The Washington Post - 14.03.2020

A16 eZ re THE WASHINGTON POST.SATURDAy, MARCH 14 , 2020

The coronavirus outbreak

BY JOSEPH MARKS

AND LISA REIN

Hundreds of thousands of fed-
eral workers and congressional
staff may soon be asked to work
remotely full time a s the c oronavi-
rus spreads, putting reams of sen-
sitive government data at higher
risk of hacking and threatening to
overwhelm outdated government
computer s ystems.
The surge in telework will m ark
a first-of-its-kind test for the gov-
ernment, which has struggled to
update and s ecure its arcane tech-
nology systems after a string of
damaging data breaches during
the O bama administration.
If U.S. adversaries such as Rus-
sia or Iran compromise networks
during the pandemic, they could
disrupt efforts to mitigate the vi-
rus by stopping or slowing vital
government communications.
They could also sow chaos by
sending phony alerts about the
virus to the government work-
force or the p ublic.
“This is a make or break mo-
ment, a nd we won’t k now what we
get until we see it,” said Greg
To uhill, the federal chief informa-
tion security officer during the
Obama administration.
So far, no federal agency or de-
partment has mandated their em-
ployees go home and log on to do
their business, even as President
Trump declared a national emer-
gency to free up $50 billion in
disaster relief for state and local
governments.
Larger agencies such as the
Health and Human Services and
Energy departments have advised
employees about safety precau-
tions while they prepare remote

working agreements, in case

working from home full time be-

comes necessary. A handful of

smaller agencies have offered em-

ployees the opportunity to work

remotely, including the Securities

and Exchange Commission,

where a suspected infection

caused 2,400 workers in t hat agen-

cy’s h eadquarters to head home.

Only about 40 percent of the

2.1 million federal workers were

authorized to work remotely as of

2017. And the Trump administra-
      tion had been working to limit
      remote work, demanding some
      civil servants instead come into
      the office to perform their jobs.
      But as broad swaths of the private
      sector, school districts and local
      governments have moved quickly
      to limit the virus’s spread, the ad-
      ministration’s stance is changing,
      and it is now urging agencies to
      sign remote working agreements
      with as many employees as possi-
      ble.
      On Monday, the White House
      ordered employees a cross the g ov-
      ernment to be ready to telework
      full time if necessary, but it has
      released little guidance a bout h ow
      to remain s ecure while d oing so.
      Sen. Mark R. Warner (D-Va.),
      vice chairman of the Senate Intel-
      ligence Committee, called that
      lapse “inexcusable” i n an email.
      “A s the f ederal government pre-
      pares for what is likely to be an
      unprecedented experiment in
      telework, it’s also expanding op-
      portunities f or malicious actors to
      attack and potentially disrupt vi-
      tal g overnment services,” h e said.
      Furthermore, i t is f ar from clear
      that government computer serv-
      ers are prepared to handle the
      traffic from thousands of employ-

ees trying to access them from

outside the office. The virtual pri-

vate networks through which

workers would likely sign on are

often decades old and not de-

signed to handle massive traffic

volumes.

Many federal employees also

lack government-issued laptops

and phones, raising the specter of

them logging o n from their homes

or coffee shops with devices that

lack basic security features and

are not patched against the latest

bugs.

“You’re going to have a lot of

folks that are going to inevitably

be doing government business

from their personal devices. I

think that’s just a reality,” said

Suzanne Spaulding, who led cy-

bersecurity operations for the De-

partment of Homeland Security

during the Obama administra-

tion. “This j ust creates a n opening

for m alicious activity of all kinds,”

Federal workers could also be

using public WiFi networks that

are not secure against hackers.

And they will be more vulnerable

to phishing emails and texts that

look legitimate but actually con-

tain malicious software.

Cyber officials within the vast

federal bureaucracy w ere w orking

quickly for a ny c ontingency.

DHS’s Cybersecurity and Infra-

structure Security Agency (CISA)

released a checklist Friday to help

agencies ensure remote employ-

ees are operating as securely as

possible. But the agency did not

respond to detailed questions

about how it plans to deal with

security challenges during what

could be an extended telework

period. Pentagon leaders are also

urging some divisions to imple-

ment telework to the maximum

extent possible, a spokeswoman

said.

The DHS checklist includes re-

quiring employees to perform ex-

tra authentication checks beyond

entering a password to remotely

access government files and pre-

paring for an increase in phishing

emails.

Besides the SEC, o ther agencies

urging remote work include U.S.

Citizenship and Immigration Ser-

vices and the Federal Deposit In-

surance Corporation. DHS an-

nounced last week that it had

closed its Seattle field office for

two weeks after an employee test-

ed positive f or coronavirus.

Other agencies have been con-

ducting day-long telework ses-

sions for all or most employees as

“stress tests,” to see if computer

systems can handle the strain.

