Information Security: Protecting Personally Identifiable Information
Published: 2008-01-25T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The loss of personally identifiable information can result in substantial harm, embarrassment, and inconvenience to individuals and may lead to identity theft or other fraudulent use of the information. As shown in prior GAO reports, compromises to such information and long-standing weaknesses in federal information security raise important questions about what steps federal agencies should take to prevent them. As the federal government obtains and processes information about individuals in increasingly diverse ways, properly protecting this information and respecting the privacy rights of individuals will remain critically important. GAO was requested to (1) identify the federal laws and guidance issued to protect personally identifiable information from unauthorized use or disclosure and (2) describe agencies' progress in developing policies and documented procedures that respond to recent guidance from the Office of Management and Budget (OMB) to protect personally identifiable information that is either accessed remotely or physically transported outside an agency's secured physical perimeter. To do so, GAO reviewed relevant laws and guidance, surveyed officials at 24 major federal agencies, and examined and analyzed agency documents, including policies, procedures, and plans. In commenting on a draft of this report, OMB stated that it generally agreed with the report's contents.
section_title: What GAO Found
paragraphs: Two primary laws (the Privacy Act of 1974 and the E-Government Act of 2002) give federal agencies responsibilities for protecting personal information, including ensuring its security. Additionally, the Federal Information Security Management Act of 2002 (FISMA) requires agencies to develop, document, and implement agencywide programs to provide security for their information and information systems (which include personally identifiable information and the systems on which it resides). The act also requires the National Institute of Standards and Technology (NIST) to develop technical guidance in specific areas, including minimum information security requirements for information and information systems. In the wake of recent incidents of security breaches involving personal data, OMB issued guidance in 2006 and 2007 reiterating agency responsibilities under these laws and technical guidance, drawing particular attention to the requirements associated with personally identifiable information. In this guidance, OMB directed, among other things, that agencies encrypt data on mobile computers or devices and follow NIST security guidelines regarding personally identifiable information that is accessed outside an agency's physical perimeter. Not all agencies had developed the range of policies and procedures reflecting OMB guidance on protection of personally identifiable information that is either accessed remotely or physically transported outside an agency's secured physical perimeter. Of 24 major agencies, 22 had developed policies requiring personally identifiable information to be encrypted on mobile computers and devices. Fifteen of the 24 agencies had policies to use a "time-out" function for remote access and mobile devices requiring user reauthentication after 30 minutes of inactivity. Fewer agencies (11) had established policies to log computer-readable data extracts from databases holding sensitive information and erase the data within 90 days after extraction. Several agencies indicated that they were researching technical solutions to address these issues. Gaps in their policies and procedures reduced agencies' ability to protect personally identifiable information from improper disclosure. At the conclusion of GAO's review, OMB announced in November 2007 that agencies that did not complete certain privacy and security requirements, including those just described, received a downgrade in their scores for progress in electronic government initiatives. According to OMB, it will continue working with agencies to help them strengthen their information security and privacy programs, especially as they relate to the protection of personally identifiable information. In view of OMB's recent actions in this area and GAO's previous recommendations on improving agency information security and implementation of FISMA requirements, GAO is making no further recommendations at this time.

section_title: Letter
paragraphs: Concerns regarding the security of personal information on federal  systems have been raised by incidents in which such information has been  compromised by the loss or theft of equipment or by unauthorized access.  For example, in a reported incident involving the Department of Veterans  Affairs, a laptop computer containing the personal data of millions of  veterans was stolen from the home of an employee in May 2006. Similar  incidents have occurred at other agencies, such as an incident at the  Department of Energy, detected in mid 2005, when hackers gained access  to more than 1,500 records, and another in June 2006, when the  Department of Agriculture reported a hacker had broken into several  systems that potentially compromised personal records for up to 26,000  people.
These security breaches highlight the importance of federal agencies  having effective information security controls in place to protect  personally identifiable information—that is, information that can be used  to locate or identify an individual, such as names, aliases, Social Security  numbers, biometric records, and other personal information that is linked  or linkable to an individual. Loss of such information may lead to identity  theft or other fraudulent use of the information, resulting in substantial  harm, embarrassment, and inconvenience to individuals.
