U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

44–368 PDF 2008

S. HRG. 110–619 

PASSPORT FILES: PRIVACY PROTECTION NEEDED 

FOR ALL AMERICANS 

HEARING 

BEFORE THE

COMMITTEE ON THE JUDICIARY 

UNITED STATES SENATE 

ONE HUNDRED TENTH CONGRESS 

SECOND SESSION 

JULY 10, 2008 

Serial No. J–110–105 

Printed for the use of the Committee on the Judiciary 

( 

(II) 

COMMITTEE ON THE JUDICIARY 

PATRICK J. LEAHY, Vermont, Chairman 

EDWARD M. KENNEDY, Massachusetts 

JOSEPH R. BIDEN, JR., Delaware 

HERB KOHL, Wisconsin 

DIANNE FEINSTEIN, California 

RUSSELL D. FEINGOLD, Wisconsin 

CHARLES E. SCHUMER, New York 

RICHARD J. DURBIN, Illinois 

BENJAMIN L. CARDIN, Maryland 

SHELDON WHITEHOUSE, Rhode Island 

ARLEN SPECTER, Pennsylvania 

ORRIN G. HATCH, Utah 

CHARLES E. GRASSLEY, Iowa 

JON KYL, Arizona 

JEFF SESSIONS, Alabama 

LINDSEY O. GRAHAM, South Carolina 

JOHN CORNYN, Texas 

SAM BROWNBACK, Kansas 

TOM COBURN, Oklahoma 

BRUCE A. COHEN, Chief Counsel and Staff Director 

STEPHANIE A. MIDDLETON, Republican Staff Director 

NICHOLAS A. ROSSI, Republican Chief Counsel 

(III) 

C O N T E N T S 

STATEMENTS OF COMMITTEE MEMBERS 

Page 

Feingold, Hon. Russell D., a U.S. Senator from the State of Wisconsin, prepared statement ................................................................................................... 43 

Leahy, Hon. Patrick J., a U.S. Senator from the State of Vermont .................... 1 

prepared statement .......................................................................................... 52 

Specter, Hon. Arlen, a U.S. Senator from the State of Pennsylvania ................. 3 

WITNESSES 

Duda, Mark W., Assistant Inspector General for Audits, Department of State, 

Washington, D.C. ................................................................................................. 6 

Geisel, Harold W., Ambassador and Acting Inspector General, Department 

of State, Washington, D.C. .................................................................................. 4 

Raul, Alan Charles, Partner, Sidley Austin, LLP, Washington, D.C. ................. 17 

Rotenberg, Marc, Executive Director, Electronic Privacy Information Center, 

Washington, D.C. ................................................................................................. 13 

Schwartz, Ari, Vice President, Center for Democracy & Technology, Washington, D.C. ........................................................................................................... 15 

QUESTIONS AND ANSWERS 

Responses of Ambassador Geisel to questions submitted by Senators Specter, 

Leahy and Kennedy ............................................................................................. 21 

Responses of Alan Charles Raul to questions submitted by Senator Specter .... 27 

Responses of Marc Rotenberg to questions submitted by Senators Specter 

and Feingold ......................................................................................................... 31 

Responses of Ari Schwartz to questions submitted by Senators Feingold and 

Specter .................................................................................................................. 36 

SUBMISSIONS FOR THE RECORD 

Duda, Mark W., Assistant Inspector General for Audits, Department of State, 

Washington, D.C., statement .............................................................................. 38 

Geisel, Harold W., Ambassador and Acting Inspector General, Department 

of State, Washington, D.C., statement ............................................................... 45 

Kennedy, Patrick F., Under Secretary of State for Management, Department 

of State, Washington, D.C., letter ....................................................................... 50 

Raul, Alan Charles, Partner, Sidley Austin, LLP, Washington, D.C., statement ...................................................................................................................... 54 

Rotenberg, Marc, Executive Director, Electronic Privacy Information Center, 

Washington, D.C., statement .............................................................................. 57 

Schwartz, Ari, Vice President, Center for Democracy & Technology, Washington, D.C., statement ........................................................................................ 79 

(1) 

PASSPORT FILES: PRIVACY PROTECTION 

NEEDED FOR ALL AMERICANS 

THURSDAY, JULY 10, 2008 

U.S. SENATE, 

COMMITTEE ON THE JUDICIARY, 

Washington, D.C. 

The Committee met, pursuant to notice, at 10:03 a.m., in room 

SD–226, Dirksen Senate Office Building, Hon. Patrick J. Leahy, 

Chairman of the Committee, presiding. 

Present: Senators Leahy, Cardin, and Specter. 

OPENING STATEMENT OF HON. PATRICK J. LEAHY, A U.S. 

SENATOR FROM THE STATE OF VERMONT 

Chairman LEAHY. Good morning. Today, the Committee is going 

to hold an important hearing on the unauthorized access of Americans’ passport files. Millions of Americans, including, I expect, 

every member of this Committee, entrust their personal information to the State Department in order to obtain passports and other 

services. We give a great deal of information, but we trust our Government to protect the private information of its citizens. But, 

sadly, the State Department has failed to honor this duty. They 

have left millions of ordinary Americans vulnerable to not only privacy violations but to identity theft that could come from that and 

other crimes. 

Now, last week—while Americans were celebrating Independence 

Day—the State Department’s Acting Inspector General issued a report finding that State Department workers and contractors repeatedly accessed the passport files of entertainers, athletes, and 

other high-profile Americans without proper authorization. Now, I 

do not care whether it is a well-known person or someone we have 

never heard of. Either way it is wrong. And this revelation of passport snooping comes after press reports in March that the passport 

files of three Presidential candidates—Senators Obama, Clinton, 

and McCain—were improperly accessed. Somebody running for office, as they do, give up enough of their privacy as it is. They ought 

to be able to count on their own Government protecting it. 

The Inspector General’s findings raise serious concerns about 

possible violations of the Privacy Act and other Federal laws. And 

according to the report, 85 percent of the passport records included 

in a sample of high-profile Americans had been searched at least 

once—and many files were searched multiple times—during a 51⁄2- 

year period. In fact, one individual’s passport records were 

searched 356 different times by 77 different people. 

2 

The Inspector General’s report reveals that the records of millions of ordinary Americans are also vulnerable to privacy 

breaches. There are no checks in the system to even determine if 

the passport files of the average American are accessed. Now, these 

files, just so we fully understand, contain name, date and place of 

birth, and Social Security numbers. As some of the experts on the 

Internet and data privacy know these are the kinds of facts somebody wants when they want to steal your identity. But the State 

Department does not have a general lack of policies, procedures, 

guidance, and training to stop it. According to the report, the Department’s Passport Information Electronic Records System— 

PIERS—contains the passport records for approximately 127 million passport holders. Now that our Government is requiring us to 

have passports even to go into a friendly country, like Canada, the 

number of passport files to protect grows. 

The State Department could not readily identify the universe of 

Government workers and contractors who have access to this information. The Inspector General estimates that this figure exceeds 

20,000 Government employees from various agencies and outside 

contractors. We might as well just post this stuff on billboards all 

over the country. And the tip of the iceberg in this report is the 

fact that passport information is shared with other agencies, and 

we have no idea what procedures are followed to protect information once it leaves the State Department. So here, sure, take all 

this information, bring it back someday. It has got to be better 

than that. The State Department Inspector General has referred 

this serious matter to the Justice Department. I made it very clear 

to the Attorney General yesterday that I hope the Department’s 

Criminal Division will investigate this thoroughly. If criminal violations have occurred, people ought to go to jail. 

The lax data security at the State Department is not unique. A 

week does not go by without reports of personal data privacy 

breaches at Government agencies and private businesses. Just recently, we had front-page headlines with news about the theft of 

sensitive medical information from the National Institutes of 

Health, and earlier reports of data breaches have involved virtually 

every branch of our Federal Government. I just cannot imagine 

this. You might as well just open up the files and leave them out 

on the street corner and say, ‘‘Here, help yourself.’’ 

The Inspector General’s report is just the latest example of why 

we should have swift action on the Leahy-Specter Personal Data 

Privacy and Security Act. Senator Specter and I put this together. 

It is a comprehensive privacy bill that would help to prevent data 

security breaches and provide further protections in the handling 

of American’s private data. And I hope that the Senate will 

promptly pass it. 

Data privacy and security at our Federal agencies is a serious 

and growing problem. We have to address it. So we have to understand not only what went wrong at the State Department but elsewhere. And I am glad the Department’s Acting Inspector General 

and Assistant Inspector General for Audits are here to share their 

findings. And we have a distinguished panel of privacy experts. 

And then I hope we will end up passing the Leahy-Specter bill. 

3 

[The prepared statement of Senator Leahy appears as a submission for the record.] 

With that, I will turn to Senator Specter. 

STATEMENT OF HON. ARLEN SPECTER, A U.S. SENATOR FROM 

THE STATE OF PENNSYLVANIA 

Senator SPECTER. Thank you. Mr. Chairman, I commend you on 

calling this hearing so promptly. The Inspector General’s report 

was issued on July 7th. This is July 10th. That is pretty unusual 

for an oversight committee to move into a field. But I think the implications of this matter warrant it. 

On every turn, we find that privacy is in jeopardy. Yesterday we 

enacted followup legislation on the Foreign Intelligence Surveillance Act, which goes further than we had in the past. And when 

you deal with national security, there are very weighty factors. But 

where you have snoopers, there is absolutely no justification for 

what they are doing. And, regrettably, when you take a look at all 

of the snoopers, it is sort of overwhelming. 

Just last month, sensitive information on about a thousand patients at Walter Reed Army Medical Center exposed a security 

breach. Last year, thieves stole a Transportation Security Administration computer containing information on some 100,000 current 

and former employees. The Department of Agriculture 2 years ago 

exposed 26,000 employees, contractors, and retirees to an invasion 

of privacy. Also in 2006, hackers stole data from the Defense Department system on 14,000 active-duty and retired 

servicemembers’ independents. And the list goes on and on. There 

is obviously a great interest in personalities and high-profile people, but we have to do something very forceful to stop it. 

I was intrigued by one of the statistics in the IG’s report, Inspector General’s report, that the records of one individual were 

accessed a total of 356 times by 77 users between 2002 and 2008. 

I would like to know who that was. Maybe I would be interested 

in that myself. 

[Laughter.] 

Senator SPECTER. There must be something very fascinating, perhaps even lurid, about that particular individual. 

But one of the great values in our society is privacy, and vigilance is the cost of being effective at protecting it. So I am glad to 

see our Committee moving ahead, Mr. Chairman, and I am glad to 

cooperate with you in expediting this important hearing. 

Chairman LEAHY. Well, it would be impossible to move forward 

on this without you, and you have been so good on the privacy bill. 

You know, in Vermont, we tend to respect our privacy a great deal, 

and I will put this story in perspective. I live on a dirt road, an 

old 1850s farmhouse we have had for over 50 years, a lot of land, 

fields, and whatnot. And adjoining farmers hayed the fields and so 

on since I was a teenager. And this was a story in the New York 

Times. It is the only thing I think was ever written about me that 

I have actually saved, even framed, and it goes almost this way. 

It was a Saturday morning. A little farmer was standing on the 

porch. A reporter in an out-of-State car pulls up and says, ‘‘Does 

Senator Leahy live up this road?’’ He said, ‘‘Are you a relative of 

his?’’ He said, ‘‘No. No, I am not.’’ He said, ‘‘Well, are you a friend 

4 

of his?’’ ‘‘Well, not really.’’ ‘‘Is he expecting you?’’ ‘‘No.’’ ‘‘Never 

heard of him.’’ 

[Laughter.] 

Chairman LEAHY. So we love our privacy. 

Senator SPECTER. Well, Senator Leahy, as I understand it, the 

‘‘fahrm’’—also know as the ‘‘farm’’—is expansive enough so that you 

can hide. 

Chairman LEAHY. That it is. 

We are fortunate this morning. Our first witness is Ambassador 

Harold Geisel. Ambassador Geisel currently serves as the Acting 

Inspector General for the Department of State. He assumed the duties of Deputy Inspector General for the Department of State and 

the Broadcasting Board of Governors in June of this year. He is a 

career Department of State foreign service officer. He has dedicated 

more than 20 years to the Department. In 1994, Ambassador 

Geisel was assigned as Acting Inspector General of the State Department. He help the position of Deputy Assistant Secretary of 

State for Information Management from 1995 to 1996, during 

which he directed the development of the Department’s first IT 

strategy plan. He served as our Ambassador to Mauritius in 1996 

to 1999, received his bachelor’s degree in liberal arts from Johns 

Hopkins University and his master’s degree in finance from the 

University of Virginia. And I saw Senator Cardin of Maryland 

smile when I mentioned Johns Hopkins. 

Please go ahead, Ambassador. 

STATEMENT OF AMBASSADOR HAROLD W. GEISEL, ACTING INSPECTOR GENERAL, DEPARTMENT OF STATE, WASHINGTON, 

D.C. 

Ambassador GEISEL. Chairman Leahy, Ranking Member Specter, 

Senator Cardin, thank you for inviting me to discuss with you the 

privacy concerns reported in the results of our review of controls 

over access to passport records in the Department of State’s Passport Information Electronic Records System, or PIERS. The full report has been provided to the Committee. 

In March 2008, media reports surfaced that the passport files 

maintained by the Department of State of three U.S. Senators, who 

were also Presidential candidates, had been improperly accessed by 

Department employees and contractors. On March 21, 2008, the Office of Inspector General, Office of Audits, initiated a review of Bureau of Consular Affairs controls over access to passport records 

and issued the final report 1 week ago, on July 2nd. The OIG made 

22 recommendations to address the control weaknesses, and the 

Department concurred with 19 of them, partially agreed with one, 

and did not agree with two recommendations. 

OIG found many control weaknesses—including a general lack of 

policies, procedures, guidance, and training—relating to the prevention and detection of unauthorized access to passport and applicant information and the subsequent response and disciplinary 

processes when a potential unauthorized access is substantiated. 

As of April 2008, PIERS contained records on about 192 million 

passports for about 127 million passport holders. These records include personally identifiable information, or PII, as it is known, 

such as the applicant’s name, gender, Social Security number, date 

5 

and place of birth, and passport number. PIERS also contains additional information, such as previous names used by the applicant, 

citizenship status of the applicant’s parents or spouse, and scanned 

images of passport photos. PIERS offers users the ability to query 

information pertaining to passports and vital records, as well as to 

view and print original copies of the associated documents. As a result, PIERS records are protected from release by the Privacy Act 

of 1974. Unauthorized access to PIERS records may also constitute 

a violation of the Computer Fraud and Abuse Act. 

At the time of the publicized breaches, neither Consular Affairs 

nor the Department had implemented breach notification policies, 

procedures, or other criteria for reporting incidents of unauthorized 

access of passport records when they were detected. However, between March and May 2008, Consular Affairs and the Bureau of 

Administration took a number of corrective actions, including 

issuing interim guidance on the various steps to be followed and 

decisions to be made in response to a potential incident of unauthorized access to passport records and applicant personally identifiable information, and they issued a Department-wide PII breach 

response policy. 

While these immediate actions taken are commendable, OIG has 

recommended that the Department conduct the necessary vulnerability and risk assessments of all passport systems given the 

weaknesses and data vulnerabilities identified in this review of 

PIERS. Accordingly, OIG believes that the Department should 

make resources available to conduct the assessments as quickly as 

possible. 

OIG also recommended that CA ensure the accuracy of its Privacy Impact Assessments for PIERS and for all other passport systems to accurately reflect security controls for and risks to personally identifiable information. 

I would like to introduce Mr. Mark W. Duda, Assistant Inspector 

General for Audits, who led this review, and he will provide a summary of the findings. 

Thank you for the opportunity to present this timely information 

to you today. Following Mr. Duda’s remarks, we would be happy 

to answer any questions you may have. 

[The prepared statement of Ambassador Geisel appears as a submission for the record.] 

Chairman LEAHY. Thank you, Ambassador. And, of course, Mr. 

Duda, prior to being at the Department of State, was senior evaluator in the Department of Treasury Office of Inspector General, 

as well as auditor in charge at the Smithsonian Institution’s Office 

of Inspector General. And, Senator Cardin, you will be interested 

in known he received a bachelor of science degree in accounting 

from the University of Maryland and a master of business administration from the University of Baltimore. 

Senator CARDIN. I am glad to see that we are getting the best 

talent in the Nation working for us. 

[Laughter.] 

Chairman LEAHY. Mr. Duda, why don’t you go ahead, and then 

we will start with the questions. 

6 

STATEMENT OF MARK W. DUDA, ASSISTANT INSPECTOR GENERAL FOR AUDITS, DEPARTMENT OF STATE, WASHINGTON, 

D.C. 

Mr. DUDA. Chairman Leahy, Ranking Member Specter, members 

of the Committee, thank you for the opportunity to discuss the results of our review of controls over access to passport records in the 

Department of State’s Passport Information Electronic Records 

System, which is also known as PIERS. I will be referring to that 

acronym periodically. 

On March 21, 2008, following the first reported breach of a Presidential candidate’s passport records and at the direction of the 

former Acting Inspector General, the Office of Inspector General, 

Office of Audits, initiated this review of the Bureau of Consular Affairs controls over access to passport records in PIERS. Specifically, 

this review focused on determining whether the Department: one, 

adequately protects passport records and data contained in PIERS 

from unauthorized access; and, two, responds effectively when incidents of unauthorized access do occur. 

During fiscal year 2007, the Department issued about 18.4 million passports domestically and participated or assisted in the 

issuance of about 365,000 passports overseas. 

According to Consular Affairs officials, there were about 20,500 

users with active PIERS accounts as of May 2008, and about 

12,200 of these users were employees or contractors of the Department. PIERS is also accessed by users at other Federal departments and agencies, including the Department of Homeland Security, the Federal Bureau of Investigation, and the Office of Personnel Management, to assist in conducting investigations, security 

assessments, and analyses. 

In our review, OIG found many control weaknesses—including a 

general lack of policies, procedures, guidance, and training—relating to the prevention and detection of unauthorized access to passport and applicant information and the subsequent response and 

disciplinary processes when a potential unauthorized access is substantiated. 

In some cases, Department officials stated that the lack of resources contributed to the lack of controls and to the Department’s 

ability to assess vulnerabilities and risk. OIG described some security and management practices utilized by both the Internal Revenue Service and the Social Security Administration as examples 

where similar improvements could be made by the Department. 

OIG made 22 recommendations to address the control weaknesses found with safeguarding passport records. We did not verify 

instances of unauthorized access, but we did conduct a 

judgmentally determined study to identify the frequency with 

which the records for 150 high-profile individuals were accessed in 

PIERS between September 2002 and March 2008. Our results revealed several patterns that raised serious concerns about the potential for undetected unauthorized access to passport records. Of 

the 150 names included in the study, OIG found that the records 

of 127 individuals, or 85 percent, had been accessed at least one 

time. The results showed a total of 4,148 hits to the passport information for these 150 individuals. OIG made no determination as to 

whether the hits represented authorized or unauthorized access. 

7 

Additionally, although an 85-percent hit rate appears to be excessive, the Department currently lacks any criteria to determine 

whether this is an unusually high rate. 

As stated by the Acting Inspector General, following the publicized passport record breaches, the Department implemented a 

number of corrective actions and has other efforts planned, as we 

have detailed in the report. 

Based on the responses from Department officials, of the 22 recommendations made the Department has agreed with 19 of those 

recommendations; they partially agree with one recommendation; 

and they disagreed with two recommendations. To ensure adequate 

and timely action, OIG will conduct a full compliance followup review of the Department’s implementation of the recommendations 

in this report, as well as Consular Affairs’ process for reviewing 

possible unauthorized accesses by users as identified in our study. 

Thank you for the opportunity to appear before you today. I 

would be happy to answer any questions you have. 

[The prepared statement of Mr. Duda appears as a submission 

for the record.] 

Chairman LEAHY. Well, thank you. As I sort of indicated before, 

I will start with you, Ambassador. I know the State Department 

has placed a number of celebrities on a special watchlist, and dignitaries watch out for that. I am just as concerned by the person 

we do not know the name of who lives down the street, works in 

a store, or whatever else, because they have also given all this information up. And it is one thing with a watchlist. They are not 

on that watchlist. Isn’t it virtually impossible to know if the passport files of ordinary American citizens have been improperly 

accessed? 

Ambassador GEISEL. Senator, that is really the key question. The 

answer is we have the ability to know if they have been accessed. 

We do not at this time know if they have—whether the access is 

authorized or unauthorized, and a crucial part of our recommendations is that we have to know that. 

Chairman LEAHY. Yes, because it is one thing to go and look 

back and say, OK, pick out passport number 2936000 or whatever 

and find that. But I am thinking of—for example, if somebody 

wants to—well, I will check on my neighbor or my former boyfriend 

or girlfriend, or somebody may have a more nefarious thing, I want 

to get this information, I know where this person lives, they are 

fairly wealthy, I want to get this information and sell it to somebody who will probably pay a lot of money for it because they are 

going to use it to clean out their bank account. I mean, there is 

nothing to ring alarm bells when that happens. Is that correct? 

Ambassador GEISEL. As it stands right now, Senator, that is absolutely correct, and that is why I think one of our most important 

recommendations is that the Department take a look at software 

that does work, such as is used currently by the Internal Revenue 

Service or the Social Security Administration. 

Chairman LEAHY. And we know in the past that the Internal 

Revenue Service had a problem with this. People were looking at 

the tax returns of movie actors and all, and usually it was just because it is kind of fun to find out. But if they can do that, they can 

also get the person who runs the local grocery store. 

8 

Mr. Duda, the State Department has brought in a lot of contractors for this surge capacity in processing passport applications, especially when it decided that our neighbor to the north, Canada, 

the most friendly country we have ever been involved with, poses 

such a threat that we have all got to start having passports to go 

there. That is a political comment to the aside only because I think 

the policy is ridiculous. But as a result, a lot of outside people were 

hired. 

Is there a greater vulnerability to snooping if you are using outside contractors because you do not have the kind of leverage that 

you might have in the State Department? If you find a State Department employee doing it, they can be disciplined. They can be 

fired. They can be whatever else. But is there greater concern because we have had to rely so much on outside contractors? 

Mr. DUDA. There could be, but there are actually controls you 

can put in place. Obviously, if the Department is soliciting the 

services of a contractor, they are entering into a contract with a 

vendor, you know, the Department is paying the vendor. The Department writes the contracts. The Department can put whatever, 

you know, is legally feasible into a contract. And one of the things 

that can be put in the contracts is adequate controls to ensure that 

contractors have access to this data. 

Chairman LEAHY. Has that been done? 

Mr. DUDA. Partially. 

Chairman LEAHY. Partially. And shouldn’t we make sure that if 

we are going to have penalties, criminal or otherwise, that they be 

the same whether you are somebody in the State Department or 

somebody in a private contractor? 

Mr. DUDA. Absolutely. 

Chairman LEAHY. Thank you. And in that regard, Ambassador, 

the Attorney General suggested that DOJ will open a criminal investigation into the passport breaches involving the three Presidential candidates based upon the referral from your office. Are 

there going to be more referrals from your office? 

Ambassador GEISEL. We don’t comment on investigations, but 

there will certainly be referrals where we feel that a case can be 

made to the Justice Department and that the Justice Department 

has reasonable probability of achieving a good prosecution. 

Chairman LEAHY. Both Senator Specter and I are former prosecutors, as are a number of the people on this Committee, and, 

frankly, in this kind of thing, I think some well-placed prosecutions 

with the use of the criminal code may be as much of a deterrent 

as you can imagine. 

Senator Specter? 

Senator SPECTER. Thank you, Mr. Chairman. 

Has anybody been caught? 

Ambassador GEISEL. Yes, sir. Those were the referrals that were 

made. 

Senator SPECTER. And what happened as a result of their being 

identified, apprehended, and caught? 

Ambassador GEISEL. Excuse me, sir. 

[Pause.] 

Ambassador GEISEL. If these people have actually been referred 

to Justice, I— 

9 

Senator SPECTER. No, I don’t want to know ‘‘ifs.’’ I want to know 

if you have apprehended people and they have been caught. That 

is what I want to know. 

Ambassador GEISEL. The answer is yes, sir. 

Senator SPECTER. And how many? 

Ambassador GEISEL. Five so far, but it is very much of an ongoing investigation, and I am sure— 

Senator SPECTER. Only five. 

Ambassador GEISEL. So far. 

Senator SPECTER. And have there been prosecutions against 

those individuals? 

Ambassador GEISEL. I am not aware of what Justice is doing 

with those referrals. 

Senator SPECTER. Well, Ambassador, you ought to be. You ought 

to followup as to what the Department of Justice is doing. We 

would like to know that. 

Let me talk to the witness, if I may. I only have 5 minutes. What 

is the motivation behind this, if you know? Is it just curiosity? Is 

it just snooping? Why so many invasions of privacy here? 

Ambassador GEISEL. Well, I hope it is just snooping. I suspect— 

Senator SPECTER. No, no. I don’t want to know what you hope. 

What evidence do you have as to what motivates people to do this? 

Ambassador GEISEL. I don’t think we know yet what motivated 

these particular people to snoop. 

Senator SPECTER. Well, have they been questioned? Obviously, 

they have been. What has the interrogation of these people disclosed? 

Ambassador GEISEL. So far it is snooping, sir. 

Senator SPECTER. So far what? 

Ambassador GEISEL. It is snooping, just as you said. It is snooping. It is peeping. We don’t have any evidence that the—which is 

what I worry about, that someone would do this, for instance, for 

the purpose of perpetrating identity fraud. 

Senator SPECTER. Well, is the Department of State making a real 

effort to push prosecutions? Prosecutor Leahy might say to you 

that if you get a conviction, you deter some people from doing it. 

I certainly would say that. 

Ambassador GEISEL. Amen, Senator. I cannot think of a better 

way—I think there are two— 

Senator SPECTER. So what have you done to pursue prosecutions 

to try to have some deterrence? 

Ambassador GEISEL. We have referred them to the Justice Department. 

Senator SPECTER. Have you followed up? We write lots of letters 

to the Department of Justice. Senator Leahy had a whole portfolio 

of them yesterday talking to the Attorney General. There has to be 

followup. This is a primary responsibility of the Department of 

State, and the Department of State ought to pursue it. 

Ambassador GEISEL. I absolutely agree with you, Senator. 

Senator SPECTER. Well, what do you plan to do about it? 

Ambassador GEISEL. I think the best answer is that we, A, intend to followup but, B, intend to put in a much better system or 

recommend— 

10 

Senator SPECTER. Well, a better system we have talked about, 

but where you have the specific cases, would you give a report to 

the Committee within 30 days on the issue of followup and what 

has happened? 

Ambassador GEISEL. Absolutely, sir. 

Senator SPECTER. I note that the penalty for looking for commercial advantage or financial gain is increased to 5 years. It is 1 year 

otherwise. Has there been any showing that any of these invasions 

of privacy were motivated by commercial advantage or financial 

gain? 

Ambassador GEISEL. Not yet, sir, but as I said, that is our greatest worry. 

Senator SPECTER. Have you pursued the issue as to whether 

somebody is looking for financial gain? 

Ambassador GEISEL. Yes, sir, but as I said, so far it appears to 

be peeping. 

Senator SPECTER. When you have the evidence of unauthorized 

disclosure, do you go to the individuals whose files have been tampered with to see if they have any indication that they have been 

prejudiced in any way by what has happened? 

Ambassador GEISEL. That is part of an ongoing investigation, 

and I am sure you understand that I— 

Senator SPECTER. I understand. I am not asking you about specific cases. I am asking about procedures. I am not asking you 

about a specific case. 

