Category Archives: NSA Spying

Cyber-attack on Power Grid Paralysis

Posted on by

Cyber Attacks on the Power Grid: The Specter of Total Paralysis

Posted in General Security, Hacking, Incident Response on July 27, 2015

The Incidents

Imagine that one day you wake up and trading is halted on the New York Stock Exchange (NYSE) floor; meanwhile systems at United Airlines and the Wall Street Journal newspaper appear out of order.

It is not a scene from a movie; it happened on July 8, when trading at the NYSE stopped around 11:30 a.m. ET.

According the media, the temporary interruption of the services mentioned was a fateful coincidence and the events are unrelated, but the incidents have raised once again the question of the real security of critical infrastructure.

White House spokesperson Josh Earnest confirmed that the incidents weren’t caused by cyber-attacks. President Obama had briefed on the glitch at NYSE by White House counterterrorism and Homeland Security adviser Lisa Monaco as well as Chief Of Staff Denis McDonough.

“It appears from what we know at this stage that the malfunctions at United and at the stock exchange were not the result of any nefarious actor,” said Department of Homeland Security Secretary Jeh Johnson. “We know less about the Wall Street Journal at this point except that their system is back up again as is the United Airline system.”

Which is the impact of a cyber-attack on a critical infrastructure? Are critical infrastructure actually secure?

A major attack on a critical infrastructure like a power grid would cause chaos in the country by interrupting vital services for the population.

The current scenario

The Stock Exchange, transportation, and media are critical to the infrastructure of a country. A contemporary failure of these systems could cause serious problems to the nation, especially when the incident is caused by a cyber-attack.

“I think the Wall Street Journal piece is connected to people flooding their web site in response to the New York Exchange to find out what’s going on.” FBI Director James Comey told the Senate Intelligence committee. “In my business we don’t love coincidences, but it does appear that there is not a cyber-intrusion involved.”

Sen. Bill Nelson, D-FL, the top Democrat on the cyber-security subcommittee, told Fox News that the NYSE incident has “the appearance” of a cyber-attack and noted the coordination of multiple sites.

Thus far, the temporary outage at the New York Stock Exchange, United Airlines and the Wall Street Journal’s website were the results of tech glitches, but we have to consider the US infrastructure remains vulnerable to cyber-attacks that would cause serious problems and would be costly.

To compound the scenario, there is the rapid increase in the number of cyber-attacks, at least of those we fail to detect, and its complexity.

The DHS’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) has issued its new ICS-CERT MONITOR report related to the period September 2014 – February 2015. The ICS-CERT MONITOR report

According to the report, the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) received and responded to 245 incidents in Fiscal Year 2014, more than half of the incidents reported by asset owners and industry partners involved sophisticated APT. ICS/SCADA system were also targeted by other categories of threat actors, including cyber criminals, insider threats and hacktivists.

“Of the total number of incidents reported to ICS-CERT, roughly 55 percent involved advanced persistent threats (APT) or sophisticated actors. Other actor types included hacktivists, insider threats, and criminals. In many cases, the threat actors were unknown due to a lack of attributional data.” states the report.

Analyzing incidents reported by sector, it is possible to note that the majority of the attacks involved entities in the Energy Sector followed by Critical Manufacturing. About 30 percent of the incidents hit infrastructures in the energy sector, meanwhile Critical Manufacturing (i.e. manufacturing of vehicles and aviation and aerospace components) accounted for 27 percent.

The threat actors used a significant number of zero-day vulnerabilities to compromise industrial control systems through the exploitation of web application flaws.

The most common flaws exploited by attackers include authentication, buffer overflow, and denial-of-service . Noteworthy among ICS-CERT’s activities included the multi-vendor coordination that was conducted for the ”

“Noteworthy among ICS-CERT’s activities included the multi-vendor coordination that was conducted for the “Heartbleed” OpenSSL vulnerability. The team worked with the ICS vendor community to release multiple advisories, in addition to conducting briefings and webinars in an effort to raise awareness of the vulnerability and the mitigation strategies for preventing exploitation” states the ICS-CERT report to explain the coordination activities sustained by the agency to address principal vulnerabilities.

The ICS-CERT MONITOR report confirmed that the attackers used a vast range of methods for attempting to compromise control systems infrastructure, including:

Figure 1 – ICS -CERT Attack Methods

Unfortunately, it is quite difficult to attribute an incident to a specific threat actor. In the majority of cases, these offensives have gone under the radar over the years due to high level of sophistication of the Tactics, Techniques, and Procedures (TTPs).

