What SolarWinds revealed about the gaps in enterprise IT security

Federal agencies have taken significant steps to fortify their IT environments over the past couple of years. But as the latest cycle of security breaches and ransomware attacks have made abundantly clear, cybercriminals are only growing more sophisticated and persistent.

One global cybersecurity leader that successfully sidestepped the malicious impact of the SolarWinds software supply chain attack and is helping government agencies adopt zero trust strategies is Palo Alto Networks.

In this exclusive interview, FedScoop talks with Dana Barnes, senior vice president U.S. public sector sales at Palo Alto Networks, about the security giant’s perspective on zero trust, what it learned during the SolarWinds incident, and what security steps government agencies still need to focus on most. 

FedScoop: The White House executive order on cybersecurity put a bright spotlight on the need for agencies to adopt zero trust security practices and modernize their security operations. What impact do you think the EO will have in actually moving agencies from a security compliance mindset to truly embracing zero trust?

Dana Barnes: First, there’s a lot more in that executive order than just zero trust. The EO reinforces a wide range of cybersecurity measures that are already out there. If you think about the FY ‘21 appropriations as an example, there were dollars set aside for cybersecurity. The National Defense Authorization Act also had funding for cybersecurity and tech modernization. And then there was America Rescue Plan Act.  All of these things were driving funding to address the problem long before the EO was released.

Most EOs often don’t have teeth, because there’s no funding tied to them. Here’s a case where the EO is picking up on themes where the federal government has already moved on the funding. So I believe that you’re going to see a significant move by these agencies over the next six months to start to address these issues.

And all you have to do is look at the Colonial Pipeline incident to know how bad things can get quickly, if you haven’t secured your environment. And, as you know it took them some time to get up and running once they fixed everything, so I think you will see federal agencies move more quickly. In fact, we have been receiving hundreds of calls from government in the federal, state and local space to discuss our approaches on zero trust, on threat hunting and securing the network as an offshoot of the President’s executive order.

FedScoop: What did you see from Palo Alto Networks perspective from the SolarWinds incident that could offer useful lessons as agencies begin to implement some of the steps outlined in the executive order?

Barnes: SolarWinds showed that the traditional [cybersecurity] approaches that have been in place are not necessarily going to meet some of the highly sophisticated attacks that we’re seeing now. The things we’re seeing with our customers is they’re confused — they just don’t know where to start. They are fatigued. They’re understaffed. And they’re not necessarily funded to do some of the things that they need to do.

From a Palo Alto Networks perspective, what we now understand and are advising customers is that you have to know what your attack surface actually is. How do the folks who are trying to break into your environment — how do they view you? What we’ve learned is that these bad actors actually analyze the customer; they analyze the network from the internet side of it, and if they can get in, they assess and look at everything.

I’ll give you a prime example. We procured a company called Expanse. They give us the ability to see how our environment touches the outside world. What are those open ports? What are those devices and their vulnerabilities outside in? A lot of federal agencies don’t do as great a job of understanding that. That’s step one.

Once you’ve done that assessment, and you know what your attack surface is, then you have to assess your entire environment. You need to know what problem you’re trying to actually solve. That’s the confusion piece —  where do I start? And then, identify where are the gaps and then you can prioritize and figure out where to go.

That’s a large part of what we do at Palo Alto Networks. It’s not just about the firewall. It’s not just about having a data lake and machine learning and analytics, which are very important. What we want our customers to do is understand what you look like; understand where your risks are; and then we can get into, how do we address the threats?

We can look at your network security, your firewalls, your endpoint protection, at your cloud protection — and see, how do you secure all these different connections to the cloud? What’s my attack surface? How does the enemy view me? And where will they attack?

FedScoop: You mentioned the American Rescue Plan that allocated almost $2 billion towards cybersecurity. That’s on top of nearly $10 billion requested in the President’s upcoming FY 2022 fiscal budget. Given those funding opportunities, what are the biggest issues agencies still face in actually modernizing their security operations?

Barnes: I think it’s a combination of size, complexity, manpower. If you look at some of our largest agencies, they have multiple contracts for cybersecurity going across multiple integrators. We have funding that has been locked and set that dictates what technology can be used. So what you’re going to deploy today isn’t sufficient because the requirements were done four years ago, and it just took that long to get the contract. So that’s a challenge.

