minority member will have five minutes to make opening statements followed by opening statements not to exceed three minutes by any other member who seeks recognition and without objection members and when this is may have five days to submit a written statement or extraneous material of a record welcome to the day's oversight hearing on the national archives ability to safeguard the nation's electronic records the purpose of today's hearing is to examine the national archives policies and procedures to protect the nation's ever increasing store of the like tronic records we will consider several important topics including an update on the staff or laws from nara of a portable hard drive containing clinton administration electronic records possible breaches of electronic records containing personally committee is concerned as such a large and expensive information system is being developed in an agency that is already struggling managing the security of the systems they currently operate that that the loss of the clinton hard drive was very disturbing and we look forward to hearing the status of the agency's efforts to identify and notify any and all individuals whose p r i may have been compromise is more troubling however to hear of new as it says of data breaches or possible breaches the circumstances and the agency's handling of them cast doubt on the national archives ability to understand and mitigate existing and emerging risk in order to properly safeguard the nation's electronic records it is this committee's hope that through our hearing today we can gain a better understanding  as information technology security and provide the national archives with some important information and direction they can use in order to increase security across the agency policy and administrative rows thank you for being here next witness is paul brock vale the inspector general of the national archives and records and ministration mr bragg faile previously also served as director of audits for the federal election commission office of inspector general after mr bragg fail we will hear from david palmer the director of information technology management issue that the g a o mr pounder is currently responsive for a large segment of g a o the information technology war including systems development to investment  management health i t and cyber critical infrastructure protection reviews has led teams reviewing major hide t modernization average cheyenne mountain air force station the national weather service out rock and industry leader in computer forensic and investigation mr brill is recognize internationally as a leader in his fields of security computer forensic and an incident response  brill found a crow out in racks global high technology investigation practice he has an international reputation in the areas of computer communication security and technology crime investigation  thank all of you for being here today and appearing before us for testimony it is the policy of the subcommittee to swear in all witnesses before they testify but you all please stand and raise your right hand solemnly swear to tell the truth the whole truth and nothing but the truth thank you may be seated and let the record reflect that the witnesses answered in the affirmative high as in each of the witnesses give a brief summary other testimony please limit your summary the five minutes you complete with the statement will be included in the hearing record before we go to state thank you mr chairman and i do and thank you so much for continue to hold good hearings with the subcommittee i appreciate your leadership and may of this year the subcommittee first met to discuss the staggering negligence of the national archives staff and handling our nation's valuable records an issue that was only just coming to light at the time we're back again but back then we were shocked to hear that a two terabyte hard drive had disappeared from the archive storage room where it was kept in an unsecured location accessible by many employees that device contain the personally identifiable enter information hundreds of thousands of clinton administration staff secret service operating procedures and other highly sensitive information although it was clear that there were in demick problems with national archives management it appears that this loss was an isolated instance of the acting archivist of sure this committee that measures were being taken to address security concerns and prevent any further breaches that unfortunately is not the case now six months down the road we're back here again with more news of last electronic storage devices one of which contains  an identifiable information of our nation's military veterans on a drive that was sent out to an outside contractor for maintenance and repair what's more is that this breach occurred a year ago in november of two thousand and eight and we're only hearing about it now practically speechless it is my sincere hope that ms thomas you'll tell us today that the archive is doing everything possible to ensure that these veterans do not become victims of identity theft the national archives staff exposed this drive to lost or theft because they believed it was defective and beyond repair further a further claim that sending a drive containing sensitive information to a third party doesn't constitute a breach of sense of information because it contractors oblige obligated to keep its contents private as inspector general the national archives will testify today the data on this drives actually retrievable using free publicly available software and in fact some of my staff of perform procedures very similar to that exposing a drive like that to eyes outside of the national archives is irresponsible regardless of the technical definition of a breach the national archives is further claimed to subcommittee staff to breaches of this nature will not happen going forward because a policy is now in place that prohibits tribes from being sent out to contractors for repair however this policy was actually already in place the time the dr with veterans data was exposed so that's nothing more than cover for the past and not real subs have changed to ensure it doesn't happen the future the policy also did not prevent the national archives from sending yet another dr containing sensitive records to a contractor under similar circumstances and april of two thousand and nine that dr contained digitized employee files from the national archives g s a and o p m it is unacceptable that the nara staff handle any storage devices this carol carelessly but it's particular in defense department files in its possession had the same protocols been used for veterans out of this incident would have been avoided in my opinion what is clear is that there is a greater institutional problem at the archives that must be fixed and that is a culture of blatant disregard it's become very clear that the ongoing security breaches are not the result of a lack of awareness of security procedures by staff but a failure at the managerial level to enforce the procedure finally we will also hear from our witnesses about the national archives electronic records archive as in the case with nar as a whole the e r is plagued with its own problems  which is the archives strategic initiative to preserve uniquely valuable electronic records in the u s government is in the midst of a system development that is already running for over budget when fully operational cost five hundred million dollars more than projected the g a o has already been critical of this system citing mental methodological weaknesses that could limit naras ability to accurately report on costs kegel and performances in concluding that lacks a proper contingency plan