As the federal government obtains and processes information about  individuals in increasingly diverse ways, it is critically important that it  ensure that the privacy rights of individuals are respected and this  information is properly secured and protected. Security breaches that  compromise such information raise important questions about the steps  that federal agencies should take to prevent them.
To help answer these questions, you asked us to (1) identify the federal  laws enacted and guidance issued to protect personally identifiable  information from unauthorized use or disclosure and (2) describe  agencies’ progress in developing policies and documented procedures that  respond to recent Office of Management and Budget (OMB) guidance to  protect personally identifiable information that is either accessed remotely  or physically transported outside an agency’s secured physical perimeter.
To address the first objective, we reviewed relevant laws and guidance  and determined the requirements and recommended actions relevant to  securing personally identifiable information. To address the second  objective, we surveyed the 24 major federal agencies and departments,  and we examined and analyzed agency policies, procedures, plans, and  artifacts against recent OMB guidance. Appendix I contains additional  details on the objectives, scope, and methodology of our review. We  conducted this performance audit from September 2006 to January 2008 in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
subsections: section_title: Background
paragraphs: The growth in information technology, networking, and electronic storage  has made it ever easier to collect and maintain information about  individuals. An accompanying growth in incidents of loss and  unauthorized use of such information has led to increased concerns about  protecting this information on federal systems. As a result, the basic law  governing privacy protections, the Privacy Act of 1974, has been  supplemented by more recent laws and guidance that are particularly  concerned with the protection of personally identifiable information  maintained in automated information systems.
Protecting personally identifiable information in federal systems is critical  because its loss or unauthorized disclosure can lead to serious  consequences for individuals. These consequences include identity theft or  other fraudulent activity, which can result in substantial harm,  embarrassment, and inconvenience. In 2006, the estimated losses  associated with identity theft to U.S. organizations were $49.3 billion.
subsections: section_title: Incidents Have Placed Personal Information at Risk
paragraphs: Like other sectors, the federal government has seen significant exposures  of personally identifiable information. According to a 2006 congressional  staff report, since January 2003, 19 departments and agencies reported at  least one loss of personally identifiable information that could expose  individuals to identity theft. (App. II provides selected examples of these  and other incidents.)
A series of data breaches at federal agencies have involved system  intrusion, phishing scams, and the physical loss or theft of portable  computers, hard drives, and disks. During fiscal year 2006, federal  agencies reported a record number of incidents to the U.S. Computer  Emergency Readiness Team (US-CERT). For example, in 2006 there were  5,146 incident reports—a substantial increase over the 3,569 incidents  reported in 2005. During this period, US-CERT recorded a dramatic rise in  incidents where either physical loss or theft or system compromise  resulted in the loss of personally identifiable information.
section_title: Weaknesses in Implementing Security Policies Have Persisted at Federal Agencies
paragraphs: As illustrated by recent security incidents and as we have previously  reported, significant weaknesses continued to threaten the  confidentiality, integrity, and availability of critical information and  information systems used to support the operations, assets, and personnel  of federal agencies. In their fiscal year 2006 financial statement audit  reports, 21 of 24 major agencies indicated that deficient information  security controls were either a reportable condition or a material  weakness. Our audits continue to identify similar weaknesses in  nonfinancial systems. Similarly, in their annual reporting under 31 U.S.C. §  3512 (commonly referred to as the Federal Managers’ Financial Integrity  Act of 1982), 17 of 24 agencies reported shortcomings in information  security, including 7 that considered it a material weakness. Agency  inspectors general have also noted the seriousness of information security,  with 21 of 24 including it as a “major management challenge” for their  agencies.