Another challenge is you can’t just throw away what you already have. It’s not like Homeland Security can start completely from scratch and build an entire new cyber security structure. You have tools and processes in place, and you have to build upon them and leverage them. So you need approaches that allow you to take advantage of what you have — and weave in new capability — while you’re slowly upgrading those older capabilities. All of those older tools are still generating data. So how do you leverage the older tools? I think that’s where a platform approach is so crucial.

I think one of our strengths is we can come in and leverage what you already have today. We can slowly begin to replace those older things with new things that are fully integrated into what we have. So you can go on this journey, based upon where you are. Some customers have the ability to just start from scratch and go all the way. Other customers have to keep doing what they’re doing and take it step by step.

I would say the last challenges is that senior leaders in government need to become even more engaged in cybersecurity — and better understand the importance of cybersecurity to the overall mission, by asking questions. If you’re a director of an agency, you need to know what’s needed. It’s not just the sole responsibility of the network people and the CIO and CISO. It’s the job of every person in that organization. If leaders at the top don’t understand the urgency at the same level that the CIO and CISO does, agencies will still struggle.

FedScoop:  Given the vast range of security solutions available to agencies, what would be your recommendations for what agencies should focus on most?

Barnes: The first thing is to know what you have and what your current security posture really is. Then you can start deploying things like next generation firewalls, focusing on things like role filtering and enterprise data loss prevention. We would argue that we have some of the best technology in that space.

But then you have to take another step. And this gets into taking anti-ransomware measures. Ransomware is huge right now and the government in particular is a heavy target. So having the ability to leverage behavioral threat analysis is key.

One thing we learned from SolarWinds, using our Cortex XDR capabilities, was that artificial intelligence and machine learning capability was what saved us, because we were able to identify and see abnormalities and behavioral changes that weren’t normally there — and that an analyst who’s inundated with data may have missed. And that’s critical. So that automation piece is key.

From there, you can start to leverage things like data lakes, and the ability to collect all that data and do the analysis.

But we also recommend four critical components to securing your enterprise, starting with having integrated endpoint detection and response (EDR). We also recommend investing in modern security, operations, automation and response (SOAR) platforms — especially at the federal level. Another important security component, or pillar, is having internet operations management in place. And finally agencies need to commit to zero trust architecture and the strategies to achieve them.

I would argue that no one has fully implemented zero trust. People have different flavors and pieces. There are so many parts to your cybersecurity. But understanding where you are right now, what you look like, and what your posture is — that’s the most important thing to focus on first. If you can do that, then you know where to put your resources, you can prioritize, you can do your risk assessments to secure your environment.

We are urging our customers to leverage our experience and capability to give them that visibility into what they didn’t see. Every customer where we’ve leveraged Expanse — it’s really opened their eyes to what bad actors are seeing, and saying things like, “I didn’t realize that I was so at risk here, here and here.” 

Learn more how Palo Alto Networks is helping government organizations to “solar proof” their cybersecurity foundation.

Lawmakers look to create cyber training programs at CISA, VA

Lawmakers want to create cyber training programs at the Cybersecurity and Infrastructure Security Agency and Department of Veterans Affairs to bolster the federal workforce, through legislation introduced Friday.

The Federal Cybersecurity Workforce Expansion Act would launch a registered apprenticeship program at CISA and a veteran training pilot at the VA with costs to be determined.

Recent supply chain attacks like the SolarWinds hack, targeting agencies through a government contractor, underscored the lack of cyber talent at the federal level on down, with more than 500,000 job openings nationally, according to the National Institute of Standards and Technology.

“In order to bolster our cyber defenses and protect our critical infrastructure, we need to increase the number of cybersecurity professionals in the federal government,” said Sen. Maggie Hassan, D-N.H., in a statement. “This bipartisan bill will also help address the workforce challenges in the veteran community by standing up a cyber-training program at the VA to help veterans secure good-paying, stable jobs, and I urge my colleagues to join me in supporting this legislation.”

Hassan, who chairs the Subcommittee on Emerging Threats and Spending Oversight, is cosponsoring the bill with Sen. John Cornyn, R-Texas.

Should the bill become law, CISA would have two years to establish at least one apprenticeship program leading to employment at the agency or a company contributing to national cybersecurity and mostly funded by an contract, grant or cooperative agreement with the agency. The program must also meet CISA’s cyber work role needs and be registered with the Department of Labor’s Office of Apprenticeship or a similar state agency.

