Data held by feds, vendors at risk

By Mary Mosquera

Connecting state and local government leaders

| October 13, 2006

Federal contractors that agencies rely on for IT management services are responsible for many of the data breaches that agencies reported to the House Government Reform Committee

'The agency responses show a wide range of incidents involving data loss or theft, privacy breaches and security incidents. Agency responses to data losses appear to vary as well, with some notifying all potentially affected individuals, and others not performing such notifications,' said committee spokesman Dave Marin.The agency reports to the committee varied in level of detail, so this report cannot be seen as a comprehensive review of data loss by federal agencies, Marin added.In addition to not knowing what information has been lost or how many individuals could be affected by a particular data loss, agencies do not appear to be tracking all possible losses of personal information. That makes it likely that their reports to the committee are incomplete, according to Marin. For example, prior to the May 2006 Veterans Affairs Department data breach, the Justice Department reported that "it did not track the content of lost, stolen, or otherwise compromised devices," Marin said.Despite the volume of sensitive information held by agencies, there is no requirement that the public be notified if their sensitive personal information is compromised. The House recently the Veterans Identity and Credit Security Act of 2006, which includes legislation that Davis authored, that would strengthen federal security requirements and provide for notification.Only a small number of the data breaches reported to the committee were caused by hackers breaking into computer systems online. The vast majority arose from physical theft of portable computers, drives and disks, or from unauthorized use of data by employees, the report said.In a related action, the House Government Reform Committee today also sent a letter to agencies seeking information about the risk posed by inappropriate Internet use by federal employees.The request came on the heels of findings by the Interior Department's Office of Inspector General that agency employees have accessed sexually explicit, gambling, gaming and auction Web sites at a high rate. By Oct. 27, agencies are to inform the committee:

Federal contractors that agencies rely on for IT management services are responsible for many of the data breaches that agencies reported to the House Government Reform Committee, which today released its findings on past data loss across government.

That is just one of the conclusions from the committee staff report, which also found that data loss occurs in all major agencies, and that those agencies don't always know what was lost.

Following a flood of data breaches earlier this year, committee chairman Tom Davis (R-Va.) sought a summary from major agencies about past data losses over the past three years.

Agencies, who also notified those potentially affected by the breaches, reported these and other data losses in the report:

The Centers for Disease Control and Prevention reported earlier this year the theft of 22 laptops from a contractor facility. Three of the laptops contained personal information of 1,382 Defense Department personnel.
A contractor for the Centers for Medicare and Medicaid Services reported this summer the theft of a laptop containing personal information, including medical care information of 49,572 Medicare beneficiaries.
The Defense Department reported the loss of a thumb drive containing personal records on about 207,570 enlisted Marines who served between 2001 and 2005.
The Transportation Department's Office of Inspector General recently lost two laptops containing data on more than 133,000 people, according to another investigation. Transportation also has lost nearly 400 laptops and had nine instances when personally identifiable information was lost or stolen.

passed

How they enforce Internet usage policies
Whether the inspector general has conducted any internal reviews of employee Internet use
Technology the agency uses to monitor or prevent access to inappropriate sites.

NEXT STORY: NBC is seeking customers for HSPD-12 offering

This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. / Do Not Sell My Personal Information

Accept Cookies