Trump Orders Emergency Meeting After Global Cyber-attack

Posted on May 15, 2017May 15, 2017 by Denise Simon

Primer: Investigators launched a far-reaching hunt for the perpetrator, as institutions around the world worked to mitigate damage from the highest-profile computer-worm outbreak in nearly a decade. More here from the WSJ.

Image result for wannacry ransomware

President Trump reportedly ordered an emergency meeting over the weekend after an unprecedented cyberattack hit at least 100,000 organizations in 150 countries.

Senior security staffers with Homeland Security, the FBI and the National Security Agency met on Friday and Saturday in the White House to assess the threat from the “ransomware” attack, Reuters reported.

Trump ordered Homeland Security adviser Tom Bossert to hold the meeting, CBS News reported. Details of the meeting were not immediately disclosed.

The attack that began Friday is believed to be the biggest online extortion attack ever recorded, spreading chaos by locking computers that run Britain’s hospital network, Germany’s national railway and scores of other companies, factories and government agencies worldwide.

Steven Wilson, Head of Europol’s European Cybercrime Centre, told Sky News on Sunday that it was now important that IT departments checked their systems on Monday morning to ensure they had not been compromised.

Security experts warned that further cyberattacks are likely.

“The global reach is unprecedented and beyond what we have seen before,” Rob Wainwright, director of the Netherlands-based Europol said Sunday “The latest count is over 200,000 victims in at least 150 countries, and those victims, many of those will be businesses, including large corporations.”

“At the moment, we are in the face of an escalating threat. The numbers are going up,” he added. “I am worried about how the numbers will continue to grow when people go to work and turn on their machines on Monday morning.”

The Europol spokesman said it was too early to say who is behind the onslaught and what their motivation was. The main challenge for investigators was the fast-spreading capabilities of the malware, he said, adding that so far not many people have paid the ransoms that the virus demands.

Had it not been for a young cybersecurity researcher’s accidental discovery of a so-called “kill switch,” the malicious software likely would have spread much farther and faster. Security experts say this attack should wake up every corporate board room and legislative chamber around the globe.

***

The long-expected US Executive Order is out, and giving prominence to the NIST Framework, DHS,and OMB. Eternal Blue is used to spread WannaCry ransomware, and the UK’s NHS is hard hit. Fancy Bear prances in NATO costume. US Intelligence Community leaders warn the Senate that the Russian cyber threat is large, growing, and not going away. And spamming celebrates its thrity-ninth birthday—no happy returns for you, spammers.

In today’s podcast, we hear about the long-expected US Executive Order, with commentary from Politico’s Eric Geller. It was signed yesterday, and gives prominence to the NIST Framework, DHS,and OMB. Eternal Blue is used to spread WannaCry ransomware, and the UK’s NHS is hard hit. Fancy Bear prances in NATO costume. US Intelligence Community leaders warn the Senate that the Russian cyber threat is large, growing, and not going away. The University of Maryland’s Jonathan Katz explains some potential browser protocol vulnerabilities. And spamming celebrates its thirty-ninth birthday—no happy returns for you, spammers. Go here for the podcast, see WannaCry ransomware title. It is key to note that cyber experts saw chatter in hack chat rooms about this worm in April.

57,000 Detections, 74 Countries Affected by Global Ransomware

Posted on May 12, 2017May 12, 2017 by Denise Simon

Go here for more information on malware affections.

Further, US-CERT, by DHS has this information.

Older machines running XP do not appear to be affected. Meanwhile, about a month ago:

Microsoft responds to NSA’s Windows exploits, urges customers to upgrade to supported versions

Remember, this NSA vault toolkit was stolen, leaked and published by WikiLeaks, Julian Assange. In some cases, it could be a deadly threat to life considering the intrusions into hospitals. The other blame goes to the Russian cyber gang, ShadowBrokers.

Russian-linked cyber gang Shadow Brokers blamed for NHS computer hack

Courtesy: TelegraphUK: Ransom message found on NHS computers

CyberScoop: Large organizations on every continent are being hit by a global campaign of ransomware attacks on Friday, unfortunately, average ransomware demand has increased significantly. Machines are being infected using exploits developed by the U.S. National Security Agency and leaked by the group known as ShadowBrokers, according to authorities.