should the electronic record system fail this really makes me question the investment overall i think our witnesses for appearing today i certainly  chairman ranking member mchenry and members of the subcommittee thank you for this opportunity to discuss the national archives and records and mr ations safeguarding of electronic records in our we recognize the challenge of securing i t systems and devices particularly in regard to protecting personally identifiable information is never ending and always changing we know that no agency will ever be perfect but we are committed to doing the best job that we can learning from our own mistakes and the mistakes of others broks failed nor a suspect or general and david pounder of the general accounting office are appearing alongside me today nars office of the inspector general has reported a number of vulnerabilities and made important recommendations on how we can improve our security in response to their work we've declared a material weakness with respect to our security and we are taking corrective actions later in my testimony i will update you on the electronic records ar which regularly received useful guidance from the g a o and has from the very start of the development in late september i was briefed by the inspector general on an allegation that nahr may have improperly disclosed sensitive personally  identifiable information when a defective disk drive from a veterans information data base was sent to an the rise contractor for repair in the fall of two thousand and eight rather than being destroyed and disposed of in our facility according to a new policy that had been issued by the cia in august of two thousand and eight the defective disk drive supports the case management reporting system or c m r s c m r s as used by naras military personnel records center to track over a million requests annually for the personal records of veterans but the system hardware resides in college park maryland on october ninth we learned that an additional defective hard drive at our national personal records center in st louis was returned to a vendor in april of two thousand and nine the drive is from a system that is used to digitize official personnel files of current government employees and we believe it contained digitized files and an associated index of current employees records from nara the general services administration and the office of personnel management nara and the inspector general continue to review these incidents however at this time there is no evidence that the defective  unauthorized hands or that any was accessed from these disks and my staff and i have concluded that there was no breach we have implemented many recommendations made by the inspector general to improve security at the n p r see including removing older dater data from the c m r s system performing annual reviews of c m r s user accounts compiling updated key inventories to better protect stored on paper and issuing policy changes to require verification of death for providing military records to next of kin in a lot of these two hard drive maintenance incidents we are taking make taking a comprehensive look at internal security controls related to the protection of within i t systems across nara we have undertaken an agency wide systematic review of the storage and protection of i that includes a review of database encryption within the systems are reviewing of our tape backup procedures a review of all of our computer acquisition and maintenance contracts to ensure that sensitive data protection is properly addressed and a review of our internal p i o awareness and training processes and procedures we are also ensuring that we use national security agency approved media sanitation and destruction procedures and have engaged expert consultants to review our security incident response procedures in order to identify ways to improve security and internal controls with regards to electronic records nara has been ducted an in audit to identify how well our security program is functioning this audit identified twenty nine recommendations for improvement in our security program since then we have doubled our security staff and much has been made in the area strengthening our security controls my written testimony describes many additional corrective actions that nara is undertaking to improve security most of the original twenty five twenty nine recommendations have been completed and we continue to work on the remaining actions you also asked that i provide an update on our response to the external hard drive containing copies of clinton administration executive office of the president data that we discovered missing in march of two thousand and nine from naras college park facility the dr is still missing it contains names dates of birth and social security numbers of people who worked in the clinton executive office of the president visited the white house complex or submitted personal information to the white house in pursuit of a job or a political appointment today approximate twenty six thousand breach notification letters to individuals whose names and social security numbers are on the hard drive we have offered these individuals one year of free credit monitoring so far one thousand six hundred and eighty five persons have taken advantage of the offer our contractor is continuing to search the hard drive for additional names of individuals whose identity might have been compromised we anticipate mailing an additional one hundred twenty thousand letters in the coming weeks finally you ask that i report on the status of the electronic records archives known as e r e r a as a comprehensive systematic and dynamic means for providing electronic records that will be free from independent from dependence on any specific hardware or software the primary purpose of this first of a kind system is to take in store and provide access to records that are born digital by which we mean the permanent arc of all electronic records created by executive branch agencies the congress federal courts and the office of the president we are currently beginning year five and increment three of this seven year five increment system development project provided support for the transfer of electronic presidential records from the executive office of the bishop ministration so that we can preserve and make these records accessible for our couple processing increment true was delivered  december two thousand and eight to enable nar to begin the injust of seventy two point three terabytes of data that legally transferred to nara as of january twentieth thousand and nine in just of these unclassified electronic records was completed in october of two thousand and nine funding a nars two thousand and ten budget is dedicated to increment three which includes a congressional records instance to provide simplified storage and access capabilities for the electronic records of congress this part of increment three is on schedule and will be delivered to nara in february of two thousand and ten increment three also provides the capability for the public to accept access records  the subcommittee should know however that the start of increment three development has not been a smooth this would be desired nara has raised several concerns with the contractor related to analysis design and architectural foundation issues the contractor was receptive to norris input and has taken concrete steps to make improvements in process deliverables and staff at present the contractor believes it can deliver increment three s scheduled but you can rest assured that n continue to monitor progress to ensure that this increment will be delivered within cost and schedule in summary e r o i is operating in the way that we now