Image by alancleaver_2000 via FlickrAlso alleged to have accessed and obtained information relating to approx 250,000 medical records of State Department and other USG employees
Criminal Case 1:11CR144 is between the United States of America vs. KUANG HAO CHOU, Also known as Edwin Chou, LING YU HSIEH, Also known as Erica Hsieh.
The Grand Jury Indictment dated March 17, 2011 includes six counts of conspiracy to commit immigration fraud, bribery of a public official and (aiding and abetting), fraud and misuse of immigration documents) and (aiding and abetting), procurement of citizenship or naturalization unlawfully and (aiding and abetting), fraud and related activity with computers, false statement in a security clearance application.
Below are excepts from the indictment:
1. Robert Schofield was a federal employee with the title of Supervisory District Adjudications Officer responsible for processing applications submitted by immigrants requesting adjustments to their United States immigration status. Prior to early 2003, Schofield worked for the Immigration and Naturalization Service (INS). After early 2003, Schofield worked for the newly formed Department of Homeland Security (DHS) Citizenship and Immigration Services (CIS).
6. On November 30,2006, Schofield pled guilty in the Eastern District of Virginia to Bribery of a Public Official and Procurement of Citizenship or Naturalization Unlawfully. As part of his plea agreement, Schofield admitted to fraudulently providing United States immigration documents, including naturalization certificates; Temporary I-551 stamps, which are evidence of LPR ("green card") status; and Advance Parole documents, to ineligible aliens in return for bribes. Schofield admitted that he utilized various brokers to bring the aliens to him who were willing to pay for falsely made United States immigration documents.
7. KUANG HAO CHOU a/k/a Edwin Chou is a Taiwanese national who entered the United States on or about August 21,1996, as a nonimmigrant B-2 visitor for pleasure. CHOU obtained unlawfully issued immigration benefits from Schofield in return for money. CHOU used his unlawful immigration benefits to obtain a United States Passport and to obtain jobs as a contract employee of the United States
Department of State(DOS) and United States government security clearances. CHOU also brought and referred other foreign nationals to Schofield in order to obtain unlawful immigration benefits for these other aliens.
8. LING YU HSIEH a/k/a Erica Hsieh is a Taiwanese national who entered the United States on or about April 11,1998, as a nonimmigrant B-2 visitor. HSIEH obtained unlawfully issued immigration benefits from Schofield in return for money. HSIEH used her unlawful immigration benefits to obtain a United States Passport and a position as a contract employee of the DOS and United States government security clearances. HSIEH also brought and referred other foreign nationals to Schofield in order to obtain unlawful immigration benefits.
9. KUANG HAO CHOU and LING YU HSIEH are married and have been married since 1991. They have resided in Herndon, Virginia, within the Eastern District of Virginia since 2001.
11. KUANG HAO CHOU and LING YU HSIEH used their fraudulently obtained United States Naturalization Certificates to obtain United States security clearances and jobs working as contract employees with the United States Department of State. On or about September 9,2005, CHOU submitted to the Office of Personnel Management (OPM) an Electronic Questionnaire for Investigations Processing (e-QIP) request number 165787, which contained a Questionnaire for National Security Positions (SF86) in connection with his employment as a contractor to the United States Department of State. On or about September 14,2005, HSIEH submitted to the Office of Personnel Management (OPM) an Electronic Questionnaire for Investigations Processing (e-QIP) request number 172495, which contained a Questionnaire for National Security Positions (SF86) in connection with her employment as a contractor to the United States Department of State.
Between on or about April 8,2010 and November 16, 2010, in Herndon, Virginia, within the Eastern District of Virginia, and elsewhere, the defendant, KUANG HAOCHOU, knowingly and intentionally accessed a computer without authorization and exceeded his authorized access and thereafter obtained information from a department and agency of the United States, to wit: CHOU accessed the United States Department of State eMED database without authorization and exceeding his authorized access and obtained information relating to approximately 250,000 or more United States Department of State and other United States government employees. (In violation of Title 18 United States Code 1030(a)(2)(B).)
On or about August 5,2010, in Herndon,Virginia, within the Eastern District of Virginia, and elsewhere, the defendant, KUANG HAO CHOU, in a matter within the jurisdiction of the Executive Branch of the Government of the United States, that is the Social Security Administration and the Department of State, did knowingly, unlawfully and willfully make a materially false, fictitious and fraudulent statement and representation, to wit: CHOU claimed to be lawfully naturalized United States citizens when CHOU sought to renew his security clearance he originally obtained to work as a contractor for the United States Department of State,in order to work with the Social Security Administration, when in truth and in fact, as CHOU then and there well knew he had paid a bribe for his immigration benefits and was not eligible to obtain or use a security clearance in September 9,2005, nor to renew it on August 5, 2010. On or about August 5,2010, CHOU submitted a Questionnaire for Non-Sensitive Positions and a Declaration for Federal Employment submitted to the United States Office of Personnel Management to maintain his security clearance and reaffirming his false statement and representation concerning his immigration status. (In violation of Title 18, United States Code, Section 1001.)
The full copy of the indictment is here (h/t to Emily Babay| Washington Examiner for a copy of the indictment posted in ScribD).
If one of the defendants "obtained" a quarter million information from the medical database, how was that information disposed of? Or perhaps the question might be, how compromised is that information right now? Med records normally include not only names, but also SSNs, blood types, medical clearances, test results (and who knows what else - papsmear and colonoscopy results, physicians' notes, allergies?).
If the allegations are true, one has to wonder at the motive for accessing personally identifiable information (PII) of State Department and other USG employees. What was the intent here? Was the information sold? Was the information hoarded for later disposal? Was it done for much darker reasons?
But more importantly, how was the data breach discovered? The breach happened in a span of seven months. Was it also downloaded and copied to a Lady Gaga CD? Did MED discover this breach due to a system warning when a large amount of data was accessed and obtained? Or was the discovery of the data breach only happened after a collateral investigation of the alleged immigration fraud?
To be blunt, if the defendant was not discovered to have committed the alleged immigration fraud, would the State Dept Office of Medical Services have discovered the breach in its medical database?
And now that eMed had been eBreached, what do you do to protect yourself?
We have asked this and other questions to Med, we'll post any response we get.