While the hearing discussed all Federal agencies and at the hearing GAO released a report on Information Security-Serious Weaknesses Place Critical Federal Operations and Assets at Risk, the main focus was on the Department of Veterans Affairs and the Social Security Administration.
Experts say most computer crime is committed by employees authorized to use the system.
Huse and Ryan discussed criminal cases where SSA employees, including field office benefit authorizers and claims handlers, stole or illegally manipulated data on SSA computers. GAO was able, during the penetration testing at VA, to gain the level of access that would have allowed them to alter, disclose or delete sensitive information, such as financial data and personal information on veterans' medical records and benefit payments. The most disturbing fact is that GAO's penetration went undetected because the VA does not have a monitoring system. The penetration testing of the SSA exposed vulnerabilities in the SSA's computer system to both external and internal intrusions. Both Mr. Gracey and Mr. Dyer admitted their agencies have weaknesses and each stated that their agency will do everything to address GAO's recommendations.