expect it to at this point in the project federal and presidential records are stored in the  which operates securely at a facility on the grounds of the u s navy's allegheny ballistic lab in rocket center west virginia hardware and sophomore software failures have been minimal we have a stage planned open the  system to federal agencies the problems we encounter are common to major i t systems development but i am confident in the ability of the e r a program office to manage the development of your right to a successful conclusion and to plan for the ongoing operational phase after twenty twelve mr chairman that concludes my testimony i would like to thank you for inviting me here today and for the helpful over site and guidance even the members of this subcommittee provide tomorrow thank you so much mr obama's sobriety you may proceed mr chairman and members of the subcommittee i thank you for the opportunity to testify today now rescore mission is to safeguard and preserve the records of  democracy to make them available for this and future generations of americans the challenges daunting and becoming more complex each day in this digital age yet fundamental truisms still exist in many areas one fundamental truism is that sound internal controls should be the foundation upon which all systems and operations are based for a decade as an air inspector general i have had a front row seat observing internal control weaknesses in internal control deficiencies that have resulted in the loss of federal funds  property compromised a successful delivery of contractual services and deliverables impaired operations and subjected information to include electronic records maintain a narrower systems and facilities to compromise however i am hopeful i believe that under the leadership of a new created by all three branches of government are probably identified scheduled next session and ultimately injected into a functional electronic records archive today at the request of the committee chair i will focus upon the exposure resulting from the compromise of records that pla personally identifiable information commonly known as p i i of our nation's veterans federal employees and millions of other americans at risk in the past year alone all i g investigators and authors have performed work specific to the following the loss of a computer hard drive from archives to a college park populated with millions of records from the clinton white house within this population by tens of thousands of records containing p e i as well there's other potentially sensitive in from a the loss of government control over a hard drive we suspect contained millions of p r records of our nation's veterans inappropriate controls over information stored in the automated case management system used in st louis to track and process electronic mail based requests for official military personnel files system vulnerabilities leave veterans p e i susceptible to unauthorized disclosure the improper transmission of veterans records over an extended period of time by personnel at the national personal records center which expose veterans p e i to potential compromise that donations surplus of laptops that were not to gas or scrub which in the least one case contained files of the former director of the information security and oversight office among these files was p e i specific to national security officials from the clinton administration the loss or sept of hundreds of pieces of i t equipment written off the period of fiscal year two thousand to two thousand and six that high capacity to store information in appropriate packaging of two backup hard drives containing limited t i i at the r presidential library resulting in their loss during shipping oh i g investigators subsequently recovered one of the two additionally this committee is recently notified of another incident in st louis missouri in which failed hard drives from a driver or a used to store p information for thousand federal employees inappropriate inappropriately left naresh physical control the array contain myriad images of office official personnel files and related information of employees from three agencies these cases work by oh i'd say for the past year are individually egregious and collectively represent an agency that is not mean a core tenet of its mission to safeguard the records of our democracy while each case of data breach loss of loss or on the risk of loss represents a unique stanza the chorus of the song remains the same as an angel now relax a viable robust risk identification and mitigation strategy and we all pay for that shortcoming in testimony before this he on july thirtieth i provided details as the internal control weaknesses which resulted in the loss of a hard drive containing two terabytes of clinton presidential records internal control weaknesses lapses and exercise of questionable judgment tied to other incidents i have spoken of today regularly leave me and my staff frustrated and be willed or allow me to lab or eight specifics of the case involving the hard drive potentially holding millions of our nation's veterans p i now or officials chronic contracting for what to do with these type of hard drives and if he had two choices it needs to be clear that often there is nothing substantially wrong with failed drives and they are perfectly usable for many applications a quarterly one contract choice the secure data option would let never physically keep all drives identified as failing or failed the second choice of the vendor provide a new drive but then the vendor would take back that drive with the information on it the vendor would then test the drive to see if anything was wrong with it and if it was it could be economically repaired or used however if it cost more to fix the drive was worth drive could be recycled for metals now or opted for choice to the snare or decided to allow the populated and potentially readable drive to leave now or control however that drives actually start to fail now was given a second chance to correct this decision and was presented with a third choice now or to keep the failed drive and pay approximately two thousand dollars each new drive on a one by one basis unfortunately never once again chose to let these populated drives leave their control the trail specifically just drive was subsequently found to be untraceable and we cannot get possession back accordingly i cannot tell the committee today whether a breach as defined by data being accessed by unauthorized parties actually occurred but i can stay in phatic lee that narrows actions to create the risk of such a breach and a lack of due diligence to protect this information cannot be ignored and should not be marginalized why i have been fully informed that the situation i just described is now been fix tragically i believe select narrow managers from the top down do not recognize the risk factors existing in today's environment failing to define the risk we do not deploy and make the security first decisions necessary to address the real and potential risks before unfortunate and irreversible events transpire in the brief time allotted to me i would also note specifically as it relates to the program that i have had professional skepticism about erases a very first meeting i attended in two thousand and two fearing worst case scenario i went to then marcus carlin on april thirtieth two thousand and two seeking audit staff resources to provide independent objective and skilled oversight over your right per my notes he responded and i quote i could give you fifty people and you still can cover it so you think you can do it with two in december two thousand and three failing to obtain any year a dedicated audit resources i made a formal request to own