Federal Breaches Spark Security Review Push

GAO, administration officials call for look into data collection processes

The massive data breach disclosed last month by the U.S. Department of Veterans Affairs has triggered sweeping reviews of information security policies at the VA and at several other government agencies that recently suffered smaller data losses.

And last week, officials at the Government Accountability Office and the White House Office of Management and Budget (OMB) said that federal agencies as a whole need to review their processes for collecting and storing data and controlling access to it.

The string of data breaches highlights the fact that agencies have to take a more strategic approach to guarding personal information, said Linda Koontz, director of information management issues at the GAO.

"We are believers in the notion of privacy impact assessments -- of looking at the implications of the information you are collecting and how to protect that," Koontz said in an interview after she testified at a hearing held last Wednesday by the House Committee on Veterans' Affairs.

The recent breach disclosures prompted the OMB to direct all agency heads to describe the specific steps they are taking to implement the requirements of the Federal Information Security Management Act in their annual reports on their compliance with FISMA.

"Agencies have a responsibility to ensure that they are FISMA-compliant and that their employees are trained to work with tough security measures," an OMB spokeswoman said. She added that the OMB has set "sound standards and policies" based on FISMA's mandates and is working with agencies "to make sure practices match these policies."

A Stronger FISMA

Rep. Tom Davis (R-Va.), chairman of the House Committee on Government Reform, last week promised to introduce legislation seeking to strengthen breach-notification requirements at agencies. His vow followed a belated disclosure by the Department of Energy that the Social Security numbers and other personal data of about 1,500 employees and contract workers were compromised by a hacker last September.

In addition to the VA and the Energy Department, the Social Security Administration and the Internal Revenue Service recently acknowledged that they had been hit by data breaches.

Davis has said the recent incidents highlight the need to strengthen FISMA's requirements. At a VA-related hearing that the Government Reform Committee held on June 8, he called for the addition of unspecified penalties and incentives to foster better information-security practices.

During the same hearing, VA Secretary R. James Nicholson expanded on some of the measures the agency is taking to prevent further breaches. Among them are a complete ban on using personally owned computers and laptops to log into the agency's networks, and an indefinite suspension of the practice of permitting VA employees to download claims files and work on them from home. Nicholson said he has also ordered a complete recall of all agency-issued laptops for a comprehensive security review by the end of this month.

The VA plans to require laptop users to submit their systems for a monthly review but has not yet decided how that will be done, a spokesman said.

Daniel Galik, chief of mission assurance and security services at the IRS, said at the June 8 hearing that the tax agency is "aggressively reviewing" information security processes after an employee lost a laptop. He added that the agency is looking for security technologies that will enable automatic encryption of all data on its laptops. The goal, he said, is to fully deploy such technologies within six months.

Federal Security Snafus
Department of Veterans Affairs

A laptop and an external disk containing personal data on 26.5 million veterans and active-duty personnel were stolen last month from the home of a data analyst.Social Security Administration

Social Security numbers and other data on about 200 people were stored and not properly secured on an employee-owned laptop that was stolen at a conference.Internal Revenue Service

An IRS employee lost a laptop containing personal data on 291 agency workers and job applicants after checking it as luggage on an airplane flight.Department of Energy

The apparent hacking of a server that took place last September but was just disclosed resulted in the potential compromise of data on more than 1,500 individuals.

Copyright © 2006 IDG Communications, Inc.

7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon