1 

 

Letter Report: 

DHS’s Implementation of 

Protective Measures for 

Personally Identifiable Information 

(Redacted) 

DEPARTMENT OF HOMELAND SECURITY 

Office of Inspector General 

OIG-07-24 January 2007

Notice: The Department of Homeland Security, Office of Inspector General, has redacted this 

report for public release. A review under the Freedom of Information Act will be conducted upon 

request.
Office of Inspector General 

U.S. Department of Homeland Security 

Washington, DC 20528 

1

January 30, 2007 

 

MEMORANDUM FOR: Hugo Teufel III 

Chief Privacy Officer 

Scott Charbo 

Chief Information Officer 

 

FROM: Richard L. Skinner 

Inspector General 

 

SUBJECT: DHS’s Implementation of Protective Measures for Personally 

Identifiable Information 

We evaluated the Department of Homeland Security’s (DHS) implementation of the 

recommendations set forth in the Office of Management and Budget’s (OMB) Memorandum 06-16, 

Protection of Sensitive Agency Information. Our objective was to determine whether DHS has 

effectively implemented safeguards to protect sensitive and personally identifiable information (PII). 

We transmitted the results of our evaluation to the President’s Council on Integrity and Efficiency 

(PCIE), using the format it suggested. In addition, we are providing the findings of our review to the 

department in this report (See Appendix F). 

DHS and its components are in the process of implementing OMB’s recommended security controls 

for sensitive data and PII. DHS has issued updated policies and procedures to address OMB’s 

recommendations. Further, DHS is in the process of identifying PII systems, encrypting laptop 

computers, and implementing remote access security and offsite transportation and storage controls. 

Until all systems collecting, processing, or storing PII are identified, and adequate controls for 

protecting remote access and storage of PII are implemented, DHS lacks assurance that sensitive 

data are properly protected. 

In response to our draft report, DHS concurred and plans to take steps to implement each of the 

recommendations. DHS’ response is summarized and evaluated in the body of this report and 

included, in its entirety, as Appendix A. In addition, we incorporated DHS’ comments, including the 

identification of the recommendations by the responsible office. 

We hope our observations will be of assistance as you move forward to implement OMB’s 

recommendations for the protection of sensitive agency information. Should you have any questions 
2 

or concerns, please call me, or your staff may contact Frank Deffer, Assistant Inspector General, 

Information Technology, at 202-254-4100. 

Background

OMB has defined PII as:1

 

Any information about an individual maintained by an agency, including, but not limited to, 

education, financial transactions, medical history, and criminal or employment history and 

information which can be used to distinguish or trace an individual's identity, such as their 

name, social security number, date and place of birth, mother’s maiden name, biometric 

records, etc., including any other personal information which is linked or linkable to an 

individual. 

Various laws and regulations have addressed the need to protect sensitive information such as PII 

held by government agencies. These laws and regulations include the Federal Information Security 

Management Act of 2002 (FISMA), the E-Government Act of 2002, the Privacy Act of 1974, and 

OMB Circular A-130, Management of Federal Information Resources. Following several recent 

incidents involving the compromise or loss of sensitive personal information, OMB issued 

Memorandum 06-16 on June 23, 2006. The memorandum recommends measures to compensate for 

the lack of physical security controls when information is removed from or accessed from outside 

the agency location.2

 These measures include (1) verifying the adequacy of agency policies and 

procedures; (2) identifying systems processing PII; (3) encrypting data on laptops and mobile 

computing devices; and, (4) implementing remote access security and offsite transportation and 

storage controls. Agencies were to ensure that these safeguards had been reviewed and implemented 

by August 7, 2006. 

DHS Has Issued Updated Policies and Procedures

DHS issued Sensitive Systems Policy Directive 4300A and National Security Systems Policy 

Directive 4300B to provide guidance to DHS components regarding the protection of information 

technology (IT) systems and data. These policies outline the management, operational, and technical 

controls necessary for ensuring confidentiality, integrity, availability, and authenticity for DHS IT 

systems. The department, with the DHS 4300A Sensitive Systems Handbook and the DHS 4300B 

National Security Systems Handbook, provides specific techniques and procedures for implementing 

the requirements of DHS policy. In addition, DHS separately issued policies and procedures for 

complying with the privacy requirements of the Privacy Act of 1974, E-Government Act of 2002, 

and the Homeland Security Act of 2002, including Management Directive 0470.2, Privacy Act 

 

1

 OMB Memorandum M-06-19, Reporting Incidents Involving Personally Identifiable Information and Incorporating 

the Cost for Security in Agency Information Technology Investments, July 12, 2006. 2

 OMB Memorandum 06-16 outlines four specific actions that agencies are to take to ensure the protection of sensitive 

data. The memorandum also includes a checklist developed by the National Institute of Standards and Technology 

addressing protections for PII that is accessed remotely or physically transported outside of the agency’s secured, 

physical perimeter. 
3 

Compliance, and guidance on the completion of privacy impact assessments (PIA) for systems and 

programs.3

 

In September 2006, the DHS Office of the Chief Information Officer (CIO), in conjunction with the 

DHS Privacy Office, updated the department’s 4300 policy directives and handbooks to reflect the 

recommendations outlined in OMB Memorandum 06-16. DHS policy was updated to (1) require the 

encryption of PII when removed from a DHS facility; (2) require that remote access to PII be 

two-factor authentication mechanisms based on agency-controlled certificates or hardware tokens; 

(3) prohibit remote downloading and storage of PII unless documented in the system security plan 

(SSP).4 In addition, DHS policy requires that user sessions be terminated after 20 minutes of 

inactivity, and that sensitive information stored on any laptop computer that may be used in a 

residence or on travel be encrypted using Federal Information Processing Standard (FIPS) 

Publication 140-2, Security Requirements For Cryptographic Modules, approved encryption. The 

updated policy requirements were incorporated into the department’s certification and accreditation 

(C&A) tool in August 2006. 

PII System Identification Is Still In Progress

DHS has integrated the identification of PII systems, as well as the determination of necessary 

protection mechanisms for these systems, into the department’s C&A process. DHS requires that 

privacy threshold assessments (PTA),5

 PIAs, SSPs, system risk assessments,6 and information 

security categorization7 be completed as part of the system C&A process. DHS began requiring 

PTAs in January 2006 to ensure that systems collecting, processing, or storing PII are identified. 

DHS component officials are responsible for developing draft PTAs, which are then validated by the 

DHS Privacy Office. The PTA validation process determines whether a system must be covered by 

a PIA, in accordance with the E-Government Act of 2002 and the Homeland Security Act of 2002. 

PIAs, in conjunction with SSPs, security categorizations, and risk assessments, ensure that system 

security controls are implemented to address the risk associated with PII. 

 

3 A PIA is an analysis of how PII is collected, stored, protected, shared, and managed. Under the E-Government Act of 

2002, a PIA should (1) determine the risks and effects of collecting, maintaining, and disseminating information in 

identifiable form via an electronic information system; and (2) evaluate protections and alternative processes for 

handling information to mitigate potential privacy risks. The E-Government Act of 2002 requires the Chief Privacy 

Officer to ensure that components complete PIAs for all new technologies, new collections of personal information, and 

new systems or existing systems that are being substantially updated.

4

 The SSP provides a complete description of the information system, including purposes and functions, system 

boundaries, architecture, user groups, interconnections, hardware, software, encryption techniques, and network 

configuration. The SSP also provides an overview of the security requirements of the system and describes the controls 

in place or planned for meeting those requirements 

5

 The PTA consists of a series of questions designed to aid system owners and program managers in determining if a 

system must be covered by a PIA. Whereas PIAs are usually completed for programs and a PIA can cover a number of 

systems, all DHS systems are required to have a 

6

 Risk Assessment is the process of identifying the risks to system security and determining the probability of 

occurrence, the resulting impact, and additional safeguards that would mitigate this impact 7

 Information security categorization, as required by FISMA and outlined in FIPS Publication 199, is the process of 

identifying the potential impact (low, moderate, or high) to organizations or individuals in the event of a security breach, 

i.e., loss of data confidentiality, integrity, or availability. In September 2006, DHS updated its information security 

policy to require that all PII systems be given a potential impact level of at least moderate for data confidentiality. 
4 

DHS has completed SSPs, security categorizations, risk assessments, and draft PTAs for most of the 

department’s 699 systems. DHS is in the process of validating the completed PTAs and PIAs. The 

DHS Privacy Office planned to complete the validation of the existing PTAs by the end of 

October 2006. In addition, DHS component officials are to complete all PIAs for DHS Privacy 

Office approval by the end of fiscal year (FY) 2007. Until DHS completes and validates the security 

documentation, PTAs, and PIAs for its systems and programs, the department lacks assurance that 

the risks associated with sensitive data and PII have been determined and appropriate security 

controls have been identified. 

