Energy data latest to be victimized
Connecting state and local government leaders
<font color="CC0000">(Updated) </font>The Energy Department was hacked eight months ago, and data on 1,500 employees and contractors'including their Social Security numbers'was stolen, the department acknowledged at a congressional hearing last week.
The Energy Department was hacked eight months ago, and data on 1,500 employees and contractors'including their Social Security numbers'was stolen, the department acknowledged at a congressional hearing last week.Contrary to federal requirements, neither law enforcement, Energy secretary Sam Bodman, congressional committees with oversight responsibility, nor the affected personnel themselves were notified when officials discovered the theft.Further, Energy inspector general Gregory Friedman testified before the House Energy and Commerce subcommittee on Oversight and Investigations that the department has failed to report as many as 50 percent of all reportable cyberattacks to authorities.'In terms of why it's not happening ' I don't have a good answer,' Friedman told the panel June 9. 'I think to some degree it's people who think that they can fix it internally; therefore, you know, there's no need to bring in an outsider, and people who may not understand the gravity of the situation or may not fully comprehend the gravity of the situation.'Energy's disclosure is another in what is quickly becoming an epidemic of federal data breaches. Last month, an employee at the Veterans Affairs Department had files stolen containing personal of more than 26 million current and former servicemen and women, and an IRS employee lost a notebook with the personal data of about 291 employees and job applicants on it.In response to this latest problem, Rep. Tom Davis (R-Va.), chairman of the House Government Reform Committee, plans to introduce legislation later this week to strengthen data breach notification requirements at federal agencies.'Sadly, once more we have an example of how far the federal government has to go to reach the goal of strong, uniform, governmentwide information security policies and procedures,' Davis said in a statement. 'My committee will be taking a look at what changes need to be made to the Federal Information Security Management Act.'Rep James Sensenbrenner (R-Wis.), introduced legislation last month calling for a five-year prison sentence or fine of up to $1 million should a person with knowledge of a major security breach of 10,000 individuals or more, databases owned by the federal government or national security databases fail to notify the FBI or Secret Service within 14 days. The bill was passed by the Judiciary Committee on May 25 and is awaiting a date to be voted on by the full House.At the Energy hearing, Rep. Ed Whitfield (R-Ky.), chairman of the subcommittee, expressed astonishment that the department has been so lax concerning notification following the data theft.'That's another thing that's so disturbing to us ' about this breach regarding these personnel files,' Whitfield said, 'that it was known to someone in the department eight months ago, and the secretary was unaware of it until maybe a day ago, or maybe today.'In a press release issued after the hearing, Whitfield said Linton Brooks, undersecretary for nuclear security, acknowledged that 'although he was aware these files were lost since September of 2005, he did not inform his superiors,' namely Bodman, of the breach.Glenn Podonsky, DOE's director of the office of security and safety performance assessment, said the department was moving quickly to strengthen its security measures, particularly on the unclassified networks that have been compromised, both by outsiders and his 'red teams' who test the department's 800 IT systems for security.'Results of our independent oversight activities have identified weaknesses that lead us to conclude that the department's unclassified information assets have been operating at an elevated level of risk for compromise and disruption, given today's threat environment,' Podonsky said. 'The effectiveness of the unclassified cybersecurity program has varied across the department and is often dependent on the knowledge and initiative of key network personnel utilizing expert-based approaches. ... In contrast to the unclassified program, our independent oversight activities indicate that the classified cyberprogram is providing an adequate level of protection.'Details on the data compromise were not discussed during the hearing's initial session. The subcommittee was scheduled to meet in closed session to learn more details.
NEXT STORY: FDA wants prescription drugs tracked