chinese government spies for breaking into Alcoa (AA), U.S. Steel Corp. (X), Westinghouse and others.

Exclusive: Secret NSA Map Shows China Cyber Attacks on U.S. Targets

A secret NSA map obtained exclusively by NBC News shows the Chinese government‘s massive cyber assault on all sectors of the U.S economy, including major firms like Google and Lockheed Martin, as well as the U.S. government and military.

The map uses red dots to mark more than 600 corporate, private or government “Victims of Chinese Cyber Espionage” that were attacked over a five-year period, with clusters in America’s industrial centers. The entire Northeast Corridor from Washington to Boston is blanketed in red, as is California’s Silicon Valley, with other concentrations in Dallas, Miami, Chicago, Seattle, L.A. and Detroit. The highest number of attacks was in California, which had almost 50.

Each dot represents a successful Chinese attempt to steal corporate and military secrets and data about America’s critical infrastructure, particularly the electrical power and telecommunications and internet backbone. And the prizes that China pilfered during its “intrusions” included everything from specifications for hybrid cars to formulas for pharmaceutical products to details about U.S. military and civilian air traffic control systems, according to intelligence sources.

The map was part of an NSA briefing prepared by the NSA Threat Operations Center (NTOC) in February 2014, an intelligence source told NBC News. The briefing highlighted China’s interest in Google and defense contractors like Lockheed Martin, and in air traffic control systems. It catalogued the documents and data Chinese government hackers have “exfiltrated” — stolen — from U.S. corporate, government and military networks, and also listed the number and origin of China’s “exploitations and attacks.”

The map suggests that NSA has been able to monitor and assess the Chinese cyber espionage operations, and knows which specific companies, government agencies and computer networks are being targeted.

The NSA did not immediately respond to repeated requests for comment.

 

 

The China Hack of United Airlines, Electronic Insurgency

Posted on by

Warning corporations, industry and government entities is one thing, action and protection and or declaration of a cyber war is yet another.

July 2015:

Aspen Institute: Cyber warfare is one of the most potent security threats the United States faces, National Security Agency Director and Commander of the US Cyber Command General Keith Alexander told the crowd at the Aspen Security Forum in Aspen, discussing in conversation with NBC News Correspondent Pete Williams the nature of the threat and how his department is working to address it.
With the Stuxnet, Duqu, and Flame viruses in the fore of the public consciousness, Alexander took pains to point out that nation-states were not the only potential cyber actors. Citing power and water grids as his chief concerns, he said, “Somebody who finds vulnerability in our infrastructure could cause tremendous problems. They could erase the Input/output of a system so it can’t boot, and would have to be replaced. And these capabilities are not only nation-state-only capabilities.”

Alexander assessed the US’ readiness to confront such an attack as a three on a scale of ten, calling lack of adequately trained cyber defense forces the critical impediment to greater preparedness. “Our issue isn’t [having the tools] to address the threat,” he said. “It’s having the capacity, and building and training cyber forces. We have a big requirement, and a small force that is growing steadily.”

China-Tied Hackers That Hit U.S. Said to Breach United Airlines

Bloomberg:

The hackers who stole data on tens of millions of U.S. insurance holders and government employees in recent months breached another big target at around the same time — United Airlines.

United, the world’s second-largest airline, detected an incursion into its computer systems in May or early June, said several people familiar with the probe. According to three of these people, investigators working with the carrier have linked the attack to a group of China-backed hackers they say are behind several other large heists — including the theft of security-clearance records from the U.S. Office of Personnel Management and medical data from health insurer Anthem Inc.

The previously unreported United breach raises the possibility that the hackers now have data on the movements of millions of Americans, adding airlines to a growing list of strategic U.S. industries and institutions that have been compromised. Among the cache of data stolen from United are manifests — which include information on flights’ passengers, origins and destinations — according to one person familiar with the carrier’s investigation.