More than 57,000 detections in 74 countries have been recorded. Russia appears to be the most infected country by far, according to cybersecurity firms Kaspersky and Avast.

The “number [is] still growing fast,” according to Costin Raiu, Kaspersky’s director of research.

Hospitals across England were forced to divert emergency patients, according to the National Health Service. Other hospitals are asking patients to avoid coming in except for emergencies, news reports said.

In Spain, victims including the telecommunications company Telefónica told employees to shut down machines and networks in an effort to stop the spread of the malware. Other victims include Gas Natural and Iberdrola, an electric utility firm.

The ransomware campaign is caused by “exploiting the vulnerability described in bulletin MS17-010 using EternalBlue / DoublePulsar,”Spain’s Computer Emergency Readiness Team explained on Friday. “Infection of a single computer can end up compromising the entire corporate network.”

EternalBlue and DoublePulsar are code names for NSA hacking tools used to infect thousands of machines around the world since the NSA tools leaked in April.

That description from Spanish authorities and the work of several researchers point directly to NSA tools hacked and leaked by ShadowBrokers. The patch that Microsoft published in March assigned the designation MS17-010 to the vulnerability.

A widespread “bloodbath” from criminals has been expected by experts since the leak.

The ransomware “infects the machine by encrypting all its files and, using a remote command execution vulnerability through SMB, is distributed to other Windows machines on the same network. Microsoft published the vulnerability on March 14 in its bulletin and a few days ago a proof of concept was released that seems to have been the trigger of the campaign.” SMB is Microsoft’s Server Message Block protocol for network file sharing.

The attacks in different countries have been linked to the same group, according to the Financial Times.

The U.S. Department of Homeland Security is “coordinating with our international cyber partners” in Europe and Asia, a spokesperson told CyberScoop. “The Department of Homeland Security stands ready to support any international or domestic partner’s request for assistance. We routinely provide cybersecurity assistance upon request, including technical analysis and support. Information shared with DHS as part of these efforts, including whether a request has been made, is confidential.”

Security researcher Kevin Beaumont advised patching machines immediately:

** Kevin Beaumont?Verified account @GossiTheDog5h5 hours ago

Confirmed – wcry ransomware spreading across Europe uses EternalBlue/MS17-010/SMB. PATCH NOW EVERYWHERE.

Spanish authorities confirmed the ransomware is a version of WannaCry (also known as WannaCrypt0r), according to the National Cryptology Center. In Spain, the newspaper El Mundo is reporting that “early indications point to an attack originating in China.”

“Given the rapid, prolific distribution of this ransomware, we consider this activity poses high risks that all organizations using potentially vulnerable Windows machines should address,” a spokesperson from the cybersecurity firm FireEye told CyberScoop. “Organizations seeking to take risk management steps related to this campaign can implement patching for the MS17-010 Microsoft Security bulletin and leverage the indicators of compromise identified as associated with this activity.”

FireEye has yet to see a U.S.-based company be affected by the ransomware worm.

An estimated 25 health facilities in London and across England have been hit, according to the NHS. St Bartholomew’s Hospital in London, one of the victims, received warnings earlier this year that computers using Windows XP were vulnerable, reported the technology news site the Inquirer. Increasingly, some infected hospitals are not accepting phone calls or internet communications. The Derbyshire Community Health Services NHS Trust has reportedly shut down all of its IT systems.

“At this stage we do not have any evidence that patient data has been accessed,” an NHS statement said. “We will continue to work with affected organizations to confirm this.”

East and North Hertfordshire NHS trust, a hospital just north of London, publicly acknowledged “a major IT problem” that is “believed to be caused by a cyber attack.”

“The trust is postponing all non-urgent activity for today and is asking people not to come to A&E – please ring NHS111 for urgent medical advice or 999 if it is a life-threatening emergency,” according to a statement. “To ensure that all back-up processes and procedures were put in place quickly, the trust declared a major internal incident to make sure that patients already in the trust’s hospitals continued to receive the care they need.”

