US Congress investigates Federal Reserve breaches

A US congressional committee has launched an investigation into the Federal Reserve's cyber security practices after reports revealed more than 50 cyber breaches at the US central bank between 2011 and 2015. 

The house committee on science, space and technology on Friday sent a letter to Federal Reserve chair Janet Yellen to express "serious concerns" over the central bank's ability to protect sensitive financial information. 

The request for information was made in a letter signed by committee chairman Lamar Smith, a Texas Republican, and Barry Loudermilk, a Georgia Republican and chairman of the panel's oversight subcommittee. 

"These reports raise serious concerns about the Federal Reserve's cyber security posture, including its ability to prevent threats from compromising highly sensitive financial information housed on the agency's systems," the letter said. 

The panel asked the Fed's national cyber security team – the national incident response team – to turn over all cyber incident reports in unredacted form from January 1, 2009, to the present. 

It also asked for incident reports from the Fed's local incident response teams. 

The letter cited the Reuters report, which was based on heavily redacted internal Fed records obtained through a Freedom of Information Act request. 

The redacted records in that report did not say who hacked the bank's systems or whether they accessed sensitive information or stole money. 

However, they do show the central bank's staff suspected hackers or spies were behind many of the breaches.  

A Fed spokesperson said the central bank had received the panel's letter and "will respond to it." 

Global policymakers, regulators and financial institutions have become increasingly concerned about the security of the international banking system after a string of cyber attacks against banks in Bangladesh, Vietnam and elsewhere linked to fraudulent transaction messages sent across the global financial platform SWIFT. 

The probe into the Fed's security practices followed a separate inquiry by the same committee into the Federal Reserve Bank of New York's handling of the cyber theft of US$81 million (A$110 million) from one of its accounts held by the central bank of Bangladesh. 

The panel also requested a "detailed description of all confirmed cyber security incidents" from 2009 to the present, all documents and communications referring or relating to "higher impact cases" handled by the Fed's NIRT team. 

The request covers all documents and communications with the Fed's Office of Inspector General related to confirmed cyber incidents, and an organisational chart detailing the Fed's top cyber security personnel. 

The committee requested a response to its inquiry by June 17. 

The Fed had declined to comment on the records, which represent only a slice of all cyber attacks on the central bank because they include only cases involving the Washington-based Board of Governors, a federal agency that is subject to public records laws.