the director stating and i quote erase the challenge we are not equipped to address within our existing  constraints we are simply unable to provide the necessary coverage to this mission critical program failure to fund this initiative will not allow me to obtain persons with the skills necessary to independently evaluate and report upon the progress of your right likewise will not be able to support this program a real time potentially resulting in less than optimal results this is a risk that this nation should not face as i testified today i continue to have profound concerns of the status the program my concerns are really reflected by management who throughout program life have expressed abundant optimism for example in april two thousand and seven asaram meeting minutes the air raid director stated the technical director stated that the program is exceeding yet oh gee authors were finding this rosy scenario to be anything but the truth in a management letter to the archivist on july thirteenth two thousand and seven we accurately define the program as one quote be set by delivery delays cost overruns and staffing shake ups unquote history shows we were correct at the very next to sarah meeting in november two thousand and seven the minutes report that the same year a technical director made a one hundred degree course correction by the finding that sound engineering methods were not followed in many areas lockheed allowed the schedule to become the per hour ready rather than ensuring that requirements were being met in a satisfactory matter ultimately has failed now researcher a notice to lock in two thousand and seven surely there after in testimony before a subcommittee of the senate committee on homeland security and government affairs a may fourteenth two thousand and eight designed to allay the concerns of souths a spouse by senators at this hearing seventeen months have passed we are now in fiscal year two thousand and ten and key staff and narrow and l m c have come and gone new voices replaced ovoid has an optimism ebbs and flows at a time when our officials publicly voice confidence staff for operating capability will be met by march two thousand and twelve a senior work within the program office spoke to me just last week of ongoing contract to performance and deliverable to fish and seas perhaps the eight team is sliding down the alphabetic scale the acting orifice told me last week the chief information officer has been made aware of ongoing deficiencies however senior never management never brought such information to my attention nor disclose it to the orders assigned to this program area as engaged as i have been i do not know what capabilities and capacities will reside in erie when the contractors throw another party turn in their badges shake hands and exit the door such a statement should be viewed as troubling to all make our stakeholders and particularly this committee it is my hope that through this testimony and with the support of a new archivist we will begin to see improvements in our system of internal controls and that those who fail to discharge their duties will face appropriate testify this afternoon on mars electronic records our cut system this five hundred fifty million dollars system is intended to preserve and provide access to massive amounts of electronic records and is an investment critical to nars mission has spent more than half of the five hundred fifty million dollars and has deployed two of the five planned increments this afternoon chairman clay i'll comment on naras performance with the first two increments existing project management concerns plans for increments three through five and recommendations for improvement starting with performance of the first to increment increment one was late over budget and did not provide the functionality promised specifically initial operating capability with four pilot agencies was scheduled for september two thousand and seven but was delayed nine months to june two thousand and eight this delay resulted in a cost overrun of twenty million dollars but even more troubling is the fact that plan functionality was not delivered and deferred to later increment these delays also squash nors plans to use arab to receive the electronic presidential records of the outgoing bush administration in january two thousand and nine instead a separate commercial system with a different architecture from error was used to archive the bush records in although nara certified the second increment in december of two thousand and eight seventy three terabytes of presidential records were not ingested into the system until september two thousand and nine the first two increments are basically different systems in integrating the systems in the later increment still need to be addressed managing a project of  this this large requires solve project management discipline that includes overseeing contractor performance to ensure that what the government is paying for is delivered at the agreed to cost and on time today tear program does not have a good track record here and when we looked into this last year we found several weaknesses in ours practices for example we found contractor reports on program funds spent without work completed and work completed and funds spent on work that was not in the work plans nars working to improve these management processes so that the cost schedule and technical performance can be closely monitored in the remaining three increments over the next three years regarding the remaining three inc have reported and ready made recommendations to nara that there out your increment need to be clearly defined as to what specific functions will be delivered when and at what cost for example nara has significant work ahead in the at your increment that include expanding beyond the four pilot agencies handling classified information providing public access capability and expanding functionality like access and preservation capabilities such detailed plans are essential if this project is to achieve full operating capability by two thousand and twelve at the five hundred fifty million dollars price tag moving forward narrowed needs to closely monitor not only the cost and schedule  increment but also needs to monitor the functionality delivered our recommendation to bolster the program's use of earned value management should help us affectively implemented the program also needs to ensure integration plans are in place to merge the differing architectures used in arab a system in the presidential records system and also naira needs to define in great detail the functions to be delivered in increments three through five this includes aligning detailed requirements in the costs with each increment failing to address these recommendations will clearly jeopardize the chances of achieving full operating capability by two thousand and twelve mr chairman this concludes my statement thank you for your oversight of this project and  senior managing director for secure information services a crawl on track i'm not here today as a representative of coraline track but as an individual to share whatever knowledge and experience i have in the fields of information security data protection and data recovery to assist the subcommittee with the vital work it performs and i'm grateful to you to you for the opportunity to speak today a substantial proportion of the information that is being created within our government simple fact that most of the data that is created and which may have historical import for extended periods of time will never in the course of normal use be printed how do we safely and efficiently preserve electronic records when the technologies involved in producing and storing those records is clearly evolving