The victims were not able to identify the threat actors. Neither the attack vector exploited by hackers for 38 percent of the reported incidents,

“Many more incidents occur in critical infrastructure that go unreported,” states the ICS-CERT MONITOR report. “Forensic evidence did not point to a method used for intrusion because of a lack of detection and monitoring capabilities within the compromised network”.

US power grid vulnerable to cyber attacks

The US power grid is a privileged target for various categories of attackers, terrorists, cyber criminals, and state-sponsored hackers. Daily, they threaten the backbone of the American society. Security experts and US politicians are aware that the national power grid is vulnerable to a terrorist attack.

“It’s possible; and whether it’s likely to happen soon remains to be seen,” explained by the former Secretary of Defense William Cohen“ on “The Steve Malzberg Show.”

Attackers have several options to hit a power grid, from a cyber-attack on SCADA systems to an EMP attack, according to Cohen.

“You can do it through cyber-attacks, and that’s the real threat coming up as well. We have to look at cyber-attacks being able to shut down our power grid, which you have to remember is in the private sector’s hands, not the government’s. And we’re vulnerable,” Cohen added. “It’s possible and whether it’s likely to happen soon remains to be seen.”

“That’s because the technology continues to expand and terrorism has become democratized. Many, many people across the globe now have access to information that allows them to be able to put together a very destructive means of carrying out their terrorist plans. We’re better at detecting than we were in the past. We’re much more focused in integrating and sharing the information that we have, but we’re still vulnerable and we’ll continue to be vulnerable as long as groups can operate either on the margins or covertly to build these kind of campaigns of terror.” said Cohen.

Former Department of Homeland Security Secretary Janet Napolitano shared Cohen’s concerns. A major cyber-attack the power grid was a matter of “when,” not “if.”

State-sponsored hackers, cyber terrorists are the main threat actors, but as confirmed by a recent research conducted by TrendMicro, also the cybercrime represents a serious menace.

Former senior CIA analyst and EMP Task Force On National Homeland Security Director, Dr. Peter Vincent Pry, told Newsmax TV that that a cyber attack against the power grid could cause serious destruction and loss of life.

Not only US power grid are under attack. In January 2015, the British Parliament revealed that UK Power Grid is under cyber-attack from foreign hackers, but the emergency is for critical infrastructure worldwide.\

Figure 2 – SCADA control room

Arbuthnot confirmed the incessant attacks on national critical infrastructure and he doesn’t exclude a major incident, despite the enormous effort spent at the National Grid.

“Our National Grid is coming under cyber-attack not just day-by-day but minute-by-minute,” Arbuthnot, whose committee scrutinized the country’s security policy, told a conference in London last year. “There are, at National Grid, people of very high quality who recognize the risks that these attacks pose, and who are fighting them off,” he said, “but we can’t expect them to win forever.”

The power grid is a vital system for our society and the cyber strategy of every government must consider its protection a high priority, a terror attack would leave entire countries sitting in the dark.

A hypothetical attack scenario and estimation of the losses

What will happen in case of a cyber-attack on a critical infrastructure in the US? Which is the economic impact of a cyber-attack against a power grid?

According to a poll conducted by researchers at the Morning Consult firm from May 29 to May 31, cyber-attacks are just behind terrorism attacks on the list of biggest threats to US. The research allowed the experts to estimate that the insurance industry could face losses of about $21 billion. That poll was conducted by interviewing a national sample of 2,173 registered voters.

Nearly 36 percent of voters consider acts of terrorism at the top of a list of major security threats, followed by cyber-attacks at 32 percent.

Figure 3- Morning Consult firm poll results

The Lloyd’s of London has conducted a very interesting study, Business Blackout, that describes the impacts of a cyber-attack on the national power grid.

It is the first time that the insurance industry has elaborated on a similar report. Obviously, the estimates provided are merely indicative due to the large number of factors that can influence the costs.

According to the report prepared by Lloyd’s of London in a joint effort with the University of Cambridge’s Centre for Risk Studies, cyber-attacks would have a catastrophic impact on multiple types of insurance.

The attack scenario described by Business Blackout illustrates the effects of a malware-based attack on systems that controls the national power grid. The attack causes an electrical blackout that plunges 15 US states and principal cities, including New York City and Washington DC, into darkness. Nearly 93 million people will remain without power in the scenario hypothesized by the study.

The attackers spread the ‘Erebos’ Trojan through the network with the effect of compromising the electricity generation control rooms in several locations in the Northeastern United States.

According to the researchers, the attack will cause health and safety systems to fail, disrupting water supplies as electric pumps fail. The chaos will reign causing the failure of main services, including transportation. The malware is able to infect the Internet and search and compromise 50 generators that it will destroy, causing prolonged outages in the region.

The total of claims paid by the insurance industry has been estimated to be included in the interval comprised between $21.4b and $71.1b, depending on the evolution of the scenarios designed by the researchers.

The researchers involved in the simulation have calculated the economic losses could range from $243 million to $1 trillion, depending on the number of components in the power grid compromised by the attack.

“Economic impacts include direct damage to assets and infrastructure, decline in sales revenue to electricity supply companies, loss of sales revenue to business and disruption to the supply chain. The total impact to the US economy is estimated at $243bn, rising to more than $1trn in the most extreme version of the scenario.” states the report.

The experts analyzed the historical outages, estimating that currently the power interruptions, most of which last five minutes or less, already cost the US about $96 billion. The cost related to a prolonged outage is likely to be included in the range of $36 billion to $156 billion. The Commercial and industrial sectors are the sectors most impacted by the attack on the power grid due to their dependency on the electricity supply.

“Evidence from historical outages and indicative modelling suggests that power interruptions already cost the US economy roughly $96bn8 annually.9 However, uncertainty and sensitivity analysis suggest this figure may range from $36b to $156b.” continues the report. “Currently over 95% of outage costs are borne by the commercial and industrial sectors due to the high dependence on electricity as an input factor of production.”

As explained in the report, it is important to identify the risks related to a possible cyber-attack and adopt all the necessary measures to mitigate them. The protection of critical infrastructure like a power grid is an essential part of the cyber strategy of any Government.

Hillary Email Server Timeline and Facts

Posted on by

Like everyone else, tracking the pieces of this scandal takes imagination and could require a spreadsheet that includes names and dates. So, below will be some facts and dates and for sure could be amended as more developments are realized.

1. Bill Clinton had/has his own server dedicated to Clinton business, Foundation operations and speeches.

2. Hillary needed an IT based system during the time she was running for president in 2008, could not use the existing server due to capacity limitations, so she bought yet another which came with an IT person.

3. Server 2 was installed in the basement of the Chappaqua home and managed by a person listed as Eric Hoteham. Likely the real name is Eric Hothem, who was a DC stockbroker and a Democrat fundraiser that worked for Bill. Eric was also an aide to Hillary during her time as First Lady.

4. Several email addresses were created on the 2nd server where they had some numbers assigned like [email protected]. Several identified run from 18-22 but leads to a question ‘were there email addresses created 1-17? There is also a strange email address on the server known as [email protected]. It should be noted that Guccifer hacked the email address of hdr22.

5. Hillary used several communications devices: a Blackberry which is government issued, an iPad and an IPhone. Questions include, were any of these fitted with encryption features, including her server(s)? So far that answer is no.

6. In the handful of emails released to date as required by the Judge via the State Department, Hillary did not know how to use email and there was a time when the server was down which caused issues for Huma Abedin.

7. In June of 2013, the Hillary team went to an outside IT provider known as Platte River, located in Denver. All electronic communications were moved to Platte River and the Hillary server was moved to a data center in New Jersey and subsequently wipe clean. Now the question is what the Denver IT company Platte River providing redundant services and or an encryption platform to protect classified data for the emails? So far the company is not responding to media questions. The decision to transfer the server services was at the same time the emails that included Sidney Blumenthal were hacked by Guccifer.

6. Two weeks ago, the FBI made a call to Platte River to determine the basis of their work for the Hillary communications platform. On Thursday of last week, Hillary’s lawyer, David Kendall surrendered the 3 thumb drives to the FBI. On Wednesday of this week, the FBI took control of the server located in New Jersey.

7. The recent 2 of 4 emails in question that were marked with the top secret classifications due in part that they included geo-spatial information were sent via a compartmentalized system to the State Department. From State Dept., they were then removed from the protected compartmentalized system and sent to the uncertified Hillary system. All the top secret designations were removed, which is a felony.

8. David Kendall, the Hillary lawyer who maintained the 3 thumb drives was also the lawyer of record for General David Petraeus during his email investigation.