Graph 1: Completion of Security and Privacy Documentation 

Source: Office of Inspector General (OIG), based on DHS FISMA and Privacy Office documentation 

Encryption of Laptop Computers Has Not Been Completed

DHS has not encrypted sensitive data or PII stored on laptop computers. Of the 16 DHS 

components, only four had implemented laptop computer encryption. Specifically, --------------- - 

------------------------------------------ ----------- ------------------------------- - - ------------------- 

-------- ---------------- ------------ ---- ------------- reported that they had implemented full hard drive 

encryption on many of their laptop computers. --------------------------- officials stated that they plan 

to encrypt the remaining laptop computers once hardware limitations and inventory issues are 

resolved, and sufficient software licenses are obtained. ------------------------ -- -------------------------- 

Security and Privacy Document Completion Progress 

Document Review Progress

Security Plan

As of August 16, 2006

Security Categorization

As of August 16, 2006

Risk Assessment

As of September 7, 2006

Draft PTA

As of September 7, 2006

PTAs Validated

As of September 8, 2006

Systems Required to be

Covered by a PIA

Systems Not Required 

to be Covered by a PIA 

PIAs Approved

As of September 8, 2006
5 

---------------------------- ) officials stated that hard drive encryption had been implemented on all 

laptop computers, but they were not able to confirm that this actually had been accomplished. 

Officials from the remaining 12 DHS components stated that they are in the process of implementing 

the encryption mechanisms recommended by OMB and required by DHS. For example, the 

----------------------------------- ----------- began implementing laptop encryption in September 2006. 

In addition, the -------------------------------------------- ------------------------------- ------ is in the process 

of implementing full hard drive encryption on --- -- - ----------------------------------------------- 

---- ---- ----------------------------------- - --------- -- ---------- ---- - --------- -- ------------- -- --------- 

-------------- laptop computers.- Until adequate encryption mechanisms have been implemented, 

there is increased risk that sensitive data or PII may be compromised through the loss or theft of 

laptop computers and mobile computing devices. 

PII Remote Access and Storage Controls Need Strengthening 

DHS has not implemented the OMB recommended controls over remote access to, and offsite 

transportation and storage of, sensitive and PII data. We interviewed DHS component officials and 

reviewed security documents for a sample of 25 DHS systems that collect, use, or store PII.9

 DHS 

components have not: 

• Encrypted PII for offsite transportation and storage. For 21 of the systems, component 

officials transport backup media containing PII to an alternate storage facility. The data for 

only two systems is encrypted during transportation, and the data for only one system is 

encrypted while stored offsite. 

• Established adequate remote access security controls for PII. For each of the 23 systems with 

remote access capabilities, DHS components employ an encrypted VPN connection for 

remote access connections to PII. DHS components have implemented two-factor remote 

access authentication for 18 (78 percent) of the 23 systems. In addition, DHS components 

require re-authentication after 20 minutes of inactivity on 14 (61 percent) of the 23 systems, 

and after 30 minutes of inactivity on an additional seven systems (30 percent). 

• Implemented sufficient controls over PII copies or extracts. DHS components have not 

implemented a process to verify that extracts are erased within 90 days if no longer required 

on any of the 11 systems that allow users to download PII data. In addition, DHS 

components reportedly enforce encrypted remote storage of downloaded data on only 3 of 

the 11 systems, through the use of measures such as hard drive encryption on the 

workstations connecting to the system. Further, a process has been implemented on only 1 of 

the 25 systems to ensure that any computer-readable data extracts made by administrators are 

erased within 90 days if no longer required. 