News of the English hospitals being hit with ransomware spread quickly among doctors and hospital employees, including in a widely shared message from an English doctor now making the rounds on social media.

**

If.ra? @asystoly6h6 hours ago Why would you cyber attack a hospital and hold it for ransom? The state of the world

“So our hospital is down,” the doctor wrote. “We got a message saying your computers are now under their control and pay a certain amount of money. And now everything is gone.”

2008, the Russians Hacked Obama’s Campaign Too

Posted on May 12, 2017May 12, 2017 by Denise Simon

Why are we learning this now? It is a dereliction of duty to advise the American electorate, campaign operators and all later political candidates, regardless of the kind of race. Further, should we be blaming Obama on this and did he invite the FBI to investigate? If so, the matters of phishing operations and Russia should have been a clarion call.

Further, why would Obama and Hillary even consider ‘resetting’ relations with Russia? Oh yeah……’cut it out Vladimir’..remember that?

Okay read on….the anger mounts.

Exclusive: Russian Hackers Attacked the 2008 Obama Campaign

Jeff Stein: Russian hackers targeted the 2008 Barack Obama campaign and U.S. government officials as far back as 2007 and have continued to attack them since they left their government jobs, according to a new report scheduled for release Friday.

The targets included several of the 2008 Obama campaign field managers, as well as the president’s closest White House aides and senior officials in the Defense, State and Energy Departments, the report says.

It names several officials by title, but not by name, including “several officials involved in Russian policy, including a U.S. ambassador to Russia,” according to a draft version of the report, authored by Area 1 Security, a Redwood City, California, company founded by former National Security Agency veterans.

“They’re still getting fresh attacks,” the company says.

The attacks on their email accounts have continued as the officials migrated to think tanks, universities and private industry, the company says. The favored weapon of the Russians and other hackers is the so-called “phishing” email, in which the recipient is invited to click on a innocent-looking link, which opens a door to the attackers.

Michael McFaul, Obama’s ambassador to Russia from 2011 to 2014, tells Newsweek that he gets “frequent” warnings of phishing attacks by an unnamed “foreign government” from both his Google email service and Stanford University, where he is now a professor of political science. He says his “colleagues, assistants and people like that” at Stanford also get attacked “on a fairly regular basis.”

“I have not been successfully penetrated, to the best of my knowledge,” McFaul says, speaking Thursday in a brief telephone interview. So far as he knows, “I have not been compromised.” There were three other U.S. ambassadors to Russia during Obama’s eight years in office who could not immediately be reached for comment.

The role of Russia in attacks on the 2008 campaigns of Obama and his Republican rival, Senator John McCain of Arizona, has not been previously reported. On the eve of a U.S.-China summit meeting in 2013, U.S. intelligence officials told NBC News that Beijing alone was responsible for a 2008 cyberattack on the Obama and McCain campaigns.

China can’t be excluded as a perpetrator in those attacks, Area 1 Security’s report says, but its new data “show that Russia tried to hack several members of the Obama campaign and could have done so at the same time as someone that achieved massive data exfiltration.”

Blake Darché, a former NSA technical analyst who co-founded Area 1 Security, tells Newsweek that “state-sponsored Russian hackers have been targeting United States officials and politicians since at least 2007 through phishing attacks.” Russian hackers reportedly breached the Joint Chiefs of Staff email system in 2015.

The company says one of the Russian targets was a “deputy campaign manager” in the 2008 Obama campaign, but was otherwise unidentified in its report. There were a number of them over a period of time. One was Steve Hildebrand. Reached in Sioux Falls, South Dakota, where he now runs a specialty bakery and coffee shop, Hildebrand says he was “not aware” that he might have been a Russian target and didn’t remember being warned about cyberattacks of any kind during the campaign. Another senior 2008 campaign aide (and later White House National Security Council spokesman), Tommy Vietor, tells Newsweek he had “no knowledge” of Russian hacking at the time.

