House panel: VA ignores cybersecurity warnings

Auditors with the U.S. Government Accountability Office (GAO) and the VA's own inspector general's office said at today's hearing that they have no authority to force the VA to comply with their recommendations. In addition, the VA doesn't give its CIO authority to implement the recommendations without approval from three undersecretaries in the agency, said Michael Staley, the VA's assistant inspector general for audits.

"They have a long way to go to mitigate their vulnerabilities and have a comprehensive IT security program," he said.

The GAO has issued multiple reports about VA cybersecurity problems since 2000, and the VA has received a failing grade in four of the past five years on an annual cybersecurity review by the House Government Reform Committee.

The agency seems to focus on individual medical centers or regional centers in fixing identified problems, instead of fixing those problems agencywide, Staley said. "The responses we get back to those recommendations is, 'We've take action at Site A,'" he said. "Then the next year, we ... go to Site B, and we see the same conditions exist."

Committee Chairman Steve Buyer (R-Ind.) asked Staley and GAO auditors who was responsible if VA officials ignored cybersecurity warnings. Auditors are working with the White House Office of Management and Budget to work on cybersecurity problems across the U.S. government, said Linda Koontz, GAO's director of information management issues.

"We need to figure out, what are the lines of authority?" Buyer said.

The VA's decentralized management, with its three divisions largely responsible for their own IT security, has contributed to cybersecurity problems, Buyer said. "VA's internal controls in data security have been grossly inadequate for years," he said.