Interior officials accused of covering up IT security flaws

Senior Interior Department officials have been accused of threatening to demote the Bureau of Land Management's CIO in a bid to deter her and other federal employees from testifying forthrightly about the department's IT security flaws.Plaintiffs in a long-running lawsuit over funds the department holds in trust for American Indians asked the U.S. District Court for the District of Columbia to charge Interior Secretary Gale Norton, Department CIO Hord Tipton and others with civil and criminal contempt for retaliating against the bureau's CIO, Ronnie Levine.The court now has heard more than 50 days of testimony in a hearing intended to determine whether the court should order Interior's systems to be disconnected from the Internet again [GCN, April 5, 2004, Page 5], as the plaintiffs in the case of Cobell vs. Norton have requested.Judge Royce Lamberth is under no deadline to rule on the latest episode'the request to disconnect Interior's systems from the Internet or the claim of contempt'of this 9-year-old saga.Lamberth first severed nearly all the department's Internet links in December 2001 to protect trust data from hacking.Since then, department officials have obtained Lamberth's permission to reconnect most of their systems after having upgraded their security.A key point in the current hearing has been whether department IT officials have been honest in their testimony and with other evidence presented to the court about their efforts to upgrade the department's IT security. The plaintiffs, who represent some 500,000 American Indians seeking to recover upwards of $100 billion missing from the trust funds, contend that the department consistently has tried to mislead the court and conceal IT security flaws. They claim that faulty IT exposes the funds to theft and makes it impossible to account for them.According to the plaintiffs, Levine resisted efforts by Interior higher-ups to misrepresent Interior's IT security. Department officials retaliated by filing a negative report on her job performance, according to hearing testimony.According to the plaintiff's court filing last week, Levine took the stand July 1 and was visibly upset and unable to testify. 'The court and the plaintiffs then learned from the Department of Justice that Ms. Levine had been told, mere hours before she was to resume the stand, that she had been removed as bureau CIO.'BLM officials in Levine's office said last week that she was still in place as the bureau's CIO. Levine and Interior Department officials were not available to comment on her testimony that she had been told of her transfer to a less important job on July 1, or on the request for contempt charges. BLM spokesman Ken Greenberger referred inquiries to Levine.According to the recently unsealed testimony, Levine met with Larry Benna, BLM's deputy director for operations, at 12:30 p.m. on July 1. When Benna asked her how she was doing in court, Levine told the judge, 'I said, 'I think I'm done,' you know, and I was going to say more, but then he interrupted and he says, 'Oh well, ... we're moving you to Eastern States.' 'The plaintiffs contend that Benna told Levine about her removal and transfer to a less important job only after her testimony, to hide the retaliation from Lamberth.'Secretary Norton's senior managers viciously punished Ms. Levine for no reason other than providing truthful information to this court,' the plaintiffs told Lamberth. 'They did not do so by mistake.'The plaintiffs cited the department's 'vindictive nature and chilling effect' of the alleged retaliation on other department employees.Interior officials reject charges that its IT security is lax, both in court testimony and in other public statements.'What is telling in all this is there has never been evidence presented that there has ever been an intrusion in the department's systems that has been accomplished by anyone who was not an agent of the federal government or the court,' said Interior spokesman Dan Dubray.Various systems experts under contract to the court and the department have penetrated Interior's systems.The most recent report on Interior's IT security flaws came from the department's inspector general. Auditors reported that the systems are so easy to penetrate that they potentially could cause 'severe or catastrophic' problems.Computer specialists working for the IG pinpointed 24 servers that hold Indian trust data and said they were able to penetrate two servers and gain full, undetected access to the Bureau of Land Management's internal networks and intranet.Levine had clashed with her Interior supervisors over whether those systems should be certified as secure, according to her testimony.The auditors made several systems security recommendations, saying that if BLM did not adopt them quickly, it should disconnect its systems from the department's networks. Levine also sought to isolate vulnerable systems, according to testimony.Other evidence suggests Interior's systems are less than secure. The department earned a C+ grade for security on the House Government Reform Committee's 2004 Federal Information Security Management Act evaluation. And according to the Office of Management and Budget's 2004 FISMA Report to Congress, the department did have a verified plan of action and milestones for improving its computer security, but its certification and accreditation process earned only a 'satisfactory' evaluation.'The thing to remember is that we asked the IG to do this study,' said Tina Kreisher, Interior's communications director. 'We are concerned about IT security. This study was a way of helping to test it. As this plays out and we discover flaws, we fix them.'