Besides top officials in the Energy, Defense and State departments, the Area 1 Security report cites a half-dozen positions in the Obama White House that were targeted from 2008 through 2016, including the president’s deputy assistant, special assistant, the special assistant to the political director, advance team leaders for first lady Michelle Obama, and the White House deputy counsel. None of them could immediately be reached for comment.

Among the State Department targets named by Area 1 Security were three top offices dealing with Russia and Europe. Evelyn Farkas, who served as the Obama administration’s deputy assistant secretary of defense for Russia/Ukraine/Eurasia from 2012 to 2015, says she could not discuss matters that remain classified, but says “the biggest impact” she remembered offhand was the Russian hack of the Joint Chiefs.

Among the three top, unnamed targets at the Energy Department was the director of the Office of Nuclear Threat Science, which is responsible for overseeing the U.S. Nuclear Counterterrorism Program.

The Area 1 Security report names the “Dukes,” also known as “Cozy Bear” and APT-29, for the Obama attacks, the same Russian actors named in the 2015 and 2016 hacking of the Democratic National Committee (DNC) and the State Department.

In an interview, Darché calls the Dukes a front for Russia’s “premier intelligence-gathering arm,” which would be the SVR, or External Intelligence Service, the Kremlin equivalent to the CIA, although he declined to specifically name it. As opposed to the DNC hacks launched to steal and publicize information damaging to the campaign of Hillary Clinton, he says, the Russian offensives that Area 1 Security uncovered were clandestine “intelligence gathering operations” designed to secretly penetrate a wide variety of institutions and industry.

Clinton had harshly criticized the Kremlin’s suppression of human rights and seizure of the Crimea, while her rival Donald Trump had repeatedly said he wanted to be “friends” with Russian President Vladimir Putin.

Oren Falkowitz, a former analyst at the National Security Agency who co-founded Area 1 Security, says he launched the company to stop phishing attacks, which until then was thought to be impossible because so many employees continue to click on risky links in emails. The key to the company’s success was persuading clients to let it monitor its servers, he told The New York Times in a 2016 interview.

In Friday’s report, Area 1 Security says it uses a “vast active sensor network” to detect and trace phishing attacks. It says it could imagine the Dukes “operating a giant spreadsheet where new targets are added, but never leave.” It “moves quickly, compromising a server or service to send out phishing emails from it, and then leaves, never returning to check for bounced email messages to cull from its list.”

Most ex-officials don’t realize they are carrying “the blemish of being a Russian target into their new workplace,” the Area 1 Security report says. As a result, “they give the Dukes beachheads in companies and organizations they never even planned on or imagined hacking,” such as Washington think tanks, defense contractors, lobbyist offices, financial institutions and pharmaceutical companies stocked with high ranking former political, military and intelligence officials.

Russia is “notoriously persistent in pursuing targets,” the report says. “It’s a lesson on why every organization needs great security.”

***

FireEye CEO: Russians are at Work in Election Hacking

FireEye CEO Kevin Mandia said Thursday that strengthening U.S. cybersecurity defenses begins with protecting the country’s own systems first, and he is hopeful the Trump administration will implement a strategy to defend from cyber threats, during an interview on FOX Business’ “Countdown to the Closing Bell.”

“You gotta protect critical infrastructure and under times of duress, you have to be able to have shields up as a nation, and I think this order is going to move toward that,” he said, referring to the executive order President Trump signed Thursday, aimed at strengthening the America’s infrastructure to help prevent cyberattacks.

Cyber hacking has been in the forefront of an FBI investigation over Russia’s alleged involvement in the 2016 presidential election. Mandia said he believes acting FBI Director Andrew McCabe will continue the investigation into these claims.

“When you awake the sleeping giant, they get the job done and I think the FBI, whenever they apply the resources at their disposal and their capability, they can get the job done as they see fit,” he said.

Mandia believes the Russians are at work in election hacking and thinks it will continue to happen.

“The tool in every emerging nation’s tool box now [is] a cyber component,” he said.

The FireEye CEO added that the risks from cyberattacks can’t be eliminated because persistent hackers are exploiting human trust and not exploiting systems.

