This Washington Post article, http://www.washingtonpost.com/world/us-agencies-respond-to-cyberattack-o..., makes some interesting assertions about the incident.

===
"The tokens would generally be used when a government employee is trying to gain access to a computer system while on a personal computer or laptop."
===