at a breakneck breakneck speed i've been involved in the security and recovery of data from computers for more than forty years my recent experiences involved working with private sector organisations to safeguard sensitive data and help those organisations respond to data security incidents i've learned a few lessons that i hope will be helpful to the subcommittee when it considers how best to carry out its oversight role in  g the preservation of electronic records which are a vital part of our national heritage first don't assume that the devices currently used to store data will be commonly used or even reasonably available in the future above all else we must ensure not only that we can store the data but that we can completely and accurately access it on the physical media that we preserve this means that we either have to also preserve workable reading mechanisms or  periodic we transfer the data to contemporary storage media as new storage technology obsoletes the old second don't assume that data can't be restored even if the storage medium appears to be damaged consider a quick example following the tragic loss of the space shuttle columbia in two thousand and three nasa located a hard drive in the debris field the glenn research center sent it to my organization for examination although the  electronics on that drive had been literally fried the case burned and plastic from the innards of the device had melted on to the surface of the drives we were able to rebuild the mechanical components clean the disk and recover over ninety nine percent of the data which turned out to be vital for completing a long term experiment in basic physics with today's technology unless the media containing the data is utterly destroyed the data is at least potentially recoverable i believe that the best practice is they want to devise contain sensitive data assume that it might be potentially recoverable unless you've taken proper steps to render that data permanently unreadable third what you see is very often not all that you can get there are a number of data fields that are automatically created and maintained by the programs that all of us use some are obvious the date and time that a file was originally written how many times it was edited when it was last opened but it can contain more it may contain a record of changes made in the course of a revision and review and this information is called method data and it's important to  understanding of the file with which it's associated people think the things like this for a brand new issue mr chairman but they're not if you look at abraham lincoln's handwritten manuscript of the gettysburg address you can see how he edited it what it looked like before he made the changes what he crossed out what he added and the same can often be done with digital records through examination of the metadata but only if that matter data is preserved unfortunately unless care is taken in regard to the preservation process medha data can inadvertently be changed or lost to ignore mehta data is to constrain future understanding of the file next ensuring data security must be more than an afterthought there is a cost to data protection but planned effectively those costs can be controlled and there will always be a tradeoff between cost and protection while i'm not an expert in the various security standards that are used by federal agencies i found that there are a number of centers of knowledge which can be of immense value in understanding the risks and the alternatives the work of the professionals at nist come to mind i have no doubt that the subcommittee is aware of the ongoing work there to identify risks protective measures and to provide publications that help professionals and managers in both the public and private sector to do a better job of securing sensitive data sir the cost of not protecting data appropriately can be very very high what is the cost to future knowledge if electronic records of today's decisions and activities are lost through security failures i believe that the expertise exists to assist and advise our government on this complex and continually changing issue there are many specialists like myself who recognise that service on advisory councils and other appropriate mechanisms is really par of our civic and professional personal duty why not call on this pool of knowledge if we don't collect data and collect it properly if we don't maintain it in a usable incomplete form and if we don't safeguard it appropriately it won't be there for the benefit of future generations finally we must assure that both public and private sector organisations have a plan for exactly what they will do if there is a data protection incident trying to develop a crisis management plan in the middle of a crisis is difficult at best recognizing that incidents can occur and that they do occur is far more effective in terms of responding to the incident i want to thank the subcommittee for inviting me here today sir over the years i've had the opportunity to work with information security professionals in government at the i the defense department the secret service i'm very proud of the work that they do their public service in a time when they could earn far more in the private sector is a measure of devotion anything that we in the private sector can do to add to the knowledge to make sure that we keep up with the changes is more than just something that could be done it's something that ought to be done thank you very much for inviting me here today sure thank you to mr commanding the gentleman from texas mr henry clay welcome aboard and we look forward to your involvement in this committee and we will go into the question and answer period and we will recognize a gentleman from ohio for five minutes to begin the question thank you very much mr chairman and i thank you for calling this hearing and i appreciate very much the testimony that certainly hits home to me i remember when i was a state representative and one of my colleagues called me and every side social security number to me after looking at a county i believe it was the county auditor or the county recorder or something like that the clerk of courts whose son had developed a new web site and they decided it would be great if we scanned every document in the county that came through the clerk of courts and they scanned it onto the website not thinking that you know perhaps some of these parking tickets that were out there are some in my was a traffic violation  contains some sensitive information but what it what it brought to mind was that there was no standard operating procedure at all in the county in the state anywhere when it came to not just archiving the data but dealing with the data at all and so mr brock felt when i hear your testimony it strikes me as very concerning and earlier this year i introduced legislation dealing with classification of documents because there's no standard operating procedure in the federal government when it comes to standard you know classifications we find that you know the federal government exists in silos and there are different standard operating procedures when it deals with just classifying documents and classifying certain information so if you could help me mr brock i'm very interested or any of you as to our status as a federal government in terms of coming up with a standard procedures for dealing with sensitive and sensitive information not only how do we collect it but then how is it how is it dealt with and certainly when it's archived you know how do we then deal with this arca give us a score as to how we are in standardizing this  as a process actually the focus of my work is doing investigations and audits in terms of policy procedures in a classification