DHS components are in the process of implementing the OMB-recommended remote access security 

and offsite transportation and storage controls. For example, ------- ----- is developing an encryption 

plan for backup media containing PII sent to a remote location and the ---------------------------------- 

--------- is currently implementing two-factor authentication for remote access VPN connections. 

 

8

 -- ------- - -- --- --- -------- - --- - - - - - ---- -- ---- - - --- ----- ----------- -- ------- - ----- 9

 See Appendices B – E. 
6 

According to DHS component officials, the implementation of enhanced remote access and storage 

controls has been hindered by uncertainty regarding the applicability and scope of the OMB 

recommendations and new DHS requirements. For example, the Information System Security 

Managers (ISSM) for USSS and USCIS were uncertain whether the electronic transfer of data to a 

remote site through a network connection constitutes offsite transportation and storage, or whether 

hardcopy printouts of PII data should be considered downloads under the new requirements. 

Component officials also requested clarification on whether the OMB and DHS requirements 

applied equally to all PII data, including PII data limited to DHS employee contact information. 

Until adequate controls are implemented for protecting remote access to, and offsite transportation 

and storage of, sensitive data and PII, DHS lacks assurance that sensitive data is properly protected. 

Recommendations 

We recommend that the Chief Privacy Officer (CPO): 

1. Ensure completion of the identification of systems that collect, process, or store personally 

identifiable information, as well as the assessment of the risk associated with the systems and 

data. 

We recommend that the CIO:Encrypt personally identifiable information stored on laptop computers 

and mobile computing devices, as well as data transported and stored at an alternate facility. 

3. Establish proper remote access security controls for access to PII, including two-factor 

authentication for remote access connections and session termination after 20 minutes of 

inactivity. 

4. Implement sufficient controls over electronic copies and extracts of personally identifiable 

information, including procedures to ensure that copies or extracts made by users or 

administrators are erased within 90 days if no longer required. 

5. Identify aspects of the updated DHS policies and procedures requiring clarification, and 

provide additional guidance to component officials on the requirements. 

Management Comments and OIG Analysis

DHS agreed with recommendation 1. The CPO is reviewing all component systems to determine 

whether PII is collected, processed, or stored. The DHS Privacy Office has developed a corrective 

action plan to complete and approve all remaining PTAs by June 30, 2007 and all PIAs by the end of 

FY 2008. 

We agree that the steps CPO has taken, and plans to take, satisfy this recommendation. 

Recommendation 2 

DHS agreed with recommendation 2. The CISO will direct the component ISSMs with systems 

identified as non-compliant to implement encryption on systems with PII data. 

 

We agree that the steps DHS plans to take satisfy this recommendation. 
7 

DHS agreed with recommendation 3. The CISO will direct the component ISSMs with systems 

identified as non-compliant to implement two-factor authentication and session termination after 20 

minutes of inactivity. 

We agree that the steps DHS plans to take satisfy this recommendation. 

 

DHS agreed with recommendation 4. The CISO will recommend policy improvement to 

DHS MD 4300A and 4300B before July 31, 2007. The CISO will direct the component ISSMs with 

systems identified as non-compliant to implement controls to ensure that data extracts are monitored 

and deleted within 90 days. 

We agree that the steps DHS plans to take satisfy this recommendation. 

5 

DHS agreed with recommendation 5. The CISO will review all recommendations to 

DHS MD 4300A and 4300B to update or clarify PII requirements or guidance. 

We agree that the steps DHS plans to take satisfy this recommendation. 

********************* 

We conducted our audit from August to September 2006 under the authority of the Inspector 

General Act of 1978, as amended, and according to generally accepted government audit standards.
Appendix A: Management Response 

8
Appendix A: Management Response

9 
Appendix A: Management Response

10 
Appendix A: Management Response

11 
Appendix B: DHS Component Systems Reviewed

12 

Component System(s) 

--------------- ---------------- • -------- - ------------ ------------------- - - --------- 

--------------------- • -------------- -------- ------------ -------------------- - -------- 

• -------------- --------------------- - --------- -- --------------- 

---------- ------------- ---------- 

------------ - --------------- ------- • --------------- - ------------ - - -------- ----------------------- 

• --------------- -- - ----------------------------------------- 

----------- --------------- ------------ - - 

---------------------------- --- • ----------------------- - ----------- -------- - ------ -------- 