CISA conducted one such test

Friday. Similar tests have been

conducted by NASA, the National

Oceanic and A tmospheric Admin-

istration and the Energy Depart-

ment. One Energy Department

employee w ho worked from h ome

during an agencywide test told

The Washington Post that he was

able to log on but the agency net-

work was “very s low.”

Chief information officers have

been meeting regularly in recent

weeks to confront myriad chal-

lenges they don’t h ave a nswers for,

such as whether agencies will h ave

enough help desk employees to

troubleshoot computer issues and

how they will handle system

crashes.

For government workers that

do highly classified work, howev-

er, there is n o way to work remote-

ly even if the o utbreak, gets w orse.

A spokesman for the National

Security Agency, whose work col-

lecting foreign intelligence is

highly c lassified, said the a gency is

continuing its work with no “re-

duction in m ission.”

Some top government officials

have secure workspaces — known

as Sensitive Compartmented In-

formation Facilities, or SCIFs —

set up inside their homes, and

have phones and tablets they can

use to read and respond to classi-

fied documents.

The vast majority of intelli-

gence workers, however, have no

choice but to do their work in

highly secure government-man-

aged buildings. In the past, offi-

cials have managed through

snowstorms and other natural di-

sasters by working rotating shifts,

and agencies have plans for pan-

demics that include reorganizing

workspaces so employees can

keep larger-than-usual d istances

between each other, former offi-

cials said.

The decision to telework is al-

ready taking hold in Congress,

where numerous lawmakers have

announced their offices will be

working remotely, including the

House Veterans’ Affairs Commit-

tee a nd the o ffices of Sen. Te d Cruz

(R-Te x.), who has extended his

self-quarantine after coming into

contact with two infected individ-

uals, and Sen. Tom Cotton (R-

Ark.).

The House Administration

Committee sent a memo Wednes-

day to all lawmakers outlining

how offices can set up temporary

telework plans for their staff

members and directing them to

the chamber’s office supply store

to buy secure laptops and other

technology.

The chamber’s tech support of-

fice has also set up shop in the

Rayburn House Office Building

cafeteria f rom 9 a.m. t o 3 p.m. e ach

day to configure security features

on the laptops of staffers who are

preparing to work remotely, ac-

cording to a copy of the memo

shared with T he Post.

“Members of both chambers

are beginning to telework at un-

precedented levels, and this

means an increased risk of cyber

threats,” said Rep. Kathleen Rice

(D-N.Y.), who sponsored a bill

mandating lawmakers get cyber-

security training that recently

passed the House.

“This situation is concerning

and i t underscores e xactly w hy i t is

so important that members and

their staff are well-versed in cyber-

security best practices.”

A memo from the Senate ser-

geant-at-arms office, meanwhile,

offers mostly pro forma security

advice such as ensuring staff lap-

tops are all up to date on security

patches.

“It’s ridiculous that they’re just

preparing for this now. This has

been a known threat for weeks at

least,” said Daniel Schuman, the

policy director for the liberal ad-

vocacy group Demand Progress

who writes a newsletter about

Congress.

Schuman’s group has urged

both chambers to close all con-

gressional offices and hold votes

using digital technology while the

pandemic u nfolds.

[email protected]

[email protected]

ellen Nakashima contributed to this

report.

Federal employees working from home could pose c ybersecurity risks

BY AMY GOLDSTEIN,

LAURIE MCGINLEY

AND YASMEEN ABUTALEB

President Trump announced
Friday that the government is
partnering with p rivate compa-
nies to set up drive-through coro-
navirus testing sites after a week
of unrelenting criticism from
lawmakers and frustrated Ameri-
cans unable to find out whether
they are infected.
At a Rose Garden news confer-
ence, the president said the push
to let people get tested from their
own cars would involve a new
Google website to advise consum-
ers about whether they should
get tested and where, and big-box
companies and drugstores that
would host drive-through testing
sites in their store parking lots.
State and federal health workers
would staff the sites and perform
the testing, officials said.
But several key participants
said the administration was over-
stating the plan, including its
scope, timetable and other as-
pects.
“This surprised all of us,” said
one state health official, who
spoke on the condition of a no-
nymity to discuss frankly how
state health departments had
gotten no advance notice. “This is
bizarre,” the official said, point-
ing out that he thought many of
the 6,000 U.S. Public Health Ser-
vice officers are deployed else-
where and could not readily be
shifted.
An hour after the news confer-
ence, a Google communications
account tweeted a comment from
Verily, the life sciences division of
Google parent company Alpha-
bet, that suggested the plan to
build a broadly available website
is nowhere close to complete.
“Verily is in the early stages of
development, and planning to
roll testing out in the Bay Area,
with the hope of expanding more
broadly over time,” the tweet
said.
Chief executives of Ta rget, Wal-
greens, Walmart and CVS
pledged during Friday’s news
conference to make space avail-
able in their store parking lots.
But asked about the plans after-
ward, representatives of t he com-
panies said they had few details
on how the tests would be admin-
istered or where or when they
would begin.
“We don’t expect a large num-
ber of CVS locations to offer
testing, given the other retail
companies involved,” said a com-
pany spokesman, Joe Goode, who
said sites would be chosen “in
close coordination” with admin-
istration officials and other re-
tailers.