According to our reports and those of inspectors general, persistent  weaknesses appear in the five major categories of information system  controls: (1) access controls, which ensure that only authorized  individuals can read, alter, or delete data; (2) configuration management  controls, which provide assurance that only authorized software programs  are implemented; (3) segregation of duties, which reduces the risk that  one individual can independently perform inappropriate actions without  detection; (4) continuity of operations planning, which provides for the  prevention of significant disruptions of computer-dependent operations;  and (5) an agencywide information security program, which provides the  framework for ensuring that risks are understood and that effective  controls are selected and properly implemented. Most agencies had  weaknesses in each of these categories. Accordingly, we have designated  information security as a governmentwide high-risk issue in reports to  Congress since 1997—a designation that remains in force today.
section_title: Federal Laws and Guidance Provide a Foundation for Agencies to Protect Personally Identifiable Information
paragraphs: The primary laws that provide privacy protections to personal information  are the Privacy Act of 1974 and the E-Government Act of 2002; these laws  describe, among other things, agency responsibilities with regard to  personally identifiable information, which include providing security. The  security of information held by the federal government is specifically  addressed by FISMA, which requires agencies to develop, document, and  implement agencywide programs to provide security for their information  and information systems, including personally identifiable information.  Along with technical guidance from NIST, FISMA establishes a risk-based  approach to security management, which requires an agency, among other  things, to categorize its information and systems according to the potential  impact to the agency should the information be jeopardized. In the wake  of recent incidents of security breaches involving personal data, OMB has  issued guidance reiterating the requirements of these laws and guidance,  drawing particular attention to those associated with personally  identifiable information. In addition, OMB updated and added to  requirements for reporting security breaches and the loss or unauthorized  access of personally identifiable information.
subsections: section_title: Privacy and Security of Personal Information Are Addressed in Several Federal Laws
paragraphs: The major requirements for the protection of personal privacy by federal  agencies come from two laws, the Privacy Act of 1974 and the privacy  provisions of the E-Government Act of 2002. In addition, FISMA, which is  included in the E-Government Act of 2002, addresses the protection of  personal information in the context of securing federal agency information  and information systems.
To protect personal privacy, the Privacy Act places limitations on  agencies’ collection, disclosure, and use of personal information  maintained in systems of records. The act describes a “record” as any item,  collection, or grouping of information about an individual that is  maintained by an agency and contains his or her name or another personal  identifier. It also defines “system of records” as a group of records under  the control of any agency from which information is retrieved by the name  of the individual or by an individual identifier. The Privacy Act requires  that when agencies establish or make changes to a system of records, they  must notify the public by a notice in the Federal Register identifying,  among other things, the type of data collected, the types of individuals  about whom information is collected, the intended “routine” uses of the  data, and procedures that individuals can use to review and correct  personal information. The act’s requirements also apply to government  contractors when agencies contract for the development and maintenance  of a system of records to accomplish an agency function.
The provisions of the Privacy Act are consistent with and based primarily  on a set of principles for protecting the privacy and security of personal  information—the Fair Information Practices. These principles have been  widely adopted as the standard benchmark for evaluating the adequacy of  privacy protections; one of the principles is security safeguards. In this  regard, the Privacy Act requires agencies to “establish appropriate  administrative, technical, and physical safeguards to insure the security  and confidentiality of records and to protect against any anticipated  threats or hazards to their security or integrity which could result in  substantial harm, embarrassment, inconvenience, or unfairness to any  individual on whom information is maintained.”
The E-Government Act of 2002 strives to enhance protection for personal  information in government information systems by requiring that agencies  conduct privacy impact assessments (PIA). A PIA is an analysis of how  personal information is collected, stored, shared, and managed in a federal  system. More specifically, according to OMB guidance, a PIA is an  analysis of how information is handled (1) to ensure handling conforms to  applicable legal, regulatory, and policy requirements regarding privacy; (2)  to determine the risks and effects of collecting, maintaining, and  disseminating information in identifiable form in an electronic information  system; and (3) to examine and evaluate protections and alternative  processes for handling information to mitigate potential privacy risks.