of documents that's not my bally wick not just glass casing but i'm talking about the sensitive information that you were talking about you know and how vulnerable we are to losing that information it strikes me that within departments we don't have standard operating procedures to deal with this appropriately and i'm wondering if you have any observations as to how far we've come or how far we still have to go in terms of the various departments in collecting and then classifying archiving that data i think there are standards available for example in the cases i was talking about specific to the loss of data in the breach of data there isn't as noted as well there's new standards o m b puts out regulations requirements agencies stablish in define their own internal requirements the problem is it should just be a paper exercise where you can hold up to the world that we have policies we have procedures and then you can put your head on your pillow and think that you can rest assured no you have to actually train people you actually have to hold people to those standards you have to test you have to drill down you have to assume sure that they're being enforced and protected at all times and i think that's what happens many time in federal agencies at least in my thirty years of experience which is that it's actually easy to write policy especially in this day and age it's easy to get contractors and pay them to write policy for you but to actually instill that work ethic to actually instill those morrows to actually enforce the proper treatment of records and protection of records that's the problem and that's where in my testimony i talk about where i believe that narrow has fallen short in terms of lack of training lack of oversight and then lack of appropriate action when people violate narrow policy and procedures which were drafted in response to o m b regulations and requirements so we don't have a pass and we don't have a buy these are things we should be doing and these are things that we failed to do with the national arts so it's not just a matter of standardization it's a matter of following through and making sure that the processes are being followed and then enforced if they're not being followed that's correct and that's why as an inspector general first of all i'm very happy to be testifying today and get the attention of the subject and i'm also proud of my staff that we're putting forward very sound recommendations that should management opt to accept them and adopt them i think will bring in far far increased levels of internal control security and maybe we won't be here next year talking about further breaches maybe we'll actually have a pretty tight shop if we do some of the stuff we're recommending well i guess following up on the issue of holding people accountable ms thomas when you were here in july with regard to the theft of the clinton administration hard drive you at the time stated that you would act with swift and appropriate disciplinary action if and if we found out that there were people to be held accountable have you followed up on that and what steps have been taken well at this point in time we have held off on taking disciplinary actions although we are ready to do so basically at the request of the inspector general so that they can finish their investigation but once that is is finished and we give and they give us the go ahead then disciplinary actions will be taken so the disciplinary action is pending pending ok and i ask that just for context so that is on the record you know this committee animals think congress looks at you as the culprit here but we're asking for your assistance  policies have you changed in light of this additional security breach with the loss of these veterans records mr congressman i think i have to say that our own determination is that we used a government wide contract that other agencies that had the appropriate privacy protections written into the contract and so that our use of that contract was a valid  way of sending back a desk now we've decided that we need to go beyond what's acceptable and we've adopted a policy the cia has not sending disks back to  vendor but we do not believe that any breach has actually occurred because the material was in the hands of authorized people all along the process ok so you have changed policy in that hand or send it back replace it those are the two choices now you've switched correct the new policy that's been adopted in place by the cia is that we will not send any disks back to the contractor  will thank you for testimony you've always been very direct and as all inspector generals are or are supposed to be and we certainly appreciate your work as the has your  office commented previously about this policy of sending these drives out to contractors and getting them back it simply should never have happened if let me read you a sentence or or two this is what dealt one of the contractors the most recent case is dell this is what dell said dell assumes no responsibility for the destruction of data return on such drives dell strongly encourages you to remove all confidential proprietary or personal information from any storage device before it is returned to dell we didn't do that i brought with me a properly scrubbed sanitized this is a dr right here this dr lets for this purpose of this hearing this dr has veterans information for millions of veterans with and once it's mobile i'm carrying it it is a mobile device it's game set match if you go to nist standards if you go to o m b requirements if you go to narrows own internal policy and procedures once you have p e i data stored on a mobile device it must be encrypted before at miss must be encrypted simple fact furthermore should you ship and lose custody or give up custody of control it must be scrubbed wipe the gast in neither case is that we're talking about today was that done this data went out now it's true there is a language boilerplate language that narrow found about three four weeks ago in a contract and that's what they're feeling comfortable in telling you that the vendor once they receive this drive we're supposed to maintain the confidential confidentiality of the data but let's go with the first case the c m r s drive it thing go to just one vendor it went to stew then three then four it followed a food chain first it went back to the company that we had a contract with they sent it to another company to analyze the data on the drive and even fact the drive sectors failed that then it went to another company and finally the fourth stop was a scrap company for the metal now that's pretty far down the food chain to lose control we don't know who had access to that within that company we don't know of was stored physically in a safe location we don't know if somebody was imbedded in one of those companies that might see this is an opportunity to find social security numbers or mind whatever data came their way for profit we nash national security cetera we don't know so the what the national archives did is violated their own policy which is derived from nist standards and b regulations and lost control of millions of veterans files and records and now in the most recent case thousands of federal employees those are the simple facts well that you mention now you had there was originally veterans data on that what process did you go to is that currently encrypted or did you delete the information from that file this is this is this dr did not i'm very careful i am careful but what i do this dr i have the proper certification is to before i would leave the building with this that it was wiped and i have the technology that was used to wipe the drive i have it certified that it has no information on it at this point