------- -- -- -- --------------------- - • ----------------- ------------------------------------ ------------ 

----------- ------------ • ----------------- -------------------------------- 

---------------------------------- • --------- - ---- ------------ - --------------- - ----- 

------------------------- --- --- 

------------- - • -------------- ------------------------------- - ------------------------ 

--------------------------------- 

-------- 

• -------------- --------------- ----- - ----------- ---------- 

---------------------- ---- 

--------------- 

• ------ - ------------------------- --------------------------- 

• ------------- -------- --- - --- - ---------- - --- ----------------- 

----- ---- ------------ - - - --------- ---- 

------------------ • -------------------------------------------- ------ --------------------- 

• ------- ---------------------------- - ---- ------------------------------------ • ---------------------- - ----------- ------ - - 

---------------------------- • ------- - ------------ - ----------- --------- 

------ ------ ------------- • -------------------------- --------------------- 

-------------- ---------- • -------------- ----------- -------- 

----- ------------------------------- • ----------------------- --------------- -------- 

------------------------- -- ---- • -------- - ----- - ----- --- ---- ------------ - ----------- ------------ 

---------------------------------- 

--------------- • --------------- 

• ----------------- ------------------------------------------ --- 

-------------------------------- ----------- 

• -------------- ------- -------- --------- ---------- 

--------------------------------- • -------------------- - ---------- ------------ 
Appendix C: Offsite Transportation and Storage of PII 

13 

Offsite Transportation and Storage of PII 

Component PII Is PII data: 

System(s) Transported/stored at an 

offsite location? 

Encrypted during offsite 

transportation? 

Encrypted during offsite 

storage? 

------ 

• ------ Yes No No 

• -------- Yes No No 

-------- 

• -------- Yes No No 

• -------- Yes Yes No 

---------- 

• --------- Yes No No 

• ------ Yes No No 

------ 

• --------- Yes No No 

• -------- Yes No No 

------------- ------ 

• -------- -- -- -- No N/A N/A 

• ---------- Yes No No 

------ 

• -------- Yes No No 

--------------- 

• ------- Yes No No 

----------------- 

• -------- Yes No No 

• -------- Yes No No 

------ 

• ------------ Yes Yes Yes 

• ------- Yes No No 

----- 

• ------- No N/A N/A 

• ------- No N/A N/A 

-------- 

• ----- Yes No No 

• ----- Yes No No 

------------- 

• --------- Yes No No 

• --------------- Yes No No 

-------- 

• --------- Yes No No 

• -------- Yes No No 

------- 

• --------- No N/A N/A 
Appendix D: Remote Access to PII

14 

Remote Access to PII 

Component PII Are the following established for remote access connections: 

System(s)

Encrypted VPN? Two-factor authentication? 20-minute or less time-out 

function? 

------ 

• ------ Yes Yes (ID/password+token) No (30 minutes) 

• ------- Yes Yes (ID/password+token) No (30 minutes) 

--------- 

• -------- Yes Yes (ID/password+IP address) Yes (5 minutes) 

• -------- Yes Yes (ID/password+IP address) No (60 minutes) 

---------- 

• --------- Yes Yes (ID/password+certificate) Yes (5 minutes) 

• ------ N/A (no remote access) N/A N/A 

----- 

• --------- Yes Yes (ID/password+token) Yes (20 minutes) 

• ------- Yes Yes (ID/password+token) Yes (20 minutes) 

------------------- 

• -------- -- -- -- Yes Yes (ID/password+token) No (30 minutes) 

• ---------- Yes Yes (ID/password+certificate) Yes (20 minutes) 

--- -- 

• ------- Yes Yes (ID/password+token) No (30 minutes) 

-------------- 

• ------- Yes No (ID/password only) Yes (20 minutes) 

--------------- - - 

• -------- Yes No (ID/password only) No (30 minutes) 

• --------- Yes Yes (ID/password+IP address) No (30 minutes) 

------ 

• ------------ Yes No (ID/password only) Yes (15 minutes) 

• ------ Yes No (ID/password only) No (120 minutes) 

----- 

• ------ Yes Yes (ID/password+IP address 

or certificate) Yes (20 minutes) 