9. All of government uses the same ‘sensitive compartmented information security procedures and there is a manual.

10. Additional details on Hillary email server scandals can be found here.

11. Hillary Clinton statements on the email scandals proving the lies so far.

12. Wrap up to date on the server and the law.

13. Huma Abedin, Hillary’s personal aide and confidant has lawyered up with Karen Dunn on two fronts, the overpayment of $10,000 and for the email scandals.

14. In a recent batch of Hillary emails released was an inquiry about a book describing how to delete emails and the consequences that could result in a jail term.

ISIS Hacking Division Takes on Military and Govt Personnel

Posted on by

Alleged ISIS leak compromises hundreds of U.S. military & intelligence emails — Dept of Defense is ‘looking into it’

and

The top of the page containing the leak appears to show an unconfirmed link to ISIS

Above: The top of the page containing the leak appears to show an unconfirmed link to ISIS

A Twitter account claiming to be the “IS Hacking Division” has published what appears to be an extensive directory of government emails, passwords, credit cards, phone numbers, and addresses spanning U.S. military departments and divisions, the FBI, U.S. embassies, the Library of Congress, U.S. city officials, the British Embassy, the FTC, and NASA, as well as possible personnel at Wells Fargo.

VentureBeat is able to confirm that the U.S. Department of Defense is “looking into” this alleged hack. We’ve also independently verified that at least several of the items included on that list contained accurate information, but that several of the people were not aware that the leak had occurred.

Other details in the document appear inaccurate or outdated; it lists two Intel Corporation email accounts which apparently do not exist in Intel’s “company email directory,” an Intel spokesperson told VentureBeat.

IS hacking division tweet

The content was published onto a site entitled “zonehmirrors.org,” a domain which was registered under the name Redi Alberto in the city of Lugano, Switzerland.

ISIS Group Claims to Have Hacked Information on U.S. Military Personnel
NBC: A hacker group claiming to be affiliated with the terror organization ISIS on Tuesday posted what it said was the personal information of hundreds of members of the military and government personnel, and urged terrorists to carry out attacks.

Flashpoint Intelligence, a global security firm and NBC News consultant, said it could not authenticate the claim by the so-called “Islamic State Hacking Division” or the accuracy of the information. Islamic State is another name by which ISIS is known.
The Twitter account used has been affiliated with infamous ISIS fighter Abu Hussain Al Britani, Flashpoint said. The account has since been suspended.

The group claimed the information contained names, emails, passwords, and phone numbers of personnel that included individuals from the Air Force, the Marines, NASA and the Port Authority of New York and New Jersey. There is no indication as to how old the information is, or whether the email addresses and passwords are still valid.

“We are aware of the report but cannot confirm credibility at this time,” a spokesperson for the Department of Defense said in an email. “The safety of our service members is always a primary concern.”

The group had previously claimed it hacked American servers and distributed information on military personnel, but analysts believe that claim was overstated, and the information was instead culled from freely available social media accounts, Flashpoint said.
T he information released Tuesday also included the purported credit card information of several U.S. State Department officials as well as screenshots of private Facebook messages between purported U.S. servicememebers.

Flashpoint analysts said the “hack” — if true — could be significant as it would represent a growing effort by pro-ISIS groups to distribute personal information that could be used in lone-wolf attacks.

The list of those hacked with names, locations, government divisions, embassies and P/W’s is here.  I was just notified that the original link has been taken offline, after some searching I located this link. http://tu3ek4yox26tber2.onion.nu/   Consider the risk if you choose to open it.

Advances and Secret Information on Hacking of Classified Systems

Posted on by

Hacking never has the sizzle when it comes to terror or scandals, yet it is the cheapest and most effective means of destruction.

So, below are some items you cannot overlook.

A few weeks ago, the unclassified email and information system at the Pentagon, mostly used by the Joint Chiefs of Staff was taken offline due to suspicious malware activity. That system is back online as of this week after all clues pointed to the hack by Russians which led to up to 4000 Pentagon employees losing access to email.

***

Then it has been determined the Chinese have accessed top government officials private emails since 2010.

Chinese hackers have been accessing the private mails of some top United States officials since April of 2010, which coincides with Hillary Clinton’s tenure as secretary of state and her decision to use a private email server, Morning Joe’s Willie Geist reported Tuesday.

“The email grab, first code-named Dancing Panda, targeted top national security and trade officials,” Geist said. “It continued as late as 2014. The timing does overlap with Hillary Clinton’s time as secretary of state and her use of a private email server.”

“Many” top officials have been hacked, according to a high-level intelligence source and a top-secret document obtained by NBC News.

***

Now comes a global network of hacking and their successful and criminal activities.