DOL, NIST, the Pentagon, National Science Foundation, and Office of Personnel Management would be expected to share resources with CISA, which may issue grants or cooperative agreements to companies or other entities to execute the program.

CISA would also need to report to Congress on the results of the program, including continued employment rate, every two years, as well as submit annual performance reports.

Under the act, the VA would have one year to create a pilot program providing cyber training using virtual platforms, hands-on skills labs and assessments, and federal work opportunities. Graduates would receive cyber credentials.

The program is expected to align with NIST’s National Initiative for Cybersecurity Education (NICE) Workforce Framework, and the VA would work with the Pentagon, Department of Homeland Security, DOL and OPM to make it a reality. Veterans and retiring active duty military personnel would be eligible.

A 2019 report from the Government Accountability Office examined the shortage of federal cyber talent. In May 2021, DHS announced a 60-day sprint to hire 200 cyber employees — 100 of them at CISA.

DOD may be underestimating risk in major IT systems, GAO report finds

The Department of Defense could be taking an overly optimistic approach to assessing cyber risk on several of its IT programs, according to the Government Accountability Office.

In a report published on Wednesday, the oversight agency said it had found at least 10 instances in major business IT programs audited, where independent assessments conducted by the DOD underestimated the level of cybersecurity risk.

The office has recommended that the DOD review how it conducts risk assessments across its IT system and warned that until it does so the department’s oversight of programs could be proving over-optimistic.

IT programs that the GAO says should be classified as having elevated risk levels include the DOD’s defense travel system, enterprise accounting and management system, logistics chain management systems, and the Marine Corps’ global combat support system.

GAO’s review also found challenges in DOD’s implementation of agile software practices. Among the concerns raised by the report were the inability of the department to hire the requisite staff and to manage the technical environments that are needed for agile software development.

The department has been trying to update its software practices to include agile development, which follows the principle of iterating and quickly updating code, and replaces the traditional waterfall method of IT development.

Former GSA chief acquisition officer Salmoiraghi joins HR consultancy

Jessica Salmoiraghi has joined human resources consultancy firm Golden Key Group as a vice president.

In her new role she will be responsible for leading shared and managed services at the company. She moves to the private sector after previously working at the General Services Administration as chief acquisition officer, a role that she left in January this year.

Salmoiraghi joined GSA in 2018 as associate administrator at the Office of Governmentwide Policy and chief acquisition officer. Before this, she was the director of federal agencies and international programs at the American Council of Engineering Companies.

The GSA has recently welcomed a new Administrator Robin Carnahan, who on Wednesday was confirmed in the role by Senate lawmakers by a voice vote.

Commenting on Salmoiraghi’s appointment, Golden Key Group CEO Gretchen McCracken said: “Jessica’s recent experience at GSA will be crucial to GKG’s growth as we expand our Shared and Managed Services practice in support of our federal clients.”

GSA, along with the Office of Personnel Management and the White House COVID-19 Response Team, has helped lead the Safer Federal Workforce Task Force, which is shaping the policies of federal agencies for getting staff back to the office.

Rep. Hice calls on IGs to assess telework’s impact on agency performance

Rep. Jody Hice, R-Ga., has called on inspectors general to assess the impact of remote working on federal agencies’ missions and the performance of their employees.

In a statement Thursday, Hice said it was “clear” that the increase in the number of federal employees working from home had contributed to delays, inefficiencies, and declines in performance.

“I’m calling on inspectors general to investigate the overall impact telework had on our federal agencies during this pandemic and report back to Congress so we can accurately assess how to move forward before rushing into foolhardy reforms,” the lawmaker said.

The congressman has written to the inspectors general of 10 agencies, including the departments of Defense, Justice and Homeland Security, asking them to look into the impact of mass telework over the past 16 months. Hice is a ranking member on the Subcommittee on Government Operations, which is part of the House Committee on Oversight and Reform.

Agencies across the federal government have been given a July 19 deadline by which they must finalize plans to get staff back into the office, a process that is being overseen by the White House-backed Safer Federal Workforce Task Force.

However, according to new guidance issued as part of the return-to-office program earlier this month, agencies have been instructed to consider embracing a more virtual workforce.

