Audit: FBI network security still poor

The FBI has failed to fully implement its IT security program and as a result its critical networks for exchanging law enforcement information remain vulnerable to misuse or interruption, the Government Accountability Office said in a issued today.The congressional audit agency prepared the report on FBI network security in response to a request from Rep. Jim Sensenbrenner (R-Wis.), a longtime critic of FBI technology management. The former Judiciary Committee chairman sponsored steady oversight and investigations of various troubled bureau IT projects.Bureau officials provided a written response incorporated in the GAO report that accepted many of the report's recommendations but rejected the congressional audit agency's characterization of the associated risks. The FBI cited the various measures it has implemented over the past five years to tighten and monitor network and IT security, such as the establishment of a 24-hour security watch center.The GAO technical review stated, 'Certain information security controls over the critical internal network reviewed were ineffective in protecting the confidentiality, integrity and availability of information and information resources.'FBI CIO Zalmai Azmi responded to the GAO report in a letter that cited the bureau's recent progress in the IT security field.He added that since the FBI activated the Information Assurance Section of its Security Division in April 2002, that organization has brought the bureau from the status of having only 8 percent of its IT systems accredited to having 100 percent of its systems accredited, as required by the Federal Information Security Management Act.Azmi added that the bureau's Enterprise Security Operations Center works with the agency's Counterintelligence and Criminal Divisions to investigate internal threats.The audit agency provided a separate classified report in addition to its public report, which is titled 'Information Security: FBI Needs to Address Weaknesses in Critical Network.'The GAO auditors found that the bureau failed to consistently: 'Taken collectively, these weaknesses place sensitive information transmitted on the network at risk of unauthorized disclosure or modification, and could result in a disruption of service, increasing the bureau's vulnerability to insider threats,' according to GAO.The FBI's alleged IT security failures recall the dismal history of the Robert Hanssen espionage case, in which a tech-savvy double agent within the bureau's counterintelligence office sold key secrets to the Soviet Union and later to Russia.Hanssen's treachery relied in large part on backward and inconsistent FBI technology security. It led to the exposure of federal espionage operations that were both very expensive and very promising, as well as the unmasking of agents working overseas who were executed.The auditors recognized that the FBI has adopted an information security program that covers the entire agency and includes an organization to monitor and protect its systems from external attacks and insider misuse, according to the report.However, the FBI's security measures that protect its network suffer from an outdated risk assessment; incomplete plans, testing and training; slow remediation of problems; and poor continuity-of-operations measures, the report said.'Without a fully implemented program, certain security controls will likely remain inadequate or inconsistently applied,' the auditors wrote.In response to the report, the FBI issued a statement through a senior spokesman emphasizing that the agency had already identified most of the issues and recommendations included in the GAO report. The prepared statement said the report failed to describe the bureau's 'proactive and aggressive' corrective action plans for IT security.'At least three agencies, including the Office of the Director of National Intelligence, the Office of Management and Budget and the Department of Justice, have recently conducted audits and reviews of the bureau's information security systems,' according to the spokesman's official statement. 'These agencies have recognized and commended the FBI's efforts to protect critical networks.'The statement added that the bureau routinely conducts penetration testing to test its system security. 'The bureau's insider threat program is currently been adopted by other government and international agencies,' according to the FBI statement.'This report illustrates that the FBI underestimates the insider risk,' Sensenbrenner said in a statement. 'This baffles me, given the incredible damage former FBI agent Robert Hanssen inflicted on the FBI's worldwide intelligence network, primarily because he knew exactly how to extract information from the system. 'Now the FBI has installed two-thirds of the Trilogy [IT overhaul project] at a cost approaching half a billion dollars, and, once again, it is ignoring the sad lessons of the past,' Sensenbrenner said. 'It fascinates me that the FBI's chief information officer hasn't been on top of the security issue.'Sensenbrenner noted that in 2001, former attorney general John Ashcroft sponsored a commission to review FBI technology that identified similar IT weaknesses and reported that the lapses reflected a pervasive inattention to security. 'Sadly, it looks like it's still a low priority for the FBI in 2007,' he said.Sensenbrenner cited the damage Hanssen did to national security and added, 'It is small comfort that the FBI substantially agrees with the GAO.'