Exposing a new front in cybercrime, U.S. authorities broke up an alleged insider trading ring that relied on computer hackers to pilfer corporate press announcements and then profited by trading on the sensitive information before it became public.

In morning raids in Georgia and Pennsylvania, federal agents arrested five men in the plot, while four others indicted on hacking and securities fraud charges remain at large.

The hackers, who are thought to be in Ukraine and possibly Russia, allegedly infiltrated the computer servers of PRNewswire Association LLC, Marketwired and Business Wire, a unit of Warren Buffett’s Berkshire Hathaway Inc., over a five-year period.

They siphoned more than 100,000 press releases including corporate data on earnings that could be used to anticipate stock market moves and make profitable trades. The hackers passed the information to associates in the U.S., who allegedly used it to buy and sell shares of dozens of companies, including Panera Bread Co., Boeing Co., Hewlett-Packard Co., Caterpillar Inc. and Oracle Corp., through retail brokerage accounts. A must read for the rest of the details is here.

***

Most chilling of all is the forward leaning and creative uses of drones.

LAS VEGAS, Nev. – Forget Facebook drones that broadcast Wifi. The future is drones that hack from above. A company called Aerial Assault has turned a quadcopter into a flying hacker that scans the world below for insecure devices and vulnerable Wifi ports. Its makers say they built the tool for penetration testing — to help “good guys” diagnose their own weaknesses — but they concede that with a bit of modification, it could be used to exploit those vulnerabilities and install malware from the air. This is why it’s paramount to get your I.T. network looked at by a penetration testing company, you may think this is a scary thing for your company to undergo however, it will actually prevent people (hackers) from stealing your companies information as all of the weak spots would of been identified and then rectified.

The unnamed drone, which may be the first unmanned aerial penetration tool for sale to the public, was on display at the DEF CON hacker conference here last week. It uses a small Raspberry Pi computer running the Kali Linux penetration tester software with the broadcast range extended by alpha radio antennas. It will retail for $2,500 when the Web site goes up in a few days, its makers say.

“We’ve set it up so it does some basic [penetration] testing stuff and coordinates all that data with GPS coordinates from the flight controller. From that, you can extend it with every type of capability that you want Kali Linux to do,” said David Jordan, a representative from Aerial Assault who was selling it on the floor at the DEF CON conference in Las Vegas, Nevada on Sunday.

While the drone isn’t specifically designed to distribute malware, Jordan acknowledged it could be modified to do so. “It is up to the user to decide what they do with it. If the user, they have Raspberry Pi with Kali on it, they can reprogram custom scripts. That’s good for doing more extensive [penetration] testing. But, you know, scripts can be whatever they are,” he said. “Our intended use is for pentesters to be able to diagnose vulnerabilities and help people understand what their Wifi accessibility is, even up in the air.”

 

IRS: Lois Lerner, Texas and Abraham Lincoln

Posted on by

Lerner Lincoln Email

From the Federalist:

“As you can see, the Lone Star State is just pathetic as far as political attitudes are concerned,” Lerner’s friend Mark Tornwall wrote in 2014.

“Look my view is that Lincoln was our worst president not our best,” Lerner responded, according to USA Today. “He should’ve let the south go. We really do seem to have 2 totally different mindsets.”

Finance Committee Releases Bipartisan IRS Report

Committee Concludes Two-Year Investigation into the IRS’s Treatment of Tax-Exempt Organizations

WASHINGTON – Finance Committee Chairman Orrin Hatch (R-Utah) and Ranking Member Ron Wyden (D-Ore.) today released the Committee’s bipartisan investigative report detailing their investigation into the Internal Revenue Service’s (IRS) treatment of organizations applying for tax-exempt status after the Committee voted to report out the findings in a closed executive session.  As required by law, members were briefed by Committee staff with 6103 authority to review private taxpayer information in a number of closed-door briefings on the findings and recommendations of the report before the vote.

“This bipartisan investigation shows gross mismanagement at the highest levels of the IRS and confirms an unacceptable truth: that the IRS is prone to abuse,” Hatch said.  “The Committee found evidence that the administration’s political agenda guided the IRS’s actions with respect to their treatment of conservative groups.  Personal politics of IRS employees, such as Lois Lerner, also impacted how the IRS conducted its business.  American taxpayers should expect more from the IRS and deserve an IRS that lives up to its mission statement of administering the tax laws fairly and impartially – regardless of political affiliation. Moving forward, it is my hope we can use this bipartisan report as a foundation to work towards substantial reforms at the agency so that this never happens again. ”

“The results of this in-depth, bipartisan investigation showcase pure bureaucratic mismanagement without any evidence of political interference,” said Wyden.  “Groups on both sides of the political spectrum were treated equally in their efforts to secure tax-exempt status.  Now is the time to pursue bipartisan staff recommendations to ensure this doesn’t happen again.”

