-

OFFICE OF 

INSPECTOR GENERAL 

U.S.DEPARTMENT OF THE INTERIOR 

Recommendation for 

Identifying, Protecting, and

Ensuring Proper Handling of 

Tribal Data and Information

MANAGEMENT ADVISORY

Case No.: 20-0463 October 2020

This is a revised version of the report prepared for public release.
OFFICE OF 

INSPECTOR GENERAL 

U.S.DEPARTMENT OF THE INTERIOR 

OCT 2 2 2020 

- -

Chief of Staff, U.S. Department of the Interior 

Memorandum 

To: Todd Willens 

From: Mark Lee Greenblatt 

Inspector General 

Subject: Management Advisory – Recommendation for Identifying, Protecting, and 

Ensuring Proper Handling of Tribal Data and Information 

Case No. OI-PI-20-0463-I 

In April and May 2020, several stakeholders and interested parties requested that we 

investigate whether U.S. Department of the Interior (DOI) officials disclosed sensitive or 

confidential tribal information to entities outside the U.S. Government. Some of these 

individuals also alleged that DOI or U.S. Department of the Treasury employees worked together 

or separately to intentionally release this confidential tribal information to Alaska Native 

Corporations. We investigated these allegations in collaboration with the Treasury’s Office of 

Inspector General. 

We found that the Treasury emailed the DOI a spreadsheet of Coronavirus Aid, Relief, 

and Economic Security Act (CARES Act) tribal registration data the Treasury had requested and 

collected from the tribes. The spreadsheet contained information such as financial details on 

tribal expenditures, the number of tribal members, and the names and email addresses of points 

of contact the tribes submitted to the Treasury. The Bureau of Indian Affairs (BIA) subsequently 

requested this information from the Treasury to confirm whether the tribes had registered to 

receive CARES Act funding. When the Treasury emailed the information to the DOI as 

requested, it did not mark the data as confidential.

1

We also found that four BIA regional employees2 forwarded the spreadsheet containing 

this tribal registration data to officers of tribes (not Alaska Native Corporations) outside the 

Government.3 The evidence showed that the BIA employees did this in an effort to remind these 

tribes that, according to the spreadsheet, they had not yet registered for CARES Act funding. We 

found that forwarding the entire spreadsheet, which included tribal information that the 

recipients did not need and was unrelated to their specific tribes, was inconsistent with DOI 

guidance that employees are responsible for “properly using and protecting agency data, 

, and one was a . 3 We consulted with the U.S. Department of Justice Public Integrity Section, which declined to accept the case for further 

investigation. 

1 According to the Treasury’s Office of Inspector General, the tribal information the Treasury collected was confidential. We did 

not independently determine whether the information collected and subsequently disclosed was, in fact, confidential, but instead, 

assumed for purposes of this management advisory that the Treasury Office of Inspector General’s determination was correct. 2 One BIA employee was a , two were 

Office of Inspector General | Washington, DC 
information and information systems ensuring their use is only for the execution of official duties 

or authorized purposes.” 4 

We did not find evidence to substantiate the allegation that any DOI or Treasury 

employees worked together or separately to intentionally release this data to Alaska Native 

Corporations. 

This management advisory provides a recommendation to help the DOI ensure proper 

identification and handling of potentially confidential tribal information and prevent future 

improper disclosures of this information. 

The Treasury Provided Tribal Registration Data to the BIA Without Marking the Data 

Confidential 

To support distribution of CARES Act funds, the Treasury asked tribes to register and 

submit information via a portal on its website from April 13, 2020, until April 17, 2020. The 

Treasury then provided the DOI’s Office of the Assistant Secretary for Indian Affairs (AS-IA) 

with the tribal registration data so the BIA could confirm that tribes had submitted the required 

information to receive CARES Act funding. The BIA requested that the Treasury send updated 

data throughout that week so the BIA would have current information. To satisfy the BIA’s 

request, a Treasury official sent updated spreadsheets containing the tribal registration data to the 

AS-IA via email several times during the week of April 13, 2020. We obtained no information 

suggesting that the emails were sent to anyone other than DOI employees.

5 

When the Treasury official sent the spreadsheets to the AS-IA, the emails and 

spreadsheets did not contain any warnings or markings stating that the information was 

confidential, nor were the spreadsheets password protected. As discussed above, the spreadsheet 

included the names of the tribes that submitted the information; the tribes’ authorized 

representatives’ names, titles, and contact information (including phone number and email); and 

other self-reported amounts for the tribes’ population, land base, employees, and expenditures. 

Several stakeholders later asserted that some of the details included in the spreadsheet were 

sensitive and proprietary and argued that release of the information could affect the competitive 

nature of tribal businesses or the opportunities to receive Federal grant funding. 

BIA Officials Sent the Registration Data to Entities Outside the Government 

registration information to an AS-IA , who forwarded the spreadsheet to 

BIA leadership and BIA regional directors. Management for at least one region then forwarded 

this spreadsheet to BIA officials in that region. 

4 DOI Departmental Manual, 375 DM 19.5(E), “Roles and Responsibilities of Department Personnel,” “Employees and 

Volunteers.” See also id. at App. A (discussing relevant authorities). We also note that various DOI training programs discuss the 

proper marking and handling of sensitive information. See, e.g., DOI Training, FY 2020, “Cybersecurity (FISSA), Privacy, 

Records Management, Section 508 Compliance, Controlled Unclassified Information Reference Guides and the DOI Rules of 

Behavior (IMT).”

address. 