A joint memorandum sent by the Office of Management and Budget, the Office of Personnel Management and the General Services Administration said that such a move should be taken “where possible and appropriate.”

Pentagon installs Garstka as acting CISO for acquisition and sustainment

Former U.S. Air Force officer and long-time cybersecurity specialist John Garstka has taken up the role of acting CISO for acquisition and sustainment at the Department of Defense, FedScoop has learned.

In the new post, Garstka will be responsible for leading the integration of security and cyber efforts within the Office of the Under Secretary of Defense and work to ensure security within the department’s technology supply chain. According to sources, he takes over the role on an interim basis from Katie Arrington.

Garstka is a Pentagon veteran, having worked in military research and development since 1984, including over a decade within the space division of the U.S. Air Force. Since 2012, he has held leadership roles within the Office of the CISO at the DOD, most recently as director of cyber programs. Between 2000 and 2002 he was CTO for the Joint Chiefs of Staff.

It is not immediately clear how much of a role Garstka will play in the management of the Cybersecurity Maturity Model Certification Program (CMMC). Recently-installed Deputy Assistant Secretary of Defense for Industrial Policy Jesse Salazar in May told Congress that he now has oversight of CMMC.

One of the core responsibilities of a CISO for acquisition and sustainment at the DOD is to ensure the digital security of weapons systems across the military.

Services have struggled with cybersecurity risks within the defense supply chain. In 2019, a landmark report by the Department of the Navy found that the service had failed to account for the fact that defense companies it contracts with would be aggressively targeted by foreign hackers for their valuable data.

The DOD, in response, has ramped up its implementation of measures such as the CMMC program.

In November last year, the Department of Defense appointed Dave McKeown, a long-time government IT and security official, as chief information security officer. He replaced former CISO Jack Wilmer, who departed in July to lead a private security company.

The DOD declined to comment.

Navy CDO Sasala says service has a ‘massive’ data duplication problem

The Navy will spend the rest of 2021 inventorying its data and solidifying management roles and responsibilities because making department-wide data policy is currently daunting, said Chief Data Officer Tom Sasala on Thursday.

Like other departments, the Navy is drawing on the Federal Data Strategy 2020 Action Plan and its Department of Defense Data Strategy Implementation Plan to focus its efforts. But the department didn’t meet the 2020 Action Plan’s six-month target for inventorying its data because of its size and scope, Sasala said.

Just how quickly the action will be completed is unclear because data quality and, more specifically, duplicate sets of low-quality data remain a problem for the Navy.

“We’re finding just massive, rampant data duplication,” Sasala said, during an AFFIRM event. “And so that’s actually hurting us much more than the quality itself.”

The data exists across multiple systems, and users have been allowed to “quote unquote innovate” with it without the Navy having a handle on its pedigree or provenance, he added.

Sasala said his priority is identifying “authoritative” datasets and where they come from while establishing who can use them and for what purposes.

Previously the Navy sought to establish authoritative systems, but not all data in a system is authoritative for the purpose the system was created. For instance, the Navy Enterprise Resource Planning financial management system serves as a general ledger for components, but not all users or even the department’s organizational structure.

At the same time, the Navy has created deputy data officer positions for the Navy and Marine Corps, which didn’t previously exist, and is working on establishing associate data officers for every command. Fortunately most commands already had associate data officers acting under different titles like “data analytics for the command” or “command data officer,” confusing because the acronym is CDO.

Sasala is in the process of appointing people to those roles and delegating statutory responsibilities from the OPEN Government Data Act to them, as well as creating a mechanism for holding them accountable for the work.

The Navy has also taken “great strides” injecting data and data professionals into its acquisition review process, known as Gate 6 reviews.

“Rather than allowing something to go into production that doesn’t have APIs and it doesn’t have data standards and is a closed ecosphere — that we can’t get access to the data and all this other stuff — we’ll have some say in some regard about whether or not we want to make that investment,” Sasala said.

What government CIOs need for AI to succeed

Kirke Everson is a principal in KPMG’s Federal Advisory practice, focusing on technology enablement, intelligent automation, program management, process improvement, cyber security, risk management, and financial management. He currently serves as the government lead for Intelligent automation for KPMG in the U.S.