Ambassador GEISEL. Yes, sir. 

Senator SPECTER. I would not intrude on that. 

Ambassador GEISEL. I understand. I don’t know that we have— 

let me ask our people. Have we gone to specific individuals? 

The answer is—as you advised, I will not discuss it in detail, but 

the answer is yes, we have done so. 

Senator SPECTER. The answer is yes to which question? 

Ambassador GEISEL. The answer is yes, we have spoken with individuals to see if they were affected by the— 

Senator SPECTER. I am not asking you about any specific individuals. Have you found any individuals who have been prejudiced 

aside from—just an invasion of privacy is a prejudice all by itself. 

But beyond that, have they lost financially? Have they had anything specific happen as a result of the unauthorized disclosure or 

snooping on their records? 

Ambassador GEISEL. We have not—that is a negative, sir. So far, 

no one has advised that they have been adversely affected in a financial sense by the snooping. 

Senator SPECTER. Well, as a final comment—my red light is on— 

I would urge you to get tough about it and to followup. 

Ambassador GEISEL. Absolutely. 

Senator SPECTER. And reports are not sufficient. When Congress 

is providing criminal penalties, you have a real hammer, and you 

ought to be using it. If you would supply in writing any recommendations you have for modifications of the statute, I think the 

Committee would appreciate that. 

Thank you very much, Ambassador. Thank you, Mr. Duda. 

Thank you, Mr. Chairman. 

Chairman LEAHY. Thank you. 

11 

Senator Cardin? 

Senator CARDIN. Thank you, Mr. Chairman. I certainly agree 

with your comments and Senator Specter’s comments, and I want 

to followup on Senator Specter’s points. 

First of all, I want to thank both of you for what you are doing 

in helping us to put in the right procedures to make sure this 

never happens again. But I just want to underscore the point that 

Senator Specter has made. When we had similar problems in other 

agencies—I think about laptops that were taken out of offices and 

that contained sensitive data that went missing—we were not clear 

as to what was being done with that sensitive information, which 

included Social Security numbers. We know that identity theft is 

one of the largest criminal problems we have in our community 

today. We know that the information contained in passport files 

would be very valuable for people who want to participate in identity theft. As Senator Leahy has said, we know that the information could be valuable for criminals who want information about 

potential targets. So the vulnerability is there with the information, and that is why it is particularly sensitive. 

I think your testimony has raised a lot more questions than we 

have the answers to. Obviously, someone who does this for curiosity to peep in someone else’s records is wrong and needs to be 

disciplined. But if they are doing it for financial reward, if it is part 

of criminal activities, then that is a much more serious issue, and 

we want to know about that also. 

I also believe—and I know there is a large volume of people 

whose records have been unauthorized access. But I think to a certain degree those individuals are entitled to know that. And although in a criminal investigation you may be looking at a specific 

number of cases in order to get the cooperation of the individuals 

whose records were unauthorized accessed, but I do think if someone looked at my passport records, I have a right to know that. 

So are any steps being taken in order to notify the individuals 

whose records were unauthorized accessed so that they are on 

record, first, that that was done and, second, to be alerted to potentially being a victim to other types of activities such as identity 

theft? 

Ambassador GEISEL. To date, Senator, the work that we have 

done, we are not yet at the point, as Mr. Duda explained, that we 

are certain that the access was unauthorized, although obviously 

when you are talking about numerous breaches, it seems a sure 

shot. 

The problem will be—well, we cannot notify anyone until we 

know that the access was unauthorized. In many cases, it would 

have been authorized. For example, someone who often crosses the 

border, the Homeland Security person will have a very good reason 

for going back to that file. But we have a lot more work to do. 

Mr. DUDA. One of the things I wanted to point out is that, you 

know, management’s responsibility is obviously to have a system in 

place, have the controls to prevent unauthorized access to, you 

know, PII information for all Americans. OIG’s role obviously is to 

oversee that and do testing and so forth. 

In this review that we did, we identified such a large number of 

potential unauthorized accesses and a control environment that 

12 

was limited, at best. We made significant recommendations which 

the Department largely agree with and is in the process of implementing. And one of the things they are doing right now, they have 

told us—CIA officials have told us that they are looking into all of 

the potential unauthorized accesses from our case study, and then 

once the determination that the Department makes, they will then 

make referrals to the Office of Inspector General. 

Senator CARDIN. Let me make a recommendation. To the extent 

that you determine that someone’s passport records were accessed, 

unauthorized, will you recommend that that individual be notified 

that his or her records were inappropriately accessed? 

Mr. DUDA. Yes, absolutely. I don’t know whether that will be a 

management responsibility, but OIG definitely— 

Senator CARDIN. Will you let us know whether that recommendation is followed by the agency so that we know whether, in fact, 

those who were victimized are at least aware that they were victimized? 

Mr. DUDA. Yes. One of the corrective actions the Department has 

already implemented is drafting a breach response policy, and I 

don’t recall the exact specifics, but— 

Senator CARDIN. I just want to make sure that we know whether 

the victims, those whose records were accessed inappropriately, 

will be notified, and whether you will be able to follow up to let 

us know whether that, in fact, was carried out by the agency. 

Ambassador GEISEL. We will make that recommendation, Senator. 

Senator CARDIN. I appreciate it. 

The second point, Mr. Chairman, just very quickly, we just finished acting on the FISA statute, and it just raises a question to 

me as to whether agencies are accessing passport records for mass 

data collections. Is any of this involved in a data collection system 

where there is routine information gathered on our passport 

records as part of homeland security or intelligence operations that 

you are aware of? 

Mr. DUDA. Not that I am aware of, but one of our concerns in 

this review or any potential plans of sharing the data in PIERS or 

any of the other passport systems with other agencies for any purpose, we want to make sure that there are adequate controls in 

place. 

Senator CARDIN. Will you also report back to us if your review 

shows that there is mass data collections from the passport records 

that are questionable from the point of view of whether they are 

authorized by statute? 

Mr. DUDA. Absolutely. 

Senator CARDIN. Thank you. 

Thank you, Mr. Chairman. 

Chairman LEAHY. Thank you very much, and if we have other 

questions, we will submit them for the record. There is going to be 

a roll call vote fairly soon, so if we seem to be speeding along, that 

is why. But thank you both very, very much. It helps us highlight 

the concern that we have here. 

The next panel, if we could arrange to bring them up. This panel 

of people are certainly known to this Committee. Marc Rotenberg 

is the Executive Director of the Electronic Privacy Information 

13 

Center, EPIC, in Washington, D.C. He teaches information privacy 

law at Georgetown University Law Center, an excellent school, 

having graduated from there. He has testified before Congress on 

such topics as encryption policy, consumer protection, computer security, communications privacy. He chairs the ABA Committee on 

Privacy and Information Protection. He has served on several national and international advisory panels, including expert panels in 

cryptography policy and computer security for the OECD, legal experts in cyber space law for UNESCO. He is a founding board 

member and former chair of the Public Interest Registry, which 

manages the .org domain. He also served as counsel, in full disclosure, an invaluable member of my staff on the Senate Judiciary 

Committee. He is a graduate of Harvard and Stanford Law School, 

the recipient of more awards than I could even name, but that includes the World Technology Award in Law. 