 

It’s increasingly clear, security experts say, that China’s intelligence apparatus is amassing a vast database. Files stolen from the federal personnel office by this one China-based group could allow the hackers to identify Americans who work in defense and intelligence, including those on the payrolls of contractors. U.S. officials believe the group has links to the Chinese government, people familiar with the matter have said.

That data could be cross-referenced with stolen medical and financial records, revealing possible avenues for blackmailing or recruiting people who have security clearances. In all, the China-backed team has hacked at least 10 companies and organizations, which include other travel providers and health insurers, says security firm FireEye Inc.

Tracking Travelers

The theft of airline records potentially offers another layer of information that would allow China to chart the travel patterns of specific government or military officials.

United is one of the biggest contractors with the U.S. government among the airlines, making it a rich depository of data on the travel of American officials, military personnel and contractors. The hackers could match international flights by Chinese officials or industrialists with trips taken by U.S. personnel to the same cities at the same time, said James Lewis, a senior fellow in cybersecurity at the Center for Strategic and International Studies in Washington.

“You’re suspicious of some guy; you happen to notice that he flew to Papua New Guinea on June 23 and now you can see that the Americans have flown there on June 22 or 23,” Lewis said. “If you’re China, you’re looking for those things that will give you a better picture of what the other side is up to.”

Computer Glitches

The timing of the United breach also raises questions about whether it’s linked to computer faults that stranded thousands of the airline’s passengers in two incidents over the past couple of months. Two additional people close to the probe, who like the others asked not to be identified when discussing the investigation, say the carrier has found no connection between the hack and a July 8 systems failure that halted flights for two hours. They didn’t rule out a possible, tangential connection to an outage on June 2.

Luke Punzenberger, a spokesman for Chicago-based United, a unit of United Continental Holdings Inc., declined to comment on the breach investigation.

Zhu Haiquan, a spokesman for the Chinese embassy in Washington, said in a statement: “The Chinese government and the personnel in its institutions never engage in any form of cyberattack. We firmly oppose and combat any forms of cyberattacks.”

Embedded Names

United may have gotten help identifying the breach from U.S. investigators working on the OPM hack. The China-backed hackers that cybersecurity experts have linked to that attack have embedded the name of targets in web domains, phishing e-mails and other attack infrastructure, according to one of the people familiar with the investigation.

In May, the OPM investigators began drawing up a list of possible victims in the private sector and provided the companies with digital signatures that would indicate their systems had been breached. United Airlines was on that list.

Safety Concerns

In contrast to the theft of health records or financial data, the breach of airlines raises concerns of schedule disruptions or transportation gridlock. Mistakes by hackers or defenders could bring down sensitive systems that control the movement of millions of passengers annually in the U.S. and internationally.

Even if their main goal was data theft, state-sponsored hackers might seek to preserve access to airline computers for later use in more disruptive attacks, according to security experts. One of the chief tasks of the investigators in the United breach is ensuring that the hackers have no hidden backdoors that could be used to re-enter the carrier’s computer systems later, one of the people familiar with the probe said.

United spokesman Punzenberger said the company remains “vigilant in protecting against unauthorized access” and is focused on protecting its customers’ personal information.

There is evidence the hackers were in the carrier’s network for months. One web domain apparently set up for the attack — UNITED-AIRLINES.NET — was established in April 2014. The domain was registered by a James Rhodes, who provided an address in American Samoa.

James Rhodes is also the alias of the character War Machine in Marvel Comics’ Iron Man. Security companies tracking the OPM hackers say they often use Marvel comic book references as a way to “sign” their attack.

Targeting Pentagon

This isn’t the first time such an attack has been documented. Chinese military hackers have repeatedly targeted the U.S. Transportation Command, the Pentagon agency that coordinates defense logistics and travel.

