Skip the navigation

Federal Breaches Spark Security Review Push

GAO, administration officials call for look into data collection processes

June 19, 2006 12:00 PM ET

Computerworld - The massive data breach disclosed last month by the U.S. Department of Veterans Affairs has triggered sweeping reviews of information security policies at the VA and at several other government agencies that recently suffered smaller data losses.

And last week, officials at the Government Accountability Office and the White House Office of Management and Budget (OMB) said that federal agencies as a whole need to review their processes for collecting and storing data and controlling access to it.

The string of data breaches highlights the fact that agencies have to take a more strategic approach to guarding personal information, said Linda Koontz, director of information management issues at the GAO.

"We are believers in the notion of privacy impact assessments -- of looking at the implications of the information you are collecting and how to protect that," Koontz said in an interview after she testified at a hearing held last Wednesday by the House Committee on Veterans' Affairs.

The recent breach disclosures prompted the OMB to direct all agency heads to describe the specific steps they are taking to implement the requirements of the Federal Information Security Management Act in their annual reports on their compliance with FISMA.

"Agencies have a responsibility to ensure that they are FISMA-compliant and that their employees are trained to work with tough security measures," an OMB spokeswoman said. She added that the OMB has set "sound standards and policies" based on FISMA's mandates and is working with agencies "to make sure practices match these policies."

A Stronger FISMA

Rep. Tom Davis (R-Va.), chairman of the House Committee on Government Reform, last week promised to introduce legislation seeking to strengthen breach-notification requirements at agencies. His vow followed a belated disclosure by the Department of Energy that the Social Security numbers and other personal data of about 1,500 employees and contract workers were compromised by a hacker last September.

In addition to the VA and the Energy Department, the Social Security Administration and the Internal Revenue Service recently acknowledged that they had been hit by data breaches.

Davis has said the recent incidents highlight the need to strengthen FISMA's requirements. At a VA-related hearing that the Government Reform Committee held on June 8, he called for the addition of unspecified penalties and incentives to foster better information-security practices.

During the same hearing, VA Secretary R. James Nicholson expanded on some of the measures the agency is taking to prevent further breaches. Among them are a complete ban on using personally owned computers and laptops to log into the agency's networks, and an indefinite suspension of the practice of permitting VA employees to download claims files and work on them from home. Nicholson said he has also ordered a complete recall of all agency-issued laptops for a comprehensive security review by the end of this month.

Our Commenting Policies
Internet of Things: Get the latest!
Internet of Things

Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!