Mr. Rotenberg, please go ahead. 

STATEMENT OF MARC ROTENBERG, EXECUTIVE DIRECTOR, 

ELECTRONIC PRIVACY INFORMATION CENTER, WASHINGTON, D.C. 

Mr. ROTENBERG. Thank you very much, Mr. Chairman, Senator 

Cardin. I appreciate the opportunity to be here today. 

We have a particular interest in the privacy of personal information collected by Federal agencies, and as the recent news stories 

and the report from the Inspector General have made clear, the 

passport information that we are required to provide to the Government is not adequately protected. And we are particularly concerned about this because there are growing demands on personal 

information by the Federal Government, and with the increasing 

use of identification documents. 

So it is not simply the passport information of Presidential candidates or celebrities that is at issue. It is the personal information 

of people who apply for a driver’s license, work in the Federal Government, or travel to Canada. And for these reasons, we think that 

more needs to be done to protect personal privacy, not only at the 

State Department but also across the Federal Government. 

Now, I think it is helpful to understand the background of the 

particular incident at the State Department to put in context what 

the Inspector General uncovered. It was back in 1992 when State 

Department officials were found to be going through the passport 

files of then Presidential candidate Bill Clinton to try to find embarrassing information. And there was an investigation. The State 

Department subsequently dismissed employees who were engaging 

in this activity. This is precisely the concern about information that 

individuals provide to the Federal Government that will be misused, that will obtained by identity thieves, or that will be used in 

ways that are simply not appropriate. 

So it was because of that 1992 incident that alarm bells literally 

went off this spring at the State Department when it was determined that the passport files of Senators Obama, McCain, and 

Clinton had been improperly accessed. And I think it is worth noting that all three Senators made statements at the time about the 

importance of protecting the privacy of personal information. In 

fact, Senator Obama himself said, ‘‘One of the things that the 

14 

American people count on in their interactions with any level of 

government is that if they have to disclose personal information, 

that it stay personal and stay private.’’ 

Now, the Inspector General’s report, which was undertaken pursuant to the March release of the passport information, provides 

some useful information and some useful recommendations. But I 

should point out that much of the report has been redacted, that 

is to say, of the 22 recommendations contained in the IG’s report, 

only six, in fact, are available for public review. There are many 

sections of the report that have literally been blacked out. If I may 

show the Committee, we have a few pages here from the report. 

[Displays documents.] 

This is a page labeled ‘‘Sensitive but unclassified.’’ The top half 

of the page references the FOIA exemption (b)(2) as the basis for 

withholding the information. The bottom does not even bother with 

the (b)(2) designation. It just blacks out the entire section of the 

report. This is problematic because, of course, to evaluate the adequacy of the recommendations made by the Inspector General, it is 

important to see the whole report. 

Now, we have made—and it is included in my complete statement—a series of recommendations. We do think there should be 

auditing so that whenever there is access, those access events will 

be recorded. We do think there should be improved oversight. We 

think there needs to be some independent evaluation of the privacy 

safeguards within the Federal agencies, including the State Department. But I think most importantly, the legislation S. 495, 

which you, Mr. Chairman, cosponsored along with Senator Specter 

and was favorably reported by this Committee, contains several 

very important provisions that, if in force, might have actually prevented this from occurring, because a big problem today at the 

State Department is that a lot of the information processing is 

being done by private contractors. The agency turns over to a private company the responsibility for producing the passports, for 

collecting the information for the passports, for inspecting the information. And it is in that process of outsourcing the Government 

function that the privacy concern arises. And so this legislation, S. 

495, actually puts in place disciplinary requirements so that if 

these kinds of problems occur, people can be held accountable, opportunities to review the contractor relationship so that an agency 

can make a determination if the contractor is doing enough to protect personal privacy. 

One of the remarkable facts here is that just a few days before 

the State Department revealed that three Presidential candidates 

had their passport files improperly accessed, the agency had renewed its contract with Stanley, the privacy company, a 5-year 

deal for $570 million. I think if a company cannot protect the personal information of American citizens that it obtains, the agencies 

need to rethink some of those contracts. 

So thank you very much for the opportunity. I would be pleased 

to answer your questions. 

[The prepared statement of Mr. Rotenberg appears as a submission for the record.] 

Chairman LEAHY. Thank you very, very much. 

15 

Ari Schwartz is the Vice President and Chief Operating Officer 

of the Center for Democracy and Technology, CDT. He works to 

promote privacy protection in the Digital Age while expanding access to Government information through the Internet. He is the 

leader of the Anti-Spyware Coalition, in 2006 was awarded the 

RSA Award for Excellence in Public Policy for his work in building 

the Anti-Spyware Coalition and other efforts against spyware. He 

has been named to the top five Influential IT Security Thinkers of 

2007 by Secure Computing magazine, served as a member of the 

Department of Commerce National Institute of Standards and 

Technology Information, among others. 

So, Mr. Schwartz, I am delighted you are here because I am a 

bit of a bug or nag in my office on keeping spyware off our computers. 

STATEMENT OF ARI SCHWARTZ, VICE PRESIDENT, CENTER 

FOR DEMOCRACY & TECHNOLOGY, WASHINGTON, D.C. 

Mr. SCHWARTZ. Thank you very much, Senator Leahy, and Senator Cardin as well. Thank you for holding this important public 

hearing and for inviting me to participate. 

I would especially like to commend you, Mr. Chairman, on how 

you opened this hearing. While the news reporting on the subject 

of passport breach has focused on whether Presidential candidates 

or other celebrities had their passport records snooped through, the 

privacy and security of the passport records of average individuals 

has received considerably less attention, and you raised that in 

your opening statement and I appreciate that. 

As we heard earlier, there seems to be little to no protection on 

how to prevent or detect the truly nefarious activities which passport records such as stalking or identity theft that we could see 

with this kind of browsing. 

To address this problem, CDT suggests that Congress take the 

same approach that it did 11 years ago when it was found that IRS 

employees were browsing tax records. Congress should increase 

oversight and civil and criminal penalties on passport records. Just 

to send you to the right place, that is the Taxpayer Browsing Protection Act of 1997 that I know the Chairman and many other people on this Committee worked on. 

The illegal browsing of passport records of Americans by Government employees should be a major concern not only to the millions 

of passport holders but to all Americans as it suggests an inability 

of Government to protect privacy at the highest levels. 

The Inspector General’s report pointed to many flaws in the 

State Department’s ability to protect privacy. CDT has raised many 

of these same concerns over the past 3 years with the State Department. For example, the Inspector General found that the Privacy Impact Assessment for the passport data base was just inaccurate. CDT wrote to Secretary Rice over a year ago to raise concerns about Privacy Impact Assessments at the State Department, 

and particularly the E-Passport program. We never received a 

reply, and no changes to the PIAs were ever made. CDT has since 

found incomplete and inaccurate information in several other Privacy Impact Assessments on the Department of State website. 

16 

The State Department must be held accountable for the failures 

of its privacy program and encouraged to provide resources and 

leadership so that it can be ensured that our privacy is being protected when held by the State Department. 

To prevent other serious breaches of public trust Congress will 

need to address the roots of the problem by more closely monitoring 

the State Department’s collection of personal data. 

While the State Department has clearly been a failing agency 

across the board on privacy, there are several other failing agencies 

as well. For example, one agency that CDT spoke to told us that 

a privacy audit revealed that they had lost track of half of their 

Privacy Act system of records. They simply do not know where millions of personal records were that were originally brought in by 

this agency. One retiring security official from the Department of 

Interior explained publicly, while discussing that agency’s constant 

failures in privacy and security reporting, ‘‘We are promiscuous 

with our data. We don’t know where our data is.’’ 

You can call this a privacy concern. You can call this a security 

concern. You can call it a data management concern. But to the 

American taxpayer, it is certainly called a failure. 

CDT agrees with GAO’s recent analysis suggesting that the way 

to ensure privacy protection at agencies is through improvement in 

existing Government privacy laws, oversight, and leadership. To 

solve these problems beyond our initial State Department specific 

suggestions, CDT recommends that Congress work with the executive branch in the four following areas: 

No. 1, expanding Privacy Act coverage and closing Privacy Act 

loopholes. 

No. 2, improving the quality of Privacy Impact Assessments by 

Government agencies. This would also include Privacy Impact Assessments for Government use of commercial data, as required in 

the Leahy-Specter data breach bill, S. 495 as referenced earlier. 

No. 3, improving privacy leadership. This would include a permanent Chief Privacy Officer position at the Office of Management 

and Budget written into law, Chief Privacy Officers at all major 

component agencies, and the creation of an independent Chief Privacy Officer Council with a similar structure to the CIO and CFO 

councils. 

And, No. 4, increasing and improving privacy reporting and audits. I detail all these suggestions in my written testimony. 

In general, we believe that there is now consensus around a set 

of sound recommendations for action by Congress and executive 

branch to fill the gaps and loopholes in privacy law and policy. 

CDT urges the Committee and the Senate to work quickly so that 

the next President can have the right tools in place upon taking 

office and can get started immediately on strengthening privacy in 

the Federal Government. 

I look forward to working with you, and we thank you for your 

leadership on these important issues. Thank you for your attention, 

and I look forward to your questions. 

[The prepared statement of Mr. Schwartz appears as a submission for the record.] 

Chairman LEAHY. Thank you very much. 

17 

Alan Raul is a partner in the Washington, D.C., office of the 

international law firm Sidley Austin. He chairs Sidley’s Information Law Privacy Practice Group, served as Vice Chairman of the 

White House Privacy and Civil Liberties Oversight Board from 

March 2006 through January 2008. He was the Associate Counsel 

to President Reagan from 1986 to 1988, where he represented the 

White House in connection with the Iran-contra investigation. He 

served as General Counsel to the Office of Management and Budget in the Executive Office of the President. He was nominated by 

President George H.W. Bush and confirmed by the Senate to the 

position of General Counsel at the U.S. Department of Agriculture 

from 1989 to 1993. He is a graduate of Harvard College, Harvard 

University’s Kennedy School of Law, and to show there is no rivalry, the Yale School. 

Please go ahead. 

STATEMENT OF ALAN CHARLES RAUL, PARTNER, SIDLEY 

AUSTIN, LLP, WASHINGTON, D.C. 

Mr. RAUL. Thank you, Chairman Leahy, Senator Specter, Senator Cardin. Thank you for inviting me to testify on protecting the 

privacy of passport files maintained by the U.S. Department of 

State. It is an honor to appear before you this morning. 

I am testifying today in a personal capacity. As you noted, I am 

currently engaged in private law practice in Washington where I 

focus on privacy, data security, and Internet law. And until recently, I also served in a part—time capacity as Vice Chairman of 

the White House Privacy and Civil Liberties Oversight Board. 

This hearing arises because of a recent investigation and report 

by the State Department’s Inspector General indicating that the 

passport files of high-profile individuals, including the files of three 

Presidential candidates—namely, Senators McCain, Obama, and 

Clinton—may have been improperly accessed by State Department 

employees and contractors. The State Department announced this 

week that it had terminated around five contractors in connection 

with what appear to be serious violations of personal privacy, Federal law, and internal controls. 

While the investigation continues, if the facts turn out to be as 

they now appear, there is no question that the standards of the 

Privacy Act of 1974 were not satisfied. To the extent agency employees and contractors accessed passport files with no official need 

to do so, they disrespected the privacy of affected passport holders 

and applicants and brought substantial disrepute upon their agency. 

The Privacy Act, the e-Government Act of 2002, and the Federal 

Information Security Management Act of 2002—FISMA—all require Government agencies to adopt and implement effective controls to prevent just the sort of invasion of personal information 

that occurred here. 

Moreover, each of these Acts authorizes the Director of the Office 

of Management and Budget to assist, guide, and oversee Federal 

efforts in the realm of privacy and information security. Congress 

and the White House should continue to support and encourage 

OMB’s leading role in the field of privacy and information security. 

18 

With regard to the specific incident at hand, it is not clear at this 

point whether any of the individuals whose files were accessed experienced any pecuniary losses or other actual damages that would 

support claims of civil liability under the Supreme Court’s Doe v. 

Chao decision of 2004. However, if any agency employee or contractor ‘‘willfully disclose[d] the material in any manner to any person or agency not entitled to receive it,’’ or ‘‘knowingly and willfully 

request[ed] or obtain[ed] any record concerning an individual from 

an agency under false pretenses,’’ then they would be guilty of a 

criminal misdemeanor and fined up to $5,000. 

It is perfectly clear now, however, that existing law and applicable guidance should have prevented State Department employees 

and contractors from engaging in frolics and detours—or worse— 

through the passport files of politicians, prominent figures, or indeed, of any Americans. The fact that these files were subject to 

access for no good reason is highly troubling. We all expect the 

Government to do much better in safeguarding our personal information. 

Plainly, the State Department must redouble its efforts to conduct privacy impact and risk assessments, to communicate binding 

privacy policies to all parties handling personal information—both 

employees and contractors—provide its employees and contractors 

with meaningful privacy and data security training so they take 

these issues seriously, and ensure effective audit trails for accessing personal information, as well as establishing clear guidelines 

for disciplining and terminating employees and contractors who 

transgress. The State Department should also revisit its administrative, technical, and physical safeguards to prevent future abuse 

of passport files and other personal records. 

At the same time, care must be taken to avoid unduly restricting 

proper access to information that is essential for national security 

purposes. As the 9/11 Commission recommended, and Congress enacted, the country has a critical need to promote an ‘‘information 

sharing environment’’ that transcends traditional governmental 

boundaries in order to help prevent future terrorist attacks. But 

the relevant Government agencies, including the State Department, must effectively integrate protections for privacy and other 

civil liberties into this new information-sharing environment. 