Agencies must conduct PIAs (1) before developing or procuring  information technology that collects, maintains, or disseminates  information that is in a personally identifiable form or (2) before initiating  any new data collections involving personal information that will be  collected, maintained, or disseminated using information technology if the  same questions are asked of 10 or more people. OMB guidance also  requires agencies to conduct PIAs when a system change creates new  privacy risks, for example, changing the way in which personal  information is being used. The PIA requirement does not apply to all  systems. For example, no assessment is required when the information  collected relates to internal government operations, the information has  been previously assessed under an evaluation similar to a PIA, or when  privacy issues are unchanged.
Besides these primary laws, Congress has passed laws requiring protection  of personally identifiable information that are agency-specific or that  target a specific type of information. For example, the Veterans Benefits,  Health Care, and Information Technology Act, enacted in December 2006,  establishes information technology security requirements for personally  identifiable information that apply specifically to the Department of  Veterans Affairs (VA). The act mandates, among other things, that VA  develop procedures for detecting, immediately reporting, and responding  to security incidents; notify Congress of any significant data breaches  involving personally identifiable information; and, if necessary, provide  credit protection services to those individuals whose personally  identifiable information has been compromised. Another example is the  Health Insurance Portability and Accountability Act of 1996 (HIPAA),  which requires the Secretary of Health and Human Services to adopt  standards for the electronic exchange, privacy, and security of health  information. These standards apply to agencies, such as the Department of  Defense and VA, to the extent they are covered by HIPAA.
FISMA is the primary law governing information security in the federal  government; it also addresses the protection of personal information in the  context of securing federal agency information and information systems.  FISMA, which establishes a risk-based approach to security management,  defines federal requirements for securing information and information  systems that support federal agency operations and assets. Under the act,  agencies are required to provide sufficient safeguards to cost-effectively  protect their information and information systems from unauthorized  access, use, disclosure, disruption, modification, or destruction, including  controls necessary to preserve authorized restrictions on access and  disclosure (and thus to protect personal privacy, among other things). The  act also requires each agency to develop, document, and implement an  agencywide information security program to provide security for the  information and information systems that support the operations and  assets of the agency (including those provided or managed by another  agency, contractor, or other source).
Specifically, the act requires that these information security programs  include, among other things,    periodic assessments of the risk and magnitude of harm that could result  from the unauthorized access, use, disclosure, disruption, modification, or  destruction of information or information systems; risk-based policies and procedures that cost-effectively reduce  information security risks to an acceptable level and ensure that  information security is addressed throughout the life cycle of each  information system;   subordinate plans for providing adequate information security for  networks, facilities, and systems or groups of information systems, as  appropriate;   security awareness training for agency personnel, including contractors  and other users of information systems that support the operations and  assets of the agency;   periodic testing and evaluation of the effectiveness of information security  policies, procedures, and practices, performed with a frequency depending  on risk, but no less than annually, and that includes testing of  management, operational, and technical controls for every system  identified in the agency’s required inventory of major information systems;   a process for planning, implementing, evaluating, and documenting  remedial action to address any deficiencies in the information security  policies, procedures, and practices of the agency;    procedures for detecting, reporting, and responding to security incidents;    plans and procedures to ensure continuity of operations for information  systems that support the operations and assets of the agency.
In addition, FISMA requires agencies to produce an annually updated  inventory of major information systems (including major national security  systems) operated by the agency or that are under its control, which  includes an identification of the interfaces between each system and all  other systems or networks, including those not operated by or under the  control of the agency.
Like protecting other information and systems, protecting personally  identifiable information is dependent on agencies’ having established  security programs that include the elements described above. Among  other things, agencies must identify the personally identifiable information  in their information systems, determine the appropriate risk level  associated with it, develop appropriate controls to secure it, and ensure  that these controls are applied and maintained.
FISMA also establishes evaluation and reporting requirements. Under the  act, each agency must have an annual independent evaluation of its  information security program and practices, including control testing and  compliance assessment. Evaluations of non-national security systems are  to be performed by the agency inspectors general or by an independent  external auditor, while evaluations related to national security systems are  to be performed only by an entity designated by the agency head.
FISMA also requires each agency to report annually to OMB, selected  congressional committees, and the Comptroller General on the adequacy  of information security policies, procedures, and practices, and  compliance with the act’s requirements. In addition, agency heads are  required to annually report the results of their independent evaluations to  OMB. OMB is required to submit a report to Congress each year on  agency compliance with the act’s requirements, including a summary of  findings of agencies’ independent evaluations.
section_title: FISMA Requires NIST to Develop Security Guidance
paragraphs: Other major FISMA provisions require NIST to develop, for systems other  than national security systems, standards for categorizing information and  information systems according to risk levels, guidelines on the types of  information and information systems that should be included in each  category, and standards for minimum information security requirements  for information and information systems in each category. Accordingly,  NIST developed the following guidance:    Federal Information Processing Standards (FIPS) 199, Standards for  Security Categorization of Federal Information and Information  Systems. This standard is to be used by all agencies to categorize all their  information and information systems based on the objectives of providing  appropriate levels of information security according to a range of risk  levels. In addition, NIST has published Special Publication 800-60, to  provide guidance on how to implement FIPS 199 and how to determine  whether a system or information should be categorized as having a high-,  moderate-, or low-risk impact level.
FIPS 200, Minimum Security Requirements for Federal Information and  Information Systems. This standard provides minimum information  security requirements for information and information systems in each  risk category.
NIST Special Publication 800-53, Recommended Security Controls for  Federal Information Systems. The publication provides guidelines for  selecting and specifying security controls for information systems  supporting the federal government.
section_title: OMB Provides Guidance Reiterating Requirements on Security and Privacy
paragraphs: OMB is responsible for establishing governmentwide policies and for  providing guidance to agencies on how to implement the provisions of  FISMA, the Privacy Act, and other federal information security and privacy  laws. It has issued both recommended steps and required actions to  protect federally owned information and information systems. For  example, OMB memorandum M-05-08 directs agencies to designate a  senior official with overall responsibility for information privacy issues,  including taking appropriate steps to protect personally identifiable  information from unauthorized use, access, disclosure, or sharing, and to  protect related information systems from unauthorized access,  modification, disruption, or destruction.
Following the May 2006 VA data breach, OMB issued guidance reiterating  agency responsibilities under the laws and technical guidance, drawing  particular attention to the requirements associated with personally  identifiable information.
OMB memorandum M-06-15, Safeguarding Personally Identifiable  Information, re-emphasizes agency responsibilities to safeguard  personally identifiable information and to appropriately train employees in  this regard. It also requires agencies to perform a review of their policies  and procedures for the protection of personally identifiable information,  including an examination of physical security, and to take corrective  action.
OMB memorandum M-06-16, Protection of Sensitive Agency Information,  asks agencies to verify that existing organizational policy adequately  addresses the information protection needs associated with personally  identifiable information that is accessed remotely or physically removed. It  recommends, among other things, that all information on mobile  computers and devices be encrypted unless a written waiver is issued  certifying that the computer does not contain any sensitive information. In  addition, M-06-16 recommends that agencies use a NIST checklist included  in the memorandum. The NIST checklist states that agencies should verify  that information requiring protection as personally identifiable  information is appropriately categorized as such and that it is assigned an  appropriate risk impact category.
OMB also updated and added to requirements for reporting security  breaches and the loss or unauthorized access of personally identifiable  information. OMB memorandum M-06-19 directs agencies to report all  incidents involving personally identifiable information to US-CERT within  1 hour of discovery of the incident. Further, OMB recommends that  agencies establish a core management group responsible for responding to  the loss of personal information in a memorandum issued September 20,  2006. In OMB memorandum M-06-20, FY 2006 Reporting Instructions for  the Federal Information Security Management Act and Agency Privacy  Management, OMB asks agencies to identify in their yearly FISMA reports  any physical or electronic incidents involving the loss of or unauthorized  access to personally identifiable information. In these annual reports,  agencies also are required to report numbers of incidents for the reporting  period, the number of incidents the agency reported to US-CERT, and the  number reported to law enforcement.