The administration’s an-

nouncement of drive-through

testing and several other testing

initiatives Friday came a day after

a drubbing on Capitol Hill. At one

hearing, Anthony S. Fauci, long-

time director of the National

Institutes of Health’s National

Institute of Allergy and Infec-

tious Diseases, acknowledged the

U.S. testing system is “not really

geared to what we need right

now.... That is a failing. Let’s

admit it.”

Democratic and Republican

lawmakers have repeatedly

pressed administration health of-

ficials on why the United States

has not set up a model similar to

that in South Korea — a country

with a huge covid-19 outbreak —

in which drive-through testing

sites are widely available and do

not require a doctor’s prescrip-

tion, with results available rapid-

ly. At one hearing Thursday, Sen.

Ben Sasse (R-Neb.) called on offi-

cials to “get to the bottom of why

those problems are there.”

A senior administration offi-

cial, speaking on the condition of

anonymity to talk candidly, said

the concern now is less about

supply of tests than whether

Americans can find easy and

convenient places to get tested.

Another concern is setting up

testing sites away from health-

care facilities so providers and

others are not exposed to the

virus.

The virus is highly contagious,

and experts have urged the gov-

ernment and hospitals to figure

out how to set up testing methods

that will keep potentially sick

people out of hospital emergency

rooms s and doctors’ offices.

“ There is no reason” states

cannot “set up a drive-through ...

a clinic in a parking lot” for

patients to be swabbed and speci-

mens shipped off to labs to deter-

mine the results, the senior ad-

ministration official said.

The administration’s push to

boost drive-through testing

comes as several places around

the country have begun ramping

up such services. Mayo Clinic

opened such a facility this week,

according to Jack O’Horo, a Mayo

infectious disease specialist.

“This helps to protect other pa-

tients and staff from potentially

coming into contact with the

covid-19 virus,” he said.

New Rochelle, a New York City

suburb that has been designated

a coronavirus containment zone

after an outbreak there, on Friday

became the first East Coast site of

drive-though testing. Residents

can make appointments by

phone and then be tested from

their cars in a six-lane site set up

by the state’s health department.

Colorado’s health department

also has launched a drive-

through site in Denver, requiring

patients to bring a doctor’s note

saying they need a test. Such sites

also are available in Oahu, Ha-

waii, and Hartford, Conn.

In other measures announced

earlier Friday, the Food and Drug

Administration has created a 24-

hour emergency hotline for labo-

ratories having difficulty getting

materials or finding other imped-

iments to running tests, officials

announced.

Officials also said they were

giving nearly $1.3 million in fed-

eral money to two companies

trying to develop rapid coronavi-

rus tests that could determine

whether a person is infected

within an hour.

I n addition, the Department of

Health and Human Services as-

signed Brett Giroir, the assistant

secretary for health, to coordi-

nate all coronavirus testing ef-

forts among federal public health

agencies, including the FDA and

the Centers for Disease Control

and Prevention, as well as state

and local health departments

and public and private clinical

laboratories.

The FDA also is giving New

York state the ability to authorize

certain public and private labs to

test for the virus under the aegis

of the state health department,

without first getting federal ap-

proval.

Earlier this week, New York

Gov. Andrew M. Cuomo (D) an-

nounced he was moving ahead to

contract with 28 private labs in

New York.

“We’re not in a position where

we can rely on the CDC or the

FDA to manage this testing pro-

tocol,” the governor said.

Cuomo said he told the private

labs they should “get up, get

running and start moving for-

ward with testing.”

In addition, the FDA autho-

rized a coronavirus test devel-

oped by the manufacturer Roche,

making it the third diagnostic

test approved for use in the

outbreak.

Another senior administration

official said the government was

starting to collect data from pri-

vate laboratories on the number

of tests they performed daily. The

administration has been repeat-

edly criticized for knowing the

volume of tests performed by the

CDC but not a nationwide total

from all the state and local and

hospital labs involved in corona-

virus testing.

[email protected]

[email protected]

[email protected]

Abha Bhattarai and lena H. sun

contributed to this report.

Trump says drive-through testing sites are in the works

AlBA VIgArAy/ePA-eFe/sHUTTersToCK

Medical personnel in protective suits wait to take information from people Friday at a new drive-through coronavirus testing center in New Rochelle, N.Y., making it the first

East Coast site for such testing. The New York City suburb has been designated a coronavirus containment zone after an outbreak of pathogen there.

Partnership with private

store chains apparently

remains in early stages