On April 16, 2020, a Treasury official emailed the spreadsheet containing the tribal 

5 One of the DOI employees was email 

2 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Later that day, four BIA employees forwarded the entire spreadsheet containing tribes’ 

data to officers of tribes that had not submitted data to the Treasury. The employees told us that 

they sent the information to alert the tribes that they were not listed on the spreadsheet and thus 

might not be registered to receive CARES Act funding. The deadline to submit the data was the 

following day, April 17, 2020. 

When we asked the BIA employees why they sent the entire spreadsheet containing other 

tribes’ data to tribes that had not yet registered, the BIA employees told us they did not look at 

the entire spreadsheet before forwarding the email and did not realize the spreadsheet contained 

potentially confidential information. The employees also noted that they were not advised 

against sending the spreadsheet outside the DOI. When we questioned the BIA employees on 

whether they could have accomplished the task of reminding the tribes to register without 

forwarding the spreadsheet, they said that they simply forwarded the email out of a sense of 

urgency due to the April 17, 2020 deadline. They also noted that they were unable to contact 

some of the tribal representatives over the phone because they did not have the officers’ cellular 

phone numbers and that they often communicated with the tribes by forwarding BIA emails. The 

BIA employees told us that, because they received the email and spreadsheet through their chain 

of command and were not told that the information was confidential or that it should not be 

released outside the DOI, they forwarded the entire email to the tribal officers, as they had done 

with other emails in the past. 

As noted previously, the DOI’s internal guidance explains that employees generally are 

responsible for “properly using and protecting agency data [and] information,” and the DOI’s 

mandatory annual records management training for employees6 covers procedures for sending 

agency information, including potentially sensitive materials, outside the DOI.

7 The BIA 

employees acknowledged that they did not look at the entire spreadsheet before forwarding the 

email to the tribes. Without reviewing the spreadsheets, the employees could not have made an 

assessment as to whether the information was confidential or sensitive and thus subject to the 

DOI guidance cited above. Moreover, the BIA employees did not need to provide this 

information to the tribal officers in order to alert them that, according to the Treasury data, the 

tribes had not yet registered for CARES Act funding. 

We conducted an extensive forensic analysis of the DOI’s archived email system to 

determine whether any other BIA, AS-IA, or DOI employees shared the spreadsheet or the data 

contained therein with other entities or individuals outside the Government. We identified and 

reviewed 75,519 email items. We did not find any other instances in which BIA, AS-IA, or DOI 

employees disclosed the spreadsheet to entities or individuals outside the Government other than 

the emails sent by the four BIA employees discussed above. We also found no evidence 

suggesting that DOI or Treasury employees worked together or separately to intentionally release 

this confidential tribal information to Alaska Native Corporations, and we found no evidence of 

coordinated disclosure or misconduct. 

6 We note that DOI training records showed that three of the BIA employees discussed above had completed their mandatory 

training as required, but one employee had not completed the training since 2017. 7 For example, this information is included in the training program cited previously, DOI Training, FY 2020, “Cybersecurity 

(FISSA), Privacy, Records Management, Section 508 Compliance, Controlled Unclassified Information Reference Guides and 

the DOI Rules of Behavior (IMT).” This training emphasizes requirements for ensuring that any recipient is authorized to access 

and view such materials. Id. 

3 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Recommendation 

In light of the BIA employees’ disclosure of the information identified above, we 

recommend that the DOI take the following actions: 

1. The BIA should consider implementing further training, policies, and/or periodic 

reminders to ensure all BIA officials who handle tribal information understand their 

obligations (a) to identify and protect sensitive and/or confidential tribal information and 

(b) not to disclose such information outside the Government without proper authorization 

or an official need to do so. 

Please provide a written response to us within 90 days describing the actions you have 

taken, or plan to take, to address the recommendation, as well as target dates for these actions 

and the titles of the officials responsible for implementing them. You may email your response to 

doioigreferrals@doioig.gov. 

In accordance with the IG Empowerment Act of 2016, we intend to publish this 

memorandum on our website, in redacted form, no later than 3 days from the date we issue it to 

you. Within the next 10 business days, a representative from our Office of Investigations will 

contact you, or your designee, to discuss the memo and the status of your response. 

If you have any questions or need further information concerning this matter, please 

contact Matthew Elliott, Assistant Inspector General for Investigations, at 202-208-5745. 

cc: Tara Sweeney, Assistant Secretary for Indian Affairs. 

4 
Report Fraud, Waste,

and Mismanagement

Fraud, waste, and mismanagement in

Government concern everyone: Office 

of Inspector General staff, departmental 

employees, and the general public. We 

actively solicit allegations of any 

inefficient and wasteful practices, fraud, 

and mismanagement related to 

departmental or Insular Area programs 

and operations. You can report 

allegations to us in several ways.

 By Internet: www.doioig.gov

 By Phone: 24-Hour Toll Free: 800-424-5081

Washington Metro Area: 202-208-5300

 By Fax: 703-487-5402

 By Mail: U.S. Department of the Interior 

Office of Inspector General

Mail Stop 4428 MIB 

1849 C Street, NW. 

Washington, DC 20240