Most recently, OMB memorandum M-07-16, Safeguarding Against and  Responding to the Breach of Personally Identifiable Information,  requires agencies to develop and implement breach notification policies— that is, policies governing how and under what circumstances affected  parties are notified in case of a security breach. Agencies were to develop  and implement such policies and associated plans within 120 days from  the issuance of the memorandum (May 22, 2007).
The memorandum also reiterates four particularly important existing  security requirements that agencies should already have been  implementing: (1) assigning an impact level to all information and  information systems, (2) implementing the minimum security  requirements and controls in FIPS 200 and NIST Special Publication 800- 53 respectively, (3) certifying and accrediting information systems, and  (4) training employees. With regard to the first of these, OMB stressed that  agencies should generally consider categorizing sensitive personally  identifiable information (and information systems within which such  information resides) as moderate or high impact.
In addition, this memorandum reiterates the guidance provided in  memorandum M-06-16 on protection of personally identifiable information  and changes earlier recommendations to requirements.
These and other OMB memorandums significant to the protection of  personally identifiable information are briefly described in table 1.
section_title: Not All Agencies Had Developed Policies and Procedures Reflecting OMB Guidance on Protection of Personally Identifiable Information
paragraphs: Ensuring that agency policies and procedures appropriately emphasize the  protection of personally identifiable information in accordance with  applicable laws and guidance is an important aspect of protecting personal  privacy. In recent guidance, OMB directed agencies to encrypt and  otherwise protect personally identifiable information that is either  accessed remotely or physically transported outside an agency’s secured  physical perimeter. Specifically, agencies were required to    encrypt all data on mobile computers or devices that carry agency data,  unless the data are determined to be nonsensitive;   allow remote access only with two-factor authentication, where one of the  factors is provided by a device separate from the computer gaining access;   use a “time-out” function for remote access and mobile devices that  requires that users re-authenticate after 30 minutes of inactivity; and log all instances in which computer-readable data are extracted from  databases holding sensitive information, and verify that each extract  including sensitive data has been erased within 90 days or that its use is  still required.
OMB also recommended the use of a NIST-provided checklist for the  protection of remote information, which was included in memorandum M- 06-16. The checklist provides specific actions to be taken by federal  agencies for the protection of personally identifiable information that is  categorized as moderate or high impact and that is either accessed  remotely or physically transported outside an agency’s secured, physical  perimeter, including information transported on removable media and on  portable or mobile devices such as laptop computers and personal digital  assistants. The controls and assessment methods and procedures in the  checklist are a subset of what is currently required under NIST Special  Publications 800-53 and 800-53A for moderate- and high-impact  information systems. In addition, NIST standard (FIPS 140-2, Security  Requirements for Cryptographic Modules) is to be used by federal  organizations when it is specified that cryptographic-based security  systems are to be used to provide protection for sensitive or valuable data.  All encryption modules that protect sensitive data must follow this  standard.
However, not all agencies had developed policies and procedures  reflecting OMB guidance for protecting personally identifiable information  that is accessed remotely or physically transported outside an agency’s  secured perimeter. Of the 24 major agencies, 22 had developed policies  requiring personally identifiable information to be encrypted on mobile  computers and devices. A smaller number of agencies had policies to  provide other protections recommended by OMB, 14 of the agencies had  two-factor authentication policies for remote access. Fifteen of the  agencies had policies to use a “time-out” function for remote access and  mobile devices requiring user reauthentication after 30 minutes of  inactivity. One agency used a reauthentication time shorter than 30  minutes (15 minutes). Fewer agencies (11) had established policies to log  computer-readable data extracts from databases holding sensitive  information and erase the data within 90 days after extraction. However,  several of the agencies that had not established such policies indicated  that they were researching technical solutions to address these issues.
Four agencies had policies requiring the use of the NIST checklist  recommended by OMB. In addition, 20 agencies had written policies that  require encryption software to be NIST FIPS 140-2 compliant.
