McCain Lays Into OPM Director Over Data Breaches

The head of the Office of Personnel Management faced a third consecutive day of intense questioning over her handling of a series of data breaches last year.

National Journal

Katherine Archuleta's week is not getting any easier.

Archuleta, the director of the Office of Personnel Management, appeared in front of Congress for the third public committee hearing in three days, as lawmakers try to obtain more information about the extent and damage of a series of data breaches that affected OPM last year.

The director fielded questions at a Senate Homeland Security Committee hearing Thursday about her performance at the helm of the government's personnel agency, coming under withering fire from Committee Chairman Ron Johnson and Republican Sen. John McCain, both of whom stopped just short of calling for Archuleta to step down.

In a heated exchange with the OPM director, McCain asked Archuleta to confirm basic details about the scope of the data breach and the identity of the attackers, questions which Archuleta refused to answer.

"Even though it's all public knowledge that it was China, you're not ready to tell the committee that you know that it was China that was responsible for the hacking," McCain said, after Archuleta repeatedly dodged the question. "Is that true?"

"OPM is not responsible for attribution," Archuleta said. "We rely on our colleagues to talk about that."

McCain was left almost speechless. "Your committee, your business, is to track and to respond to hacking, and, well, uh—...."

The Arizona senator then turned to questioning Archuleta about the size of the data breaches, since she had pushed back in her opening statement against widely cited press reports that more than 18 million records were affected by the hacks.

"Why wouldn't you, when there's a clear situation here of an allegation by the most respected law enforcement agency in America of 18.2 million [affected individuals], and you're alleging that it's 4 million, wouldn't you sit down with the FBI to say, 'Hey, the American people need to know'?" McCain asked.

Archuleta said that her colleagues had met with the FBI, but she had not.

"It doesn't rise to your level of attention? I see," McCain replied.

"Ms. Archuleta, I must say, I have seen a lot of performances," McCain said as he finished his round of questions. "Yours ranks as one of the most interesting."

McCain's frustration with the lack of information about the breaches mirrored the disappointment of other senators Tuesday after they attended a closed-door briefing, where they had hoped to get clearer answers to some of their basic questions about the data breaches. But many said the information they received in secret didn't go beyond anything that had already been publicly revealed.

And Archuleta's fiery confrontation with McCain came a day after she appeared for the second time in two weeks before the House Oversight Committee, where Chairman Jason Chaffetz accused her of lying outright about a breach of OPM servers that was revealed in March 2014, and called for her to resign.

Chaffetz's ire was echoed by Sen. Steve Daines, a Republican from Montana who on Tuesday called for Archuleta to step down. Daines has said he received a letter from the personnel agency notifying him that he was affected by the OPM data breach.

Even Republican presidential candidate Jeb Bush joined the chorus, telling a radio host on Tuesday that President Obama should fire Archuleta for the "sheer incompetence" her agency displayed "across the board."

Johnson also cut Archuleta no slack during his committee's Thursday meeting. The fact that Archuleta has not yet met with the OPM inspector general or with FBI Director James Comey to discuss the data breaches "really gives me great pause in terms of having confidence that the current management team at OPM really is up to the task," Johnson said.

But not everyone at Thursday's hearing rushed to criticize Archuleta. Tony Scott, the U.S. chief information officer, said he thinks the leadership has been effective and that perhaps lawmakers are pointing fingers in the wrong direction.

"We need to be careful about distinguishing fire-starters from firefighters," Scott said. "In this particular case, they have my full support."