In any event, if the executive branch wishes to hold the private 

sector, State governments, and foreign nations to high standards 

for information privacy and security, it needs to be a consistently 

good role model for privacy itself. To that end, the Government obviously has plenty of room for improvement under existing privacy 

laws and standards for information security. 

Thank you for considering my views. 

[The prepared statement of Mr. Raul appears as a submission for 

the record.] 

Chairman LEAHY. Thank you. The vote has started. I want to ask 

one question, and then we will recess for a couple minutes to see 

if others are coming back. 

Mr. Rotenberg, last year Senator Specter and I introduced our 

Personal Data Privacy and Security Act. Now, this has a specific 

requirement that the General Services Administration has to 

evaluate the privacy security practices of potential Government 

19 

contractors, but then put penalty provisions in if they fail to follow 

and fail to protect data privacy. Would this help? 

Mr. ROTENBERG. Absolutely, Senator. As I was thinking about 

the legislation, which I believe you introduced in 2007, it occurred 

to me this was actually an example where the legislation was 

ahead of the problem. In other words, if these requirements had 

been put in place back in 2007, I believe the State Department 

would have been much more careful in its relationship with the 

private contractor, and I think the private contractor would have 

been much more diligent about the activities of its employees. And 

it was the failure to pass that legislation earlier that very well may 

have made possible this recent breach. 

So I hope the Senate—and the House, of course—act on this. I 

think it would prevent a lot of damage going forward. It is a very 

sensible approach to a real problem. 

Chairman LEAHY. Mr. Schwartz, Mr. Raul, how do you feel about 

that? 

Mr. SCHWARTZ. I strongly agree with that statement. It would 

definitely help privacy and security to have that kind of review, 

and the Government needs to ensure that their security efforts and 

the security efforts of their contractors are the best that there are. 

And I would actually take it a step further and say that the entire 

title of that bill, S. 495, Title 4, would have helped in this case. It 

has better auditing capability in that section, assuming that was 

not done in this case, and improvement of Privacy Impact Assessments, something that the Inspector General specifically pointed 

out in this case was a failure. 

Chairman LEAHY. Mr. Raul? 

Mr. RAUL. Chairman Leahy, due diligence of potential contractors with regard to their information security systems and processes is essential. I think that is recognized in other legislation like 

Gramm-Leach-Bliley, HIPAA, regulations under those statutes. I 

think there is existing guidance that Federal agencies should be 

doing it now. 

I think the message really need to be effectively communicated 

to the various departments and agencies that they need to take 

this seriously. So I would support strongly sending that message to 

all agencies. 

Chairman LEAHY. Well, you know, my concern is we know how 

much there are attacks from outside our borders into all our different computer banks, and a lot of this has been reported in the 

press, and I will not go into some aspects of it for obvious reasons 

in an open session. So we have to guard against that, and we 

should, of course, for the obvious reasons—national security and 

everything else. 

I hate to have to think we have to guard against our own people, 

and yet it seems possible. The Inspector General’s report included 

22 recommendations for improvements in the Consular Affairs Bureau of the State Department. 

We have that the Department is going to implement most of the 

recommendations. Is that going to be enough? Again, I am thinking 

about what we do with our own people. It is a whole different subject what happens when we have countries, not just bad actors outVerDate Aug 31 2005 11:44 Nov 26, 2008 Jkt 044368 PO 00000 Frm 00023 Fmt 6633 Sfmt 6633 S:\GPO\HEARINGS\44368.TXT SJUD1 PsN: CMORC
20 

side but actually state-sponsored efforts to penetrate our computer 

systems. 

Mr. ROTENBERG. Senator, I think the Inspector General’s report 

is helpful, but I don’t think it will be enough. It has recommendations to the agencies, some of which apparently the bureaus are 

disputing. I think there needs to be here a clear mandate about 

how the practices are going to change so that this does not happen 

in the future. And I think there needs to be a comprehensive approach that prevents this from happening in other Federal agencies. 

One of the realities right now is that security breaches are on the 

increase in the Federal Government, and without adequate safeguards to ensure particularly with private contractor access to personal data, I think this problem will continue to get worse. 

Mr. SCHWARTZ. Mr. Chairman, I would say that the external security and the internal security are actually tied together and that 

you cannot really separate the two. It seems in this case, from 

what we know from the public reports, that the State Department 

did not know all the people that had access to it, and did not even 

list all the agencies that have access to it. 

Chairman LEAHY. That really frosted me when I saw that. 

Mr. SCHWARTZ. And then we also see—and I just said from other 

agencies, we know that agencies are losing systems. If they do not 

know where it is, that makes it more vulnerable to outside attack. 

You cannot secure something if you do not know where it is. 

These are all systems that have personal information of Americans in them, so I think that it is a major concern both for the internal threat that comes from this and the external threat as well. 

Mr. RAUL. One of the critical components, Chairman Leahy, in 

any information security program is the conduct of a risk assessment, either incorporated in a Privacy Impact Assessment as required by the Federal Government, or in vulnerability assessments. 

From my review of the redacted version of the Inspector General’s report, it is not clear whether the State Department had conducted sufficient risk assessments in this area. And it sounds like 

they were not sure who had access, what information they had. 

You know, that is unacceptable because risks, as you say, Mr. 

Chairman, can be either internal or external, and for various different motivations. And if an agency does not know what is at risk, 

it cannot possibly protect against it. 

Chairman LEAHY. We will stand in recess. I keep looking up 

here. You are probably wondering what I am looking at. It is those 

five lights in the back which went on some time ago. That is the 

5-minute warning. I am heading to the floor. Take care. 

We will stand in recess. 

[Whereupon, at 11:09 a.m., the Committee was adjourned.] 

[Questions and answers and submissions for the record follow.] 

21 


44368.001
22 


44368.002
23 


44368.003
24 


44368.004
25 


44368.005
26 


44368.006
27 


44368.007
28 


44368.008
29 


44368.009
30 


44368.010
31 


44368.011
32 


44368.012
33 


44368.013
34 


44368.014
35 


44368.015
36 


44368.016
37 


44368.017
38 


44368.018
39 


44368.019
40 


44368.020
41 


44368.021
42 


44368.022
43 


44368.023
44 


44368.024
45 


44368.025
46 


44368.026
47 


44368.027
48 


44368.028
49 


44368.029
50 


44368.030
51 


44368.031
52 


44368.032
53 


44368.033
54 


44368.034
55 


44368.035
56 


44368.036
57 


44368.037
58 


44368.038
59 


44368.039
60 


44368.040
61 


44368.041
62 


44368.042
63 


44368.043
64 


44368.044
65 


44368.045
66 


44368.046
67 


44368.047
68 


44368.048
69 


44368.049
70 


44368.050
71 


44368.051
72 


44368.052
73 


44368.053
74 


44368.054
75 


44368.055
76 


44368.056
77 


44368.057
78 


44368.058
79 


44368.059
80 


44368.060
81 


44368.061
82 


44368.062
83 


44368.063
84 


44368.064
85 


44368.065
86 


44368.066
87 


44368.067
88 


44368.068
89 

Æ 


44368.069