Bipartisan findings of the report include:

  • During the years 2010 to 2013, IRS management failed to provide effective control, guidance and direction over the processing of applications for tax-exempt status.
  • Top IRS managers did not keep informed about the applications involving possible political advocacy and thereby forfeited the opportunity to provide the leadership that the IRS needed to respond to the legal and policy issues presented by these applications.
  • Lois Lerner, who headed the Exempt Organizations Division, became aware of the Tea Party applications in early 2010, but failed to inform her superiors about their existence.  While under Lerner’s leadership, the Exempt Organizations Division undertook no less than seven poorly planned and badly executed initiatives aimed at bringing the growing number of applications from Tea Party and other groups to decision.  Every one of those initiatives ended in predictable failure and every failure resulted in months and years of delay for the organizations awaiting decisions from the IRS on their applications for tax-exempt status.
  • The Committee also found that the workplace culture in the Exempt Organizations Division placed little emphasis or value on providing customer service.
    • Few if any of the managers were concerned about the delays in processing the applications, delays that possibly harmed the organizations ability to function for their stated purposes.
  • The Committee made a number of recommendations to address IRS management deficiencies as follows:
  • The Hatch Act should be revised to designate all IRS, Treasury and Chief Counsel employees who handle exempt organization matters as “further restricted.”  “Further restricted” employees are precluded from active participation in political management or partisan campaigns, even while off-duty.
  • The IRS should track the age and cycle times of applications for tax-exempt status to detect backlogs early in the process and allow management to take steps to address those backlogs.
  • The Exempt Organizations Division should track requests for assistance from both the Technical Branch and the Chief Counsel’s office to ensure the timely receipt of that assistance.
  • A list of over-age applications should be sent to the Commissioner on a quarterly basis.
  • Internal IRS guidance should require that employees reach a decision applications no later than 270 days after the IRS receives that application.  Employees and managers who fail to comply with these standards should be disciplined.
  • Minimum training standards should be established for all managers within the EO Division to ensure that they have adequate technical ability to perform their jobs.

Issuance of the report was delayed for more than a year after the IRS belatedly informed the Committee that it had not been able to recover a large number of potentially responsive documents that were lost when Lois Lerner’s hard drive crashed in 2011.

  • By failing to locate and preserve records, making inaccurate assertions about the existence of backup data, and failing to disclose to Congress the fact that records were missing, the IRS impeded the Committee’s investigation.  These actions had the effect of denying the Committee access to records that may have been relevant and, ultimately, delayed the investigation’s conclusion by more than one year.

A table of contents for the appendix can be found here. The appendicies can be found below:

Part 1 here.

Part 2 here.

Part 3 here.

Part 4 here.

A timeline can be found here.

Additional views from Chairman Hatch can be found here. A summary can be found here.

Additional views from Ranking Member Wyden can be found here. A summary can be found here.

 

Background:

On May 20, 2013, the leaders of the Senate Finance Committee sent a detailed, 41-question document request to the Internal Revenue Service (IRS) seeking information about the alleged targeting by the IRS of certain social welfare organizations applying for tax-exempt status based on those organizations’ presumed political activities. That letter marked the beginning of a bipartisan investigation by the Committee into the IRS’ activities related to the review of tax-exempt applications and related issues raised by the Treasury Inspector General for Tax Administration (TIGTA) in his May 14, 2013, report.

In June 2014, the Committee learned that Lois Lerner had experienced a hard drive failure in 2011, which raised questions about the IRS’s ability to produce all the documents necessary to complete the Senate Finance Committee investigation. As a result, Chairman Hatch and Ranking Member Wyden asked TIGTA to investigate the matter. Specifically, TIGTA looked into: 1) what records the IRS lost; 2) if there was any attempt to deliberately destroy records, or otherwise impede congressional and federal investigations; and 3) whether any of the missing information can be recovered.

TIGTA provided their findings to the Committee on June 30, 2015.

Upon completing the report, Committee investigators had interviewed more than 32 current and former IRS and Treasury employees and reviewed nearly 1.5 million pages of documents.