A report last year from the Senate Armed Services Committee documented at least 50 successful hacks of the command’s contractors from June 2012 through May 2013. Hacks against the agency’s contractors have led to the theft of flight plans, shipping routes and other data from organizations working with the military, according to the report.

“The Chinese have been trying to get flight information from the government; now it looks as if they’re trying to do the same in the commercial sector,” said Tony Lawrence, a former Army sergeant and founder and chief executive officer of VOR Technology, a Columbia, Maryland-based cybersecurity firm.

It’s unclear whether United is considering notifying customers that data may have been compromised. Punzenberger said United “would abide by notification requirements if a situation warranted” it.

The airline is still trying to determine exactly which data was removed from the network, said two of the people familiar with the probe. That assessment took months in the OPM case, which was discovered in April and made public in June.

M&A Strategy

Besides passenger lists and other flight-related data, the hackers may also have taken information related to United’s mergers and acquisitions strategy, one of the people familiar with the investigation said.

Flight manifests usually contain the names and birthdates of passengers, but even if those files were taken, experts say that would be unlikely to trigger disclosure requirements in any of the 47 states with breach-notification laws.

Those disclosure laws are widely seen as outdated. The theft by hackers of corporate secrets usually goes unreported, while the stealing of customer records such as Social Security numbers and credit cards is required in most states.

“In most states, this is not going to trigger a notification,” said Srini Subramanian, state government leader for Deloitte cyber risk services.

WH: Census to Home Surveys to HUD to Massive Database

Posted on by

In 2013, Congresswoman Maxine Waters appeared on television and spilled the secret.

Did you ever wonder exactly why the White House took control of the U.S. Census in 2010 from the Commerce Secretary? It was a multi-tracked mission that not only included future Gerrymandering efforts, but it was for data-mining housing, and to all patterns of personal life across the country.

The Wall Street Journal reports that the Chinese have hacked databases and has personal data.

It was just a few weeks ago that Housing and Urban Development announced a scheme to racially diversify neighborhoods across the country. Zipcodes appear to be racist and the White House with HUD is working to change that.

So understand these efforts, in 2013 the profiles of cities began where fact sheets have been created.

A sample of what they are tracking is found here.

Screen shot 2015-07-18 at 6.07.54 PM

 

 

 

So, when the NY Post publishes this by Paul Sperry, one must take real notice. We have a pattern here.

Obama collecting personal data for a secret race database

A key part of President Obama’s legacy will be the fed’s unprecedented collection of sensitive data on Americans by race. The government is prying into our most personal information at the most local levels, all for the purpose of “racial and economic justice.”

Unbeknown to most Americans, Obama’s racial bean counters are furiously mining data on their health, home loans, credit cards, places of work, neighborhoods, even how their kids are disciplined in school — all to document “inequalities” between minorities and whites.

This Orwellian-style stockpile of statistics includes a vast and permanent network of discrimination databases, which Obama already is using to make “disparate impact” cases against: banks that don’t make enough prime loans to minorities; schools that suspend too many blacks; cities that don’t offer enough Section 8 and other low-income housing for minorities; and employers who turn down African-Americans for jobs due to criminal backgrounds.

Big Brother Barack wants the databases operational before he leaves office, and much of the data in them will be posted online.

So civil-rights attorneys and urban activist groups will be able to exploit them to show patterns of “racial disparities” and “segregation,” even if no other evidence of discrimination exists.

Obama is presiding over the largest consolidation of personal data in US history.

Housing database

The granddaddy of them all is the Affirmatively Furthering Fair Housing database, which the Department of Housing and Urban Development rolled out earlier this month to racially balance the nation, ZIP code by ZIP code. It will map every US neighborhood by four racial groups — white, Asian, black or African-American, and Hispanic/Latino — and publish “geospatial data” pinpointing racial imbalances.

The agency proposes using nonwhite populations of 50% or higher as the threshold for classifying segregated areas.