Russian “information operations troops” (“cyber troops”)

Posted on May 11, 2017May 11, 2017 by Denise Simon

Russian ‘Cyber Troops’: A Weapon of Aggression

Eurasia Daily Monitor: Speaking to the Russian parliament (Duma) last February, Russian Minister of Defense Sergei Shoigu announced the creation of “information operations troops” (“cyber troops”) within the Armed Forces. He emphasized that state “propaganda should be smart, accurate and effective” and that that these new formations “will be much more efficient than the ‘counter-propaganda’ department that operated during the Soviet period” (TASS, February 22). It is dubious, however, that the responsibilities of “cyber troops” will be reduced solely to “propaganda.” Rather, it seems that this unit is to become the main tool of Russia’s offensive cyber operations as a part of “information warfare.” The official history of the Russian cyber troops goes back to 2012, when Dmitry Rogozin (at the time heading the Russian Foundation for Advanced Research Projects in the Defense Industry) addressed the issue publicly for the first time. In 2013, an anonymous source confided that formations of this kind had been established under the umbrella of the Russian Armed Forces (RBC, February 22), but at the time there was no solid evidence available.

Then, in April 2015, the official state news agency TASS reported that a unit of Russian “information operations forces” were deployed to the territory of the Crimean Peninsula (TASS, April 17, 2015). Nonetheless, in the meantime, the Russian side continued to deny the existence of cyber troops. For instance, in January 2017, the first deputy director of the Russian Duma Defense Committee, Alexander Sherin, claimed that “Russia does not have such formations.” Similar statements were made by top-ranking Russian officials related to security and mass communications, such as Viktor Ozerov and Alexey Volin (Interfax, January 16). This silence was interrupted only by Defense Minister Shoigu’s official announcement in February. Commenting on the main tasks of the cyber troops, Franz Klintsevych, a high-ranking member of the Russian Federation Council (upper house of parliament), identified the disclosure of subversive activities by foreign intelligence services in electronic, paper and TV media outlets. He suggested that the cyber troops would deal with such hacker attacks as their main responsibility. But this assessment fails to fully reflect the true essence and tasks of the new unit. According to Yaakov Kedmi—who used to head Nativ, the former Israeli intelligence service charged with facilitating the immigration of Jews from the Soviet Bloc—“cyber troops” exist in “all serious armies” and are subordinated to their respective defense ministries. Their main tasks are “propagandist” (propaganda and counter-propaganda) and “operational” (activities designed to distract the adversary by providing false information). Yet, he also highlighted that so-called “political propaganda” falls outside the range of responsibilities for such formations (Kommersant, February 22).

Another revealing bit of information on the secretive cyber troops can be found in research conducted by Zecurion Analytics, a Russian software company established in 2001. According to a report the firm published several months ago, Russia may be placed in the top five countries with the “most powerful” cyber troop units, in terms of the number of personnel employed (which Zecurion Analytics estimates at approximately 1,000) and financial expenditures (around $300 million per annum). The company’s head, Vladimir Ylianov, has stated that the main tasks of Russian “cyber troops” include espionage, cyber attacks, and informational warfare (Kommersant, January 1). This assessment, however, also may underestimate the real capabilities of these cyber forces. Thanks to introduction of so-called “research units,” Russian cyber defense is inseparable from the Armed Forces and its resources, which exponentially increases its offensive potential (see EDM, November 30, 2016).

A somewhat different opinion was expressed by pro-Kremlin cyber security specialist Igor Panarin. He hopes that the creation of the cyber troops will allow Russia to overcome its inferiority in the cyber domain compared to other countries, like the United States, and beef up its offensive capabilities. According to the expert, the 2008 Russian-Georgian War in fact demonstrated that Russian failed to act efficiently when it came to offense, and it instead relied on “defense and containment” in its cyber operations. Panarin suggested that unlike the Department of Information and Mass Communication, which was created under the umbrella of the Ministry of Defense in 2016 and tasked with defensive activities, the cyber troops—which could and should act in concert with the Federal Security Service (FSB) and the Foreign Intelligence Service (SVR)—will be specifically charged with conducting offensive operations in the “cyber sphere” (kiber prostranstvo) (Militarynews.ru, February 22). If accurate, this demonstrates Russia’s continuing development of offensive cyber capabilities and a delineation between “cyber” and “information” operations.