Federal and state government leaders are witnessing the expansion of artificial intelligence all around them. From back-office automation, that can help reduce backlogged work, to cognitive platforms, that can identify and respond to natural language requests to better serve the public, AI and automation have become a driving force in addressing mission and business objectives.

That’s clearly evident in speaking directly with federal and state government CIOs in multiple roundtable discussions over the past several weeks. Based on the use cases they described, it’s clear that agencies are making significant headway in putting AI to work.

At the same time, there are a variety of issues where government CIOs also need broader support. The issues they and their executive teams face, in many ways, are not that different from previous technology breakthroughs that tended to upend familiar work processes. The technology component — like the disruption of mobile and cloud technology — is only part of a larger equation involving processes, policy, culture, governance and ethics. That said, government is already seeing the value of AI, especially in light of unprecedented citizen demands for agency services during the pandemic.

CIOs in these roundtable discussions expressed a collective optimism and determination for how government can and must put AI to work. There was a broad consensus that they cannot delay integrating AI into their operations. “It’s not a question of when, but how we allow AI to come into our processes,” said one leader.

What’s critical now for agencies is to address these larger policy issues. At the same time, they also need to assess and select the right technologies for more advanced use cases; establish the means to scale AI solutions; and improve the quality of, and access to, clean and digestible data.

It’s getting to the “how” that CIOs are now wrestling with. Here’s a partial list of what many of them say their organizations still need from their leadership to ensure AI will live up to its promise:

Clearer use cases — We have already seen how AI is helping government agencies to analyze data, automate responses through robotic process automation and augment employee workloads. But agencies have all kinds of opportunities to build upon those successes to develop more advanced use cases, where more complex AI components can be applied to drive innovation and strategic decision making for better mission outcomes. Fortunately for government, AI’s application in commercial sectors — for detecting fraud, for example — are demonstrating tangible results and offer a helpful roadmap for what’s possible.

Greater data preparation — The ability to readily identify useful patterns in government data depends on having clean and reliable data to work with. Given the volume and velocity of data agencies generate, CIOs need modernized IT infrastructure, more robust data management applications and the resident skills to capitalize on them. Here is where automation and AI solutions can be part of the solution, to help access, consolidate, normalize and cleanse data.

Commitment to trustworthiness — This was one of the top concerns among CIOs in these discussions. It is vital that senior leadership establish and implement an ethical and responsible approach to AI, that adequate controls be put in place, and that agencies execute against an ethical AI framework. Without those safeguards, agencies run the risk of relying on untrustworthy or biased data or undermining the productivity gains AI promises.

Greater governance — Decisions need to be made on how agencies will manage the application of AI, which use cases to pursue and how to implement, scale, monitor and evaluate the impact of AI. CIOs can’t do that alone. Governance will also play a key role in building in proper checks and balances and guidance on how AI is ultimately put to work — and ensuring that AI initiatives conform with wider accepted practices.

Broader training — Artificial intelligence is more than the technology that creates it. It is a powerful set of outcomes that requires care, calibration and control — beginning with the data that goes into it and for the decisions that come out of it.  Not unlike the fields of medicine or building design, AI will require specialized and continuous training at many levels across every organization endeavoring to integrate AI into its operations.

There’s no question, AI promises to be an incredible force-multiplier in helping government better serve the public. CIOs have a unique perspective and a critical role to play in all of these areas.  But AI’s promise also hinges on agency leaders focusing on the mission or business, developing clear use cases, and then applying the technology, not the other way around.

Learn more about how KPMG can help your organization harness AI more effectively.

CMMC uncertainty threatens small contractors, business leaders warn

Small business owners warned members of Congress on Thursday that uncertainty over the costs and timeline of the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) program could push their enterprises out of the defense industrial base.

In testimony given to a House Committee on Small Business subcommittee, they also raised concerns over the department’s communication strategy for the scheme, saying it has allowed information to trickle out through social media, rather than contacting affected contractors directly.

“There is no consistent method or message from DOD,” said Michael Dunbar, a small business president who testified on behalf of HUBZone Contractors National Council. “A lot of small businesses have been ignored.”

CMMC will require third-party certification that contractors meet a five-tiered range of security controls. Critics say that the cost of meeting those standards could fall unfairly on small businesses because they have fewer resources to deploy on cybersecurity than large defense firms.