it's clear and no and real ok mr brill right it had no here to help me retrieve data off of that quote unquote wiped hard drive sir if the drive was wiped properly and completely the answer is general you cannot here's the problem if there is a big difference between i believe i've wiped the drive and i wipe the drive we find for example that organizations  sometimes discover that a disgruntled employee may have run a wiping program to get rid of data that would incriminate them but not all wiping programs are created equally effective and some of them work very very well some of them w not well at all that's why it's important not just to say wipe the drive but as i think the inspector general has suggested that it be wiped in a forensically acceptable way and possibly it's about security chain of possession of sensitive information and the chairman i think there's a larger cultural issue with the archives in terms of employee satisfaction and following technology is moving at such a fast pace that things processes and procedures that were acceptable six months ago may not be acceptable today i can i know that when i moved to virginia thirty years ago my driver's license number was my social security number i think our social security numbers were used on a lot of documentation i ask to when you wrote a check write your your driver's license number on it that was your social security number when all of the information not all the information but a good deal of the information became electronic and much easier to manipulate and use in ways and in all of the data was in the more concentrated small device like paul has mentioned it's becoming more and more of a challenge to deal with that and to protect that information so our procedures our policies have to catch up to the reality of today and continuously change as technology changes we got to get well they came up with a series of recommendations i think i said twenty nine recommendations at least twenty nine all of which we are have are working to implement most of them have been by i know it is more than fifty percent probably more like three quarters you can see how that can be a problem if you do an internal audit to see what your weaknesses are and we have an implement how recommendations i know that there that the cia are always working on implementing all the recommendations and i am going to say that within the next six months and i may have to correct that after i talk to the cia i'm sorry we're going to try to cannot be considered an audit it was performed by s a i c under what's called a program review for information service management assistance that's called prism it was perfect so it's not technically loud to be called an audit it was not an audit it does not in fact c in their prism report specifically states that it's not an audit what would you classify it's a review that was done in the for management in addition to the audit work that we do where we've determined that i t security is a material weakness the twenty nine have not been adopted today we believe and only two have been composed close out of completed talks satisfaction can i just follow up on twenty seven out of the twenty nine have not been implemented that was reported on september i believe one hundred twenty eight was supporting for just this past month to management r r we put together a matrix defining why we believe twenty seven to twenty nine had not been corrected we requested a meeting in september to discuss this  have you made your determinations as to the causes of the that are laos what specific actions have you taken the determination of what how the hard drive was was went missing was stolen is an investigatory responsibility of the inspector general so we are waiting for the investigation to be complete we have however determined that there were certainly internal control weaknesses that allowed whatever happened to happen and we have made substantial changes in the way the controls of the equipment who can have access to it and we are ready to take disciplinary action against those people who are not following existing policy but we are waiting for the end of the investigation bright i am the investigation your question is is an investigation complete no we are actively investigating we have new information which i cannot discuss publicly at this open hearing but we do have progress in our investigation and as as the nature of investigation is extremely sensitive we and the acting archivist is correct we respectfully requested whether we respect we requested they hold off because we don't want to do anything at this point that could damage our investigation so in that case that is correct we have respectfully request that this might actually be held back pending further inch of our investigation or in support of our investigation thank you integration costs whether we're going to get a full operational capability by two thousand and twelve if you look at the track record to date i think it's the answer is likely no and so what we want to see is real clear plans for the next three increment exactly what's going to be delivered so we can measure to that this is similar in cost mr chairman we were here a year ago talking about fit to i was a five hundred million dollars contract at one time the system at one time that double quickly ok we want to avoid a situation like that has has there been a i guess we'll call it a cavalier attitude to would tax payers money in this instance i wouldn't say that but i would say that the management discipline that we would like to see from the government is clearly not where we want to be and i'll give you an example where we looked at these contractor reports and we see contractor reports where they're spending money receiving funds but not getting the work done you know there's a program management technique that's when be endorsed called are in value management we look at those reports and scrub them and what we need here is we need the program office to pay close attention those reports so that we're overseeing the contractor in the governments in charge not the contractor would you supply it as committee w industry standards that nara could use that would that would have helped this situation and you have a comment whether one comment on the multiple classifications g a o has done a lot of work on sensitive but on classified data this is dated but you know today that two to three years ago there were over seventy class cations sensitive but on class eight by date and i think what the answer to the congressman's question is consolidating those many classifications is a clear work in progress and it's incomplete thank you but it was mr brill any comment on the industry the industry standard i think if there's if there's anything to be said about industry standards th ere's a recognition that the more complex you make any program the more likely you are to have problems if you can keep things simple if you can classify things in a limited number of buckets and you have some clear rules about what to do in each case then it is much more likely that you're going to have a very high degree of success in that program we see all the time you know my work is kind of divided into sure in some cases were brought in in advance to try to avoid problems but in a lot of cases where the the firemen were the guys who got the call when something terrible happens and i think it would be fair to tell you that when that happens we can end up in most cases classifying the incident into one of two major buckets one is it happened the other is it happened but it shouldn't have happened that it was an avoidable problem that if rules had been follow if standards had been followed if for example something as simple as a patch from a vendor