Panarin also outlined a number of supplementary steps Russia needs to take, which included the following elements (Vz.ru, February 28, 2017):

1. The establishment of a State Council (that is to include various governmental structures, public diplomacy organizations, media sources, representatives of business, political parties and non-governmental organizations) tasked with issues related to “information confrontation” (informatsionnoye protivoborstvo—understood as a struggle in the information sphere with the broad aim of achieving information dominance over one’s opponent);

2. The establishment of a position of a “Presidential Advisor” on information operations, tasked with the coordination of informational-analytical units connected with the “cyber troops,” the Ministry of Defense, FSB, Federal Protective Service (FSO), SVR and other key ministries;

3. The creation of a media holding—based on existing media resources of Russian TV Channel One, All-Russia State Television and Radio Broadcasting Company (VGTRK), RT and others—subordinated to the Ministry of Foreign Affairs of the Russian Federation. It is imperative to copy the US experience while implementing this initiative, Panarin alleged; and finally

4. The formation of separate centers of information operations pertaining to the FSB, FSO and SVR. Panarin’s suggested program should be seen as an extremely ambitious and far-reaching strategy, fully complying with the steps and activities already conducted by the Russian side in the domain of cyber security and information operations. Within this development of the country’s cyber capabilities, the Russian cyber troops should be seen mainly as an offensive operations force, and not as a defensive mechanism.

–Sergey Sukhankin

For reference, here is the testimony before

THE SELECT COMMITTEE ON INTELLIGENCE DISINFORMATION A PRIMER IN RUSSIAN ACTIVE MEASURES AND INFLUENCE CAMPAIGNS

Who Can be Fired at the VA for Cause? No One

Posted on May 11, 2017May 11, 2017 by Denise Simon

Bipartisan Senate Group Unveils New Bill to Speed Up VA Firing, Bonus Recoupment

The new bill comes just days after a federal appeals court ruled Congress’ previous attempt at hastening VA’s disciplinary process — through the 2014 Veterans Access, Choice and Accountability Act — was unconstitutional. The measure stripped Senior Executive Service employees of their right to a second-level appeal before the Merit Systems Protection Board’s presidentially-appointed, Senate-confirmed panel. VA had already stopped using the new authority after its constitutionality was questioned in court and the Obama administration declined to defend it.

The senators have been working on their new bill for weeks, but they said the court ruling reinforced the need for reform. “This legislation would improve on the law we enacted in 2014,” Rubio said.

The bill would allow the department’s secretary to fire, suspend or demote an employee with only 15 days notice. Affected workers would then have seven days to issue a response before a final decision is made. Any employee facing removal, suspension of at least 14 days or a demotion would have 10 days to appeal the action to the Merit Systems Protection Board. MSPB would then have 180 days to issue a decision, a much longer period than the 45-day timeline set up in the House bill. Employees would maintain the right to appeal an MSPB decision to federal court.

Employees covered by a collective bargaining agreement would also maintain the right to appeal a negative personnel action through the grievance process, though it would have to be resolved within 21 days. Read more here.

Meanwhile, there is that blasted union problem at the VA:

An estimated 346 employees in the Department of Veterans Affairs do no actual work for taxpayers. Instead, they spend all of their time doing work on behalf of their union while drawing a federal salary, a practice known as “official time.”

That’s according to a report by the nonpartisan Government Accountability Office. But exactly what those VA workers are doing and why so many are doing it is not clear. The VA doesn’t track that, and the GAO report offers no clue.

Rep. Jody Arrington, R-Texas, a member of the House Veterans’ Affairs Committee, thinks the number on 100 percent official time may be much higher. He also notes that the 346 workers don’t include those who spend most, not all, of their time doing union work.

“The lack of accountability at the VA when it comes to monitoring official time suggests it might be worse,” said Arrington, who has introduced legislation that would require the department to track the use of official time, among other reforms.