Gaps in their policies and procedures reduce agencies’ ability to protect  personally identifiable information from improper disclosure. The loss of  personally identifiable information can result in substantial harm,  embarrassment, and inconvenience to individuals and may lead to identity  theft or other fraudulent use of the information. Because agencies  maintain significant amounts of information concerning individuals,  agencies should be more vigilant to protect that information from loss and  misuse.
At the conclusion of our review and with the recent release of OMB’s  President’s Management Agenda Scorecard for the fourth quarter of fiscal  year 2007, OMB announced that agencies that did not complete all the  privacy and security requirements identified in OMB memorandum M-07- 16, which included the requirements just described, received a downgrade  in their scores for E-Government progress. According to OMB, it will  continue working with agencies to help them strengthen their information  security and privacy programs, especially as they relate to the protection  of personally identifiable information. In view of OMB’s recent actions in  this area, we are making no recommendations at this time.
We reiterate, however, as we have in the past, that although having  specific policies and procedures in place is an important factor in helping  agencies to secure their information systems and to protect personally  identifiable information, proper implementation of these policies and  procedures remains crucial. Agencies’ implementation of OMB’s guidance  on personally identifiable information, as well as our previous  recommendations on improving agency information security and  implementation of FISMA requirements, will be essential in improving the  protection of personally identifiable information.
section_title: Agency Comments
paragraphs: In providing oral comments on a draft of this report, OMB representatives  stated that they generally agreed with the report’s contents. In addition,  they provided technical comments that we incorporated into the report.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies of this report to interested  congressional committees and other interested parties. We will also make  copies available to others upon request. In addition, the report will be  available at no charge on the GAO Web site at www.gao.gov.
If you have questions about this report, please contact me at (202) 512- 6244. I can also be reached by e-mail at wilshuseng@gao.gov. Contact  points for our Offices of Congressional Relations and Public Affairs may  be found on the last page of this report. GAO staff who made major  contributions to this report are listed in appendix III.
section_title: Appendix I: Objectives, Scope, and Methodology
paragraphs: Our objectives were to (1) identify the federal laws and guidance issued to  protect personally identifiable information from unauthorized use or  disclosure and (2) describe agencies’ policies and documented procedures  that respond to recent Office of Management and Budget (OMB) guidance  to protect personally identifiable information that is either accessed  remotely or physically transported outside an agency’s secured physical  perimeter.
To address our first objective, we identified and reviewed legislative  requirements for the protection of personally identifiable information by  federal agencies. Specifically, we reviewed  the Privacy Act of 1974; the E-Government Act of 2002; the Federal Information Security Management Act of 2002; the Veterans Benefits, Health Care, and Information Technology Act of  2006; and the Health Insurance Portability and Accountability Act of 1996.
We also reviewed policy and guidance issued by OMB and National  Institute of Standards and Technology (NIST) relevant to agencies’  policies and procedures to safeguard personally identifiable information.
To address our second objective, we selected 24 major agencies and  assessed the status of their policies and procedures addressing recent  OMB guidance addressing personally identifiable information. At our  request, each agency completed a survey of personally identifiable  information practices and provided related policies and procedures. The  survey and document request were based on requirements and  recommendations in the OMB guidance. We examined survey responses  and compared agency-documented policies and procedures to OMB’s  requirements and guidance for consistency and sufficiency. We did not  evaluate the effectiveness of agencies’ implementation of the practices.  However, we reviewed applicable prior GAO and agency inspector general  reports and discussed whether agency policies had been fully  implemented with applicable agency information technology officials.
We conducted this performance audit from September 2006 to January  2008 in accordance with generally accepted government auditing  standards. Those standards require that we plan and perform the audit to  obtain sufficient, appropriate evidence to provide a reasonable basis for  our findings and conclusions based on our audit objectives. We believe  that the evidence obtained provides a reasonable basis for our findings  and conclusions based on our audit objectives.
section_title: Appendix II: Selected Government Data Breach Incidents, November 2004 through January 2007
paragraphs: The incidents noted here were reported by government agencies between  November 2004 and January 2007. Many of these incidents included the  loss of personally identifiable information. These incidents were selected  to provide illustrative examples of the types of incidents that occurred  during this period.