had been applied to a computer wouldn't happen if a fire wall was properly configured wouldn't have happened if we can manage those if we can avoid the avoidable incidents by simplification by good management by good follow up by good or it's that's key there will always be incidents human beings will always make mistakes machines are not infallible so rather than than sometimes throwing up our hands and saying things happen let's classify it simply let's stop the things that we can reasonably prevent through what i consider a commercially reasonable set of controls have plans in place for what we're going to do if something happens in spite of our best efforts and recognize as everybody has said here that the environment changes the first computer that i used at the pentagon back in one thousand nine hundred sixty eight has two thousand positions of memory two k the systems in my office now are measured not in kilobytes but in petabytes and one petabyte is a million gigabytes the vast amounts of data means that we have to treat it in a systematic fashion those who figure out how to do that how to build the security into the network build it into the systems tend to have fewer mistakes and the mistakes in late and probably a lot of this has been already discussed but what would each one of you recommend after the investigation into the breaches into the delays and so on what would you recommend as we move forward because this is valuable information that's stored in the archives if there are breaches  the machinery in some way collapses what kind of backup systems do we need to have what do we need to build into our basic wittman so as you said mr brill these things should not have happened any of you look forward and tell us what you would like to see if it's my nature what can i do not i there's two different issues here in terms of the breaches in the events that transpired i think that if you look at nowra today we have a policy and procedures that are defined because they've been derived from nist and on be so we got we have that piece of the equation the question that we move forward now is ensuring through training and oversight that there is compliance with those requirements and f as appropriate punishment because those regulations which are on our books which are in our requirements say that of people violate the security provisions appropriate administrative and potentially criminal action criminal charges or the oversight i'm sorry who should do the oversight the agency's approach i'm not a program official i do audit investigations they agencies in charge with oversight of programs ensuring that their programs are implemented and and successful so the agency needs to to do that piece of the puzzle i'm there to provide whatever guidance and support i can in that regard and should somebody or entity fail to live up to their requirements on that or do investigations and returns criminal i'm there to do the criminal investigations and my staff who determines there should be an investigation responsibility with  that's my decision if imo if i'm alerted to a case it happens all the time we get hotline calls we get people coming to us we get formal referrals once my office becomes aware of an event or event we make a decision my system specs jennifer audit's and assistants back to invent general for investigations we work the issue we make determinations if we believe it's potential for criminal we work for the department of justice as we're quiet by law to do if we believe it's administr y take a different track where we believe that nothing is inappropriate happen it's not my responsibility in that regard we may just do a referral but it weighs on my shoulders and we address that  you were mentioning that we should have standards what should we do in order to avoid these kinds of problems well breaches i don't know what you would do but what would you suggest is going towards any i years and i was assigned to the office of the secretary of defense as a mobilization designate and we started looking even back then at information security and i remember a meeting that i had with the then deputy assistant secretary of defense for audits and i had just successfully compromised a data center that i'd been requested to test out and what i said to him was this you how can you go before congress and have to say that the standards that you're using maybe would not be acceptable in a major corporation you know i work with corporations primarily not governments but what i found is there is an evolution in the standards that have come out the internal controls as as the inspector general has said following things like sarbanes oxley following the changes in governance in the corporate world have changed things the changes that occurred in two thousand and six when the federal rules of civil procedure were modified as a result of the work of the sedona conference to recognize the importance of digital records in the civil litigation process there's been a sea change people are realizing that the key to this is good management it's no different than it was a hundred years ago when we had paper records we could preserve them but that didn't mean they were going to be readable unless we preserve them properly and we protected them properly digital records are no different the techniques vary but the principles are the same and isn't it always the same ma'am that that responsibility has to be taken somebody has to be the person that you can talk to about it and that there are standards whether we use the i standards whether we use the the good work that's been done at nist whether we use the standards of other organizations i don't really care what standard there are but if we have a standard and we all agree to it then an agency knows what to do you know what you can ask them the auditor's know that it's a fair game that you're testing on the basis of rules so i think what i'm seeing is that just as corporate sins have recognized that the way that they handled automated records in the past is no longer acceptable if you did what you did a few years ago you're likely to find a judge holding that you committed spoliation him and that there can be penalties for that just as i said to the guy at the defense department years ago i think that if we're lucky as citizens there's a two way street between the private sector in the public sector in terms of exchanging knowledge research that's done best practices and to the extent that that that can be done i think there's great value to be had let's see what some of the best run companies are doing let's see why the the the standards are changing what she what's being done i think the real key in getting that information is perhaps the simplest thing that anyone can do and i can express it in one word ask committee has been valuable in providing outside expert advice in the development of e r a its members represent expertise in an extremely wide range of areas  however as far as we can tail on the committee does not include want to expire or even anyone with direct experience in the area of information technology information security i think all of the members who have responsibility for systems certainly have responsibility for information security security over those systems and therefore come to the committee with with a wealth of experience in how they deal with their own systems do they bring a knowledge of information security like for instance your fellow panelists mr brill who like rarely israel is unique i do too but i mean there has to be i mean just have  i think you're probably right mr chairman and we can certainly look at the membership and if it if we are deficient in that role in having that kind of person maybe mr brill would even like to join a sarah