Pointing to the waiting list scandals at the department, Arrington said the official time situation is reflective of the “broken culture at the heart of the VA” and adds, “I haven’t heard one good, acceptable reason why the practice has continued.”

The VA was not eager to discuss the matter with the Washington Examiner. After several days of inquiries, it responded with the following statement: “VA believes that the appropriate use of official time can be beneficial and in the public interest as stated in the Federal Service Labor-Relations Statute, which governs how executive branch agencies treat official time. VA takes the position that labor and management have a shared responsibility to ensure that official time is authorized and used appropriately. VA practices are in compliance with the Federal Service Labor-Relations Statute.”

Official time is allowed under the 1978 Civil Service Reform Act. The idea behind it is to ensure that a federal employee who is also a union official won’t be penalized for being away from work if he or she is negotiating a contract or addressing a worker grievance, for example. It is essentially a trade-off for the limitations put on federal unions, such as prohibitions on striking.

At least 700 federal workers do nothing but work on official time, according to the GAO and data obtained from various Freedom of Information Act requests. The VA uses official time far more than any other agency.

“Employees spent approximately 1,057,00 hours on official time for union representation activities … In addition, the data show that 346 employees spent 100 percent of their time on official time,” the GAO found in a January report.

It is possible that even those figures are conservative. The GAO said the said the VA’s poor monitoring meant the data was “inconsistent and not reliable.”

The GAO didn’t know what the employees are doing with all of that time. “We just didn’t get into that in that particular study,” said Cindy Barnes, the GAO’s director of education, workforce and income security issues and author of the report.

Part of the explanation is that the VA is one of the largest federal agencies with 373,000 workers, making it second only to the Pentagon in the sheer size of its workforce. About 250,000 VA workers are covered by collective bargaining agreements, according to the GAO, citing 2012 data. Arrington puts the covered figure at 285,000.

By comparison, the Department of Homeland Security has 240,000 workers and the Department of Commerce has just under 44,000 workers. But those departments get by with proportionately far fewer people working exclusively on official time. DHS has 39, while Commerce has just four.

Another factor is that the VA’s workforce is represented by no less than five unions: The American Federation of Government Employees, the National Association of Government Employees, National Nurses United, the National Federation of Federal Employees and the Service Employees International Union.

National Nurses United representative Irma Westmoreland was the only union official willing to talk about the practice with the Washington Examiner. She is one of five nurses union members who work exclusively on union time at the VA. The union has another nine who spent 80 percent of their time at the VA on official time, she said.

Westmoreland said her work was necessary because nurses can’t simply stop taking care of a patient to do something like address a worker grievance. People such as her do the union work and make it possible for the other nurses to focus on providing care.

“I have to travel across the country working with 23 VA facilities in four time zones,” she said. “The management teams want somebody at 100 percent official time so they don’t have to pull somebody out of care.”

But not everyone at the VA is involved in care. So what are the other 341 exclusive official time workers doing? Westmoreland had no insight.

“I don’t know how the other people do it,” she said.

American Federation of Government Employees President J. David Cox told Arrington’s subcommittee in February that official time involved activities such as “designing and delivering joint training of employees on work-related subjects and introduction of new programs and work methods that are initiated by the agency or by the union.”

He added that “in no way did the [February GAO] report suggest that the use of official time presents problems for the department.” The report sought only to quantify the amount of time used.

Arrington argues that the practice has to change if the VA is ever to be truly reformed. He has sponsored the Veterans, Employees and Taxpayer Protection Act, which would require the VA to track the use of official time. It also would prohibit employees involved with direct patient care from spending more than a quarter of their work hours on union activities and bar any VA employee from spending more than half of their time on official time.

The legislation would effectively put VA employees under right-to-work protection. The VA would be prohibited from agreeing to union contracts that force workers to join or otherwise support a union as a condition of employment.

Westmoreland said she has no trouble with better tracking the use of official time but warns against putting any limitations on its use.

“It makes it very difficult if you cannot have set official time,” she said.