• ------- Yes Yes (ID/password+IP address 

or certificate) Yes (20 minutes) 

--------- 

• ---- Yes Yes (ID/password+token) Yes (20 minutes) 

• ---- Yes Yes (ID/password+token) Yes (20 minutes) 

----------- -- 

• --------- Yes Yes (ID/password+token) Yes (20 minutes) 

• -------------- N/A (no remote access) N/A N/A 

--------- 

• --------- Yes Yes (ID/password+token) Yes (15 minutes) 

• ------- Yes Yes (ID/password+token) No (30 minutes) 

------- 

• --------- Yes No (token being implemented) Yes (15 minutes) 
Appendix E: Downloading PII Copies or Extracts 

15 

Downloading PII Copies or Extracts

Component PII If users can copy or extract data: System(s) Are extracts tracked & 

deleted within 90 days? 

Is data encrypted when 

stored remotely? 

Are data extracts by 

administrators monitored & 

deleted within 90 days? 

------ 

• ------ No Partial (if stored on laptop) No (not deleted) 

• -------- N/A (cannot copy) N/A No (not deleted) 

-------- 

• -------- N/A (cannot copy) N/A No (not monitored or deleted)

• --------- N/A (cannot copy) N/A No (not monitored or deleted)

---------- 

• --------- No Yes No (not deleted) 

• ------ No No No (not monitored or deleted)

------ 

• --------- N/A (cannot copy) N/A No (not deleted)

• -------- N/A (cannot copy) N/A No (not monitored or deleted) 

------------------- 

• -------- -- -- -- N/A (cannot copy) N/A Yes 

• ---------- No Yes No (not monitored or deleted) 

--- --- 

• -------- N/A (cannot copy) N/A No (not monitored or deleted) 

--------------- 

• ------- No No No (not monitored or deleted) 

--------------- - - 

• -------- N/A (cannot copy) N/A No (not deleted)

• --------- N/A (cannot copy) N/A No (not deleted)

------ 

• ------------ N/A (cannot copy) N/A No (not deleted)

• ------- N/A (cannot copy) N/A No (not deleted)

------ 

• ------- No No No (not monitored or deleted) 

• ------- N/A (cannot copy) N/A No (not deleted)

-------- 

• ----- No Partial (if stored on laptop) No (not deleted)

• ---- N/A (cannot copy) N/A No (not deleted)

----------- -- 

• --------- N/A (no users) N/A No (not monitored or deleted) 

• -------------- No Yes No (not monitored or deleted) 

-------- 

• --------- No No No (not monitored or deleted) 

• ------- No No No (not monitored or deleted) 

------- 

• --------- No No No (not deleted)
Appendix F: DHS OIG Response To PCIE Data Collection Instrument 

16 
Appendix F: DHS OIG Response To PCIE Data Collection Instrument

17 
Appendix F: DHS OIG Response To PCIE Data Collection Instrument

18 
Appendix F: DHS OIG Response To PCIE Data Collection Instrument

19 
Appendix F: DHS OIG Response To PCIE Data Collection Instrument

20 
Appendix F: DHS OIG Response To PCIE Data Collection Instrument

21 
Appendix F: DHS OIG Response To PCIE Data Collection Instrument

22 
Appendix F: DHS OIG Response To PCIE Data Collection Instrument

23 
Appendix F: DHS OIG Response To PCIE Data Collection Instrument

24 
Appendix F: DHS OIG Response To PCIE Data Collection Instrument

25 

Additional Information and Copies 

To obtain additional copies of this report, call the Office of Inspector General 

(OIG) at (202) 254-4100, fax your request to (202) 254-4285, or visit the OIG 

web site at www.dhs.gov/oig.

OIG Hotline 

To report alleged fraud, waste, abuse or mismanagement, or any other kind 

of criminal or noncriminal misconduct relative to department programs or 

operations, call the OIG Hotline at 1-800-323-8603; write to DHS Office of 

Inspector General/MAIL STOP 2600, Attention: Office of Investigations – 

Hotline, 245 Murray Drive, SW, Building 410, Washington, DC 20528; fax 

the complaint to (202) 254-4292; or email DHSOIGHOTLINE@dhs.gov. The 

OIG seeks to protect the identity of each writer and caller.