New world order pits security against Web

Since Sept. 11, who decides what the public can view on government Web sites?An FBI alert last month warned that al-Qaida terrorists may be using the Web to find information about potential targets such as power plants and emergency services systems. No standards exist to determine what should be scrubbed from federal sites to guard against future terrorist attacks.The scrubbing debate 'illustrates the fundamental tension between access and security,' said Paul C. Light, vice president and director of governmental studies at the Brookings Institution in Washington.E-government proponents always focused on customer service, Light said, but since the terrorist attacks, the new priority has become security.'The two metrics are difficult to do simultaneously,' Light said. Tension is higher between employees who aim to improve public access and those who try to maximize security, he said.'We're in a period where the secondary goal will be access and the primary goal will be security, and that's a significant change,' he said.Although advocates for access acknowledge that some sensitive details'such as blueprints of nuclear power plants'are best left offline, they generally favor openness.Gary D. Bass, executive director of OMB Watch, a Washington nonprofit group that monitors the Office of Management and Budget, has asked the White House to restate its policy on withholding or removing Web data.'Once that is clear, it would make sense for each agency to figure out what should be on the Web and what should not,' he said. Agencies 'should then consult the stakeholders'the public'and come up with guidelines on what needs to be there.'Bass said agencies 'seem a little confused. They have removed information thinking it's better to be safe than sorry, but that's not the way to run the government.' After four months, he said, they should have a better idea of what to post.Federal employees and experts agree that the government should come up with a set of guidelines to help agencies decide what information can be classified as sensitive and removed and what should be put back on government sites.'There is no need for a governmentwide policy, but there should be guidelines and best practices from the Office of Management and Budget and the CIO Council on how agencies should classify information and what information should be removed,' said Laurence Wolfe, CIO of the National Institute of Allergy and Infectious Diseases and director of its Office of Technology Information Systems.Gabriel Goldberg, president of Computers and Publishing Inc. of Alexandria, Va., said the government 'should issue guidelines but not regulations. It should not follow up with report cards as to who followed the rules' by some arbitrary date. 'It needs to be done with a carrot and not a stick.'Each agency should have its own review process and should be responsible for its Web content, Wolfe said.'For example, if the public has a need to know about a particular power grid, then the Energy Department should probably weigh whether it needs to give details about the grid,' he said.But that process should balance security with the public's right to information, Goldberg said.He cautioned that removing information from the Web falls into the category of what he called 'feel-good' measures. 'What if the information is available on 1,000 Web sites and you scrub 700? You still have 300,' he said.The one way to decide what information needs to be removed, he said, is to ask, 'How many people need that information, and what's the risk of having it out there?'Ashish K. Sen, director of the Bureau of Transportation Statistics, which removed geographic information systems data from its Web site on Sept. 25 and put it back Nov. 8, said guidelines would make life easier, but each agency should be responsible for its data.Data must be evaluated on a case-by-case basis, and agencies must periodically re-evaluate what needs to be on the Web, Sen said.Much information that could aid terrorists is in the public domain in other ways, so scrubbing agency sites is not particularly useful, said Jock Gill, a systems consultant in Medford, Mass., and former White House staff member during the Clinton administration.If sensitive documents are available only in an agency library during business hours, officials have a better idea of who's reading them, Gill said.One of the developers of , Gill criticized the Bush administration for making fewer documents public than its predecessors.'I think it's important to see this scrubbing in the larger context of the administration's information policy,' he said, adding that a government that has more secrets isn't necessarily safer.Beth Daley, communications director for the Washington Project on Government Oversight, recently asked Energy Secretary Spencer Abraham to restore public access to as many of his department's Web sites as possible.While studying the security of Energy's nuclear weapons facilities, the project team found detailed maps showing where weapons-grade plutonium and enriched uranium are stored, Daley said. The group wrote to Energy officials in early October, and the department pulled down many of its Web sites.In recent months, Energy officials have been slowly restoring the department's sites, Daley said. But another advocacy group, Nuclear Watch of New Mexico, found that many of the offline documents and Web pages pertain to citizen-access and environmental issues.Colin King, research director of the Santa Fe, N.M., Nuclear Watch group, said he is concerned about the removal of documents regarding Los Alamos National Laboratory's renewal of its Resource Conservation and Recovery Act permit from the New Mexico Environment Department.Many documents that people would read before making comments were taken offline before the public comment period ended, King said.Ari Schwartz, associate director of the Center for Democracy and Technology in Washington, said a recent advisory on agency Web postings from the FBI's National Infrastructure Protection Center is not specific enough.'The concern is that we still don't have standards for how this is going to happen,' Schwartz said.OMB issued some guidance under the Clinton administration, but there is no final policy, only a draft, Schwartz said. 'We're suffering now because we don't have that kind of baseline,' he said. 'We're jumping from crisis to crisis.'