US law-enforcement agencies are at risk of being spied on and hacked because some of their field offices are located in foreign-owned buildings without even knowing it, according to a new government report.
The report by the Government Accountability Office, which was obtained by CNN and is due to be released later Monday, reveals that a number of FBI, Homeland Security, Secret Service and Drug Enforcement Agency offices across the country are housed in space leased from firms based in China and other nations.
Experts told the GAO that the agencies could be vulnerable to espionage and cyber intrusions because the foreign owners could gain unauthorized access to the properties, be able to secretly install surveillance equipment, and have knowledge of building systems like heating, ventilation and electronics which could facilitate hacking.
The General Services Administration, which handles leasing for many federal agencies, is renting space in 20 buildings from foreign owners — and its investigators were unable to identify who the property owners for about one-third of the government’s more than 1,400 “high-security leases.”
Nine of the 14 agencies the GAO contacted were unaware the building space they were using was foreign owned.
“It’s an eye opener,” Rep. Jason Chaffetz, R-Utah, told CNN about the report. “Certainly our security professionals should know who owns the piping in the buildings that they occupy.”
Chaffetz, along with Sen. Tammy Duckworth, D-Illinois, and Rep. Elijah Cummings, D-Maryland, called for the GAO review.
The chairman of the House Oversight and Government Reform Committee said he doesn’t necessarily think the agencies should be barred from leasing office space from foreign owners, but added that he would feel “much more comfortable if they’re at least aware.”
Currently, the GSA is not required to determine whether a building is foreign owned when it is considering whether to lease space.
Among the report’s findings were that DEA, Homeland Security and Secret Service offices in Little Rock, Arkansas, Jacksonville, Florida, and Shreveport, Louisiana, along with an FBI office in St. Louis, Missouri, were leased from “Gemini Investments” — a company based in China.
The GAO report noted that Chinese-owned properties were of particular concern because the country has been linked to numerous instances of hacking.
After the Waldorf-Astoria Hotel in Manhattan was sold to Chinese investors, then-President Barack Obama didn’t stay there, as had long been the custom of US presidents, with security concerns being one of the factors.
Other federal offices listed in the study are located in buildings owned by companies in Canada, Israel, the United Kingdom, Germany, South Korea and Japan.
GAO investigators talked to officials who assess foreign investments in the US, as well as real estate representatives, who warned about the potential danger.
” … (L)easing space in foreign-owned buildings could present security risks such as espionage, unauthorized cyber and physical access to the facilitates, and sabotage,” the report said. “For example, a DHS foreign investment official said that potential threat actors could coerce owners into collecting intelligence about the personnel and activities of the facilities when maintaining the property.”
The report also noted other possible “insider threats,” referring to “disgruntled employees, contractors, or other persons abusing their position of trust” who pose a “significant threat” to building access.
But this doesn’t mean that the threats have materialized. Chaffetz said he was unaware of any specific instances where sensitive information had been compromised. The report also said two real estate representatives determined it wasn’t a security risk to lease foreign-owned space.
“One of the representatives said that access at high-security facilities is strictly controlled, including access by the owners, and that passive investors in properties do not have access to the buildings,” the report said.
In addition to hacking and espionage, the report also cautioned that renting from foreign owners presented the possibility of the US agencies becoming unwittingly involved in money laundering, since real estate purchases are often used to conceal the criminal source of the investment funds.
The report recommended that the GSA should start informing the agencies if their space is foreign owned, so they can put the necessary security precautions in place. The GSA said it agreed with the recommendation.
“I hope this is a wake-up call,” Chaffetz said.