Dunbar said during the hearing that much of the communication around the implementation of the scheme had been conducted through LinkedIn and urged the DOD to formalize its communication with industry with official policy documents.

“It’s basically been kept to a very small group of people that are running all of this and then we get told later on what is happening,” he said.

In testimony, the CEO of professional services contractor T47, Tina Wilson, warned that uncertainty over costs and the implementation timeline for the regime had left many small businesses fearful of being shut out of the defense industry.

“The fear could be real,” she told lawmakers. T47 provides policy procedures and analysis services to agencies within the DOD.

Jonathan Williams, a partner at law firm PilieroMazza, warned that the DOD must clarify which of the five levels of CMMC contractors would qualify for. He noted also that one potential avenue for reducing the cost of certification to small businesses would be to ensure prime contractors are largely responsible for ensuring subcontractors adhere to cybersecurity requirements.

“If we can keep as many small businesses as possible at level one, that will strike the right balance,” Williams told the committee.

The attorney said also that the DOD must explain how it intends to meet a self-imposed 2026 deadline to make CMMC a requirement in all contracts.

In response to the concerns, subcommittee Chair Rep. Dan Meuser, R-Penn., called for the creation of a platform through which the DOD can hear concerns over the implementation of the scheme.

“I think we can conclude that these measures are overly harsh and we do need to create a forum to have this discussion with DOD,” he said.

The hearing on Thursday came after electronics manufacturer trade group IPC earlier this week published a study that found 24% of industry respondents anticipate being pushed out of the defense industry due to the costs and burdens of CMMC.

A separate report published by the Alliance for Digital Innovation on Tuesday also warned about the risks of implementing “expensive but emerging requirements that are not ‘fully baked’” in the federal acquisition space.

“A clear example is the rush to impose the emerging standards of the Department of Defense’s Cybersecurity Maturity Model Certification (CMMC) requirements into civilian agency procurements,” the study said.

Lawmakers push DOJ to investigate China Initiative after engineer’s mistrial

Democratic lawmakers urged the Department of Justice to investigate FBI misconduct under an initiative for prosecuting people stealing trade secrets, hacking or spying for China, in a letter published last week.

The note specifically asks DOJ Inspector General Michael Horowitz to look into the failed prosecution of Anming Hu, a former engineering professor at the University of Tennessee, who was fired after FBI agents told his employer he was suspected of stealing government secrets for the Chinese military.

Hu was the first person prosecuted under the Trump administration’s China Initiative, the methods of which are being questioned after a jury deadlocked in his trial June 16 — following testimony from the investigating FBI agent that he spent 21 months surveilling Hu but doesn’t believe he was ever a spy, reported the Knoxville News Sentinel.

“As members of the House Judiciary Committee, we are deeply troubled by the alleged misconduct of the [FBI] in the unsuccessful prosecution of University of Tennessee at Knoxville associate professor Anming Hu,” reads the letter. “The FBI allegedly falsely accused professor Hu of being a Chinese spy; falsely implicated professor Hu as an operative for the Chinese military; and used false information to put professor Hu on the federal no-fly list — among a number of other actions.”

Reps. Ted Lieu, Calif., Mondaire Jones, N.Y., and Pramila Jayapal, Wash., want Horowitz to determine if the China Initiative pressures personnel at DOJ, which includes the FBI, into racially and ethnically profiling people.

During his testimony, FBI Agent Kujtim Sadiku couldn’t recall who tipped him off Hu might be a spy and said he’d encouraged Hu to attend a symposium in China and report back on security concerns, reported the News Sentinel.

When Hu refused, FBI surveillance began, Hu’s bosses were informed and he was ultimately charged, not with espionage, but fraud for concealing his affiliation with Beijing University of Technology while receiving NASA funding — an accusation Hu denies.

Chinese universities are considered to be incorporated under Chinese law. As such, U.S. laws that prevent high-ranking federal employees from working for Chinese companies can also prevent them from working at Chinese universities.

The letter asks Horowitz to investigate whether false information was used against Hu and whether false accusations were made. It also calls for clarification over whether the Department of Justice was aware of concerns over false accusations, and whether racial or ethnic profiling occurred.

In the missive, lawmakers also seek to determine whether the decision to open an investigation was based on adequate facts and whether the China initiative pressures DOJ personnel into profiling people.

The Department of Justice did not respond to a request for comment.