VA disputes charge that it transmits unencrypted personal data over public Internet
Investigation by Inspector General's office finds that VA centers don't encrypt personal data during transmission to other offices
Computerworld - The Office of Information Technology at the U.S. Department of Veterans Affairs has disputed a finding by the agency's Inspector General that several VA centers routinely transmit unencrypted sensitive personal data over the public Internet.
The probe by the IG's office was launched following a complaint last year that three VA Medical Centers in the Midwest Health Care Network were transmitting personally identifiable information over unencrypted telecommunications carrier networks.
The investigation found the allegations to be true, said VA assistant inspector general for audit and evaluations Linda Halliday in a report released this week.
Investigators from the IG's office visited the three VA medical centers cited in the complaint. They centers are located in Fort Meade and Sioux Falls, S.D., and in Omaha, Neb.
The IG's office discovered that unencrypted sensitive information, including names, Social Security Numbers, dates of birth, and protected health information of veterans and their dependents, were sent from the targeted VA centers to other VA facilities, the report said.
In addition, the two facilities in South Dakota regularly used the same unencrypted telecommunications carrier network to transmit sensitive data such as x-rays and other radiographic patient images to external organizations.
IT staff at the VA centers told investigators that sending unencrypted sensitive data to other VA centers and to outside business partners was a common practice at more than just the three centers involved in the probe.
The transmission of unencrypted personal data violates internal VA security rules and does not satisfy Federal Information Security Management Act requirements. "Despite VA and [FISMA] requirements, VA has not implemented a configuration control that would ensure encryption of sensitive data," the report said.
"Unencrypted sensitive VA data could be used to perpetrate various types of fraud, including tax fraud," the report cautioned.
The report called on the VA to immediately implement encryption controls to protect data during transmission.
Roger Baker, VA assistant secretary for information and technology, rejected the IG's assertions.
He contended that personally identifiable information is not transmitted in the clear by any VA center.
Baker said the carrier networks used by the VA to transmit sensitive data to are completely segmented and not exposed to the public Internet. The VA, he said, uses a Multiprotocol Label Switching (MPLS) service from its carriers to ensure it has a private and segmented network for transmitting data.
"These carrier services provide VA with a private network and do not place traffic on the Internet," he said.
Baker conceded that the network links investigated by the IG's office were not using encryption but insisted the data was not traversing the public Internet.
When the complaint reached the VA last year, the agency's IT team inspected the communications circuits that were involved, reviewed all associated network equipment and interviewed network administrators, Baker said. "All of the findings conclusively substantiated that traffic is traversing only VA's private network," he said
Even so, the VA's IT organization has initiated a comprehensive review to ensure that sensitive data is being routed in a secure manner, he noted.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan, or subscribe to Jaikumar's RSS feed . His e-mail address is email@example.com.
- U.S. urged to let companies 'hack-back' at IP cyber thieves
- Texas drone bill sparks a battle
- How to keep the feds from snooping on your cloud data
- Google allowing Android app vendors to illegally collect user data, lawsuit alleges
- State social media privacy laws a mixed bag for businesses
- First California lawsuit over mobile privacy issues crashes
- Bill would put mobile app vendors on the hook for privacy
- Florida poised to become first state with anti-drone law
- White House signals it won't support CISPA in present form
- Microsoft takes new 'Scroogled' shot at Google
Read more about Government IT in Computerworld's Government IT Topic Center.
- The 20 Best iPhone/iPad Games of 2013 So Far
- 9 Steps to Build Your Personal Brand (and Your Career)
- 7 Consumer Technologies Coming to an Enterprise Near You
- 11 Signs Your IT Project is Doomed
- A walking tour: 33 questions to ask about your company's security
- 15 social media scams
- The 7 elements of a successful security awareness program
- IT Certification Study Tips
- Register for this Computerworld Insider Study Tip guide and gain access to hundreds of premium content articles, cheat sheets, product reviews and more.
- Federal IT Innovation Caught in a Catch-22
- Fed resources shoring up old infrastructure, holding back new technologies.
- Harness IT -- An Introduction to Business Intelligence Solutions
- Learn the key selection criteria required to provide your organization with the capability to address structured data, unstructured data and mobile demands so...
- Business Intelligence Shows its Smarts
- Today's Business Intelligence (BI) tools provide a new way to think about data with self-service capabilities and user-friendly analytics that can be used...
- Proactive Planning for Big Data
- Big data is less about the terabytes and more about the query tools and business intelligence needed to make sense of massive amounts...
- Inquiry Spotlight: Consumer-Facing Identity
- The challenges of consumer-facing identity management, access management, and authentication differ in ways subtle and dramatic from those of the employee-facing variety. All Government IT White Papers
- Becoming An Analytics Driven Organization
- Join us on Tuesday, June 18, 2013, 11:00 AM EDT and learn how your agency can create an analytics culture that will enable...
- 3 Reasons Why Sepaton is the World's Fastest Backup Solution
- Leading analyst, Storage Switzerland learns how Sepaton backs up and deduplicates massive data volumes while maintaining the industry's fastest performance - all in...
- Enterprise File Sharing: All You Need to Know
- Security. Scalability. Control. These are just some of the many benefits of enterprise cloud file-sharing that you'll discover in this KnowledgeVault, packed with...
- Bridging HTTP and FTP with FileXpress Internet Server
- What if you could take an FTP server on your internal network, and allow external users (partners or customers) to securely access it...
- MFT and FileXpress - An Overview
- Business users and applications exchange files on a regular basis. File transfer is a core part of the flow of business activity. All Government IT Webcasts