The Government Accountability Office found that the Social Security Administration is facing challenges in recovering the $62 million it spent on a service launched in 2020 to combat synthetic identity fraud due to a low number of industry subscribers.

SSA aims to recover all Electronic Consent Based Social Security Number Verification service rollout costs by the end of fiscal year 2027 in compliance with a 2018 law; however, it only collected about $25 million in user fees as of the end of FY 2023, meaning it will need to collect about $14 million annually to meet its goal, GAO said in a report released on Thursday.

The government watchdog also found that the agency did not follow guidance and best practices for service cost estimation.

Subscription data through December 2023 showed that the service has not significantly increased users since enrollment opened in FY 2022. Collections also decreased after the SSA increased fees in July 2023.

Despite the challenges, SSA officials told GAO that they did not plan to take significant steps to increase the use of the service which, according to subscribers, provides difficult-to-interpret verification results.

To resolve the issue, GAO made recommendations to the SSA, including implementing appropriate controls over IT investments, updating cost estimation guidance and developing strategies to expand service use.

The agency concurred with all recommendations.

The National Security Agency announced that U.S. and U.K. authorities have released a new joint cybersecurity guidance recommending measures for network defenders to address ongoing cyber threats from the Russian Federation Foreign Intelligence Service, or SVR. 

The joint advisory listed the common vulnerabilities and exposures that SVR is exploiting through various malicious tactics, such as spearphishing, password spraying, malware deployment, cloud exploitation and living off the land, or LOTL, attacks, the NSA said Thursday.

The new eight-page joint cybersecurity advisory, titled  “Update on SVR Cyber Operations and Vulnerability Exploitation,” is co-authored by the NSA, the FBI, the U.S. Cyber Command’s Cyber National Mission Force and the U.K.’s National Cyber Security Centre, or NCSC.  

To reduce the potential SVR attack surface, the advisory suggests disabling unnecessary internet-accessible services, restricting access to trusted networks and removal of unused applications in workstations. 

Other advisory suggestions include multi-factor user authentication and regular audits of cloud-based accounts and applications 

Additional mitigation measures on Russian exploitation of cloud environments are contained in another joint cybersecurity advisory issued in February. The earlier guidance was spearheaded by the U.K.’s NCSC and supported by international partners including U.S., Canadian, Australian and New Zealand security agencies.