Federally funded cities deemed overly segregated will be pressured to change their zoning laws to allow construction of more subsidized housing in affluent areas in the suburbs, and relocate inner-city minorities to those predominantly white areas. HUD’s maps, which use dots to show the racial distribution or density in residential areas, will be used to select affordable-housing sites.

HUD plans to drill down to an even more granular level, detailing the proximity of black residents to transportation sites, good schools, parks and even supermarkets. If the agency’s social engineers rule the distance between blacks and these suburban “amenities” is too far, municipalities must find ways to close the gap or forfeit federal grant money and face possible lawsuits for housing discrimination.

Civil-rights groups will have access to the agency’s sophisticated mapping software, and will participate in city plans to re-engineer neighborhoods under new community outreach requirements.

“By opening this data to everybody, everyone in a community can weigh in,” Obama said. “If you want affordable housing nearby, now you’ll have the data you need to make your case.”

Mortgage database

Meanwhile, the Federal Housing Finance Agency, headed by former Congressional Black Caucus leader Mel Watt, is building its own database for racially balancing home loans. The so-called National Mortgage Database Project will compile 16 years of lending data, broken down by race, and hold everything from individual credit scores and employment records.

Mortgage contracts won’t be the only financial records vacuumed up by the database. According to federal documents, the repository will include “all credit lines,” from credit cards to student loans to car loans — anything reported to credit bureaus. This is even more information than the IRS collects.

The FHFA will also pry into your personal assets and debts and whether you have any bankruptcies. The agency even wants to know the square footage and lot size of your home, as well as your interest rate.

FHFA will share the info with Obama’s brainchild, the Consumer Financial Protection Bureau, which acts more like a civil-rights agency, aggressively investigating lenders for racial bias.

The FHFA has offered no clear explanation as to why the government wants to sweep up so much sensitive information on Americans, other than stating it’s for “research” and “policymaking.”

However, CFPB Director Richard Cordray was more forthcoming, explaining in a recent talk to the radical California-based Greenlining Institute: “We will be better able to identify possible discriminatory lending patterns.”

Credit database

CFPB is separately amassing a database to monitor ordinary citizens’ credit-card transactions. It hopes to vacuum up some 900 million credit-card accounts — all sorted by race — representing roughly 85% of the US credit-card market. Why? To sniff out “disparities” in interest rates, charge-offs and collections.

Employment database

CFPB also just finalized a rule requiring all regulated banks to report data on minority hiring to an Office of Minority and Women Inclusion. It will collect reams of employment data, broken down by race, to police diversity on Wall Street as part of yet another fishing expedition.

School database

Through its mandatory Civil Rights Data Collection project, the Education Department is gathering information on student suspensions and expulsions, by race, from every public school district in the country. Districts that show disparities in discipline will be targeted for reform.

Those that don’t comply will be punished. Several already have been forced to revise their discipline policies, which has led to violent disruptions in classrooms.

Obama’s educrats want to know how many blacks versus whites are enrolled in gifted-and-talented and advanced placement classes.

Schools that show blacks and Latinos under-enrolled in such curricula, to an undefined “statistically significant degree,” could open themselves up to investigation and lawsuits by the department’s Civil Rights Office.

Count on a flood of private lawsuits to piggyback federal discrimination claims, as civil-rights lawyers use the new federal discipline data in their legal strategies against the supposedly racist US school system.

Even if no one has complained about discrimination, even if there is no other evidence of racism, the numbers themselves will “prove” that things are unfair.

Such databases have never before existed. Obama is presiding over the largest consolidation of personal data in US history. He is creating a diversity police state where government race cops and civil-rights lawyers will micromanage demographic outcomes in virtually every aspect of society.

The first black president, quite brilliantly, has built a quasi-reparations infrastructure perpetually fed by racial data that will outlast his administration.

Paul Sperry is a Hoover Institution media fellow and author of “The Great American Bank Robbery,” which exposes the racial politics behind the mortgage bust.