November 3, 2004, Department of Education: information of 8,290  individuals lost in the mail A contractor to the Federal Student Aid program sent the personal  information of 8,290 individuals via a commercial shipping company. After  determining that the package had been lost in transit, the department  decided not to notify the affected individuals. It discontinued using that  carrier for that facility as a result.
November 24, 2004, Department of Veterans Affairs (VA): personal  information accidentally disclosed on public drive of VA e-mail system A public drive on a VA e-mail system permitted entry by all users to folders  and files containing personally identifiable information (name, Social  Security number, date of birth, and in some cases personal health  information such as surgery schedules, diagnosis, status, etc.) of veterans  after computer system changes were made. All folders were then  restricted and the individual services were contacted to limit user access.
December 6, 2004, Department of Veterans Affairs: two personal  computers stolen, exposing data of 2,000 research subjects Two desktop personal computers were stolen from a locked office in the  research office of a medical center. One of the computers had files  containing names, Social Security numbers, next of kin, addresses, and  phone numbers of approximately 2,000 research subjects. The computers  were password protected by the standard VA password system. The  medical center immediately contacted the agency privacy officer for  guidance. Letters were mailed to all research subjects informing them of  the computer theft and potential for identity theft. VA enclosed letters  addressed to three major credit agencies and postage paid envelopes. This  incident was reported to VA and federal incident offices.
December 17, 2004, Department of Agriculture: e-mail sent out to 1,537  individuals whose personally identifiable information was potentially  exposed  An e-mail was sent to 1,537 people that included an attachment with the  Social Security numbers and other personal information of all 1,537  individuals. In response to the event, a letter of apology was sent and  training on appropriate security measures was developed.
February 24, 2005, Department of Agriculture: hacker obtains access  A system containing research data was breached when someone cracking  a password or a user account installed hacking software. The agency  reports that no data were compromised but that the hacker had read and  write access to the server and opened access points.
March 4, 2005, Department of Veterans Affairs: list of Social Security  numbers of 897 providers inadvertently sent via e-mail An employee reported e-mailing a list of the names and Social Security  numbers of 897 providers to a new transcription company. This was  immediately reported and a supervisor called the transcription company  and spoke with the owner and requested that the company destroy the file  immediately. Notification letters were sent out to all 897 providers.  Disciplinary action was taken against the employee.
June 17, 2005, Department of Defense: potential unauthorized access  A systems administrator discovered potential unauthorized access to the  Air Force Personnel Center Assignment Management System with  personally identifiable information on 33,000 military members.  Notifications were sent out to system users and an investigation was  begun.
Mid 2005, Department of Energy: a hacker accessed more than 1,500  In June 2006, it was announced a hacker had gained access to a file  containing the names and Social Security numbers of 1,502 individuals.  This event, which was detected in mid 2005, was not reported to senior  Department officials until June 2006.
October 14, 2005, Department of Veterans Affairs: personal computer  stolen, exposing data on 421 patients A personal computer was stolen from a medical center that contained  information on 421 patients and included patient names, last four digits of  their Social Security number, height, weight, allergies, medications, recent  lab results, and diagnoses. The agency’s privacy officer and medical center  information security officer were notified. The use of credit monitoring  was investigated and it was determined that, because the entire Social  Security number was not listed, it would not be necessary to use these  services at the time.
November 5, 2005, Department of Education: personally identifiable  information of 11,329 student borrowers lost The unencrypted magnetic tape was lost from the Federal Student Aid’s  Virtual Data Center. After an investigation, no criminal activity was found  and the case was closed.
November 18, 2005, Department of Health and Human Services: contractor  employees steal records of approximately 1,574 Two employees of the Centers for Medicare & Medicaid Services  contractor stole records for the purpose of identity theft. The  approximately 1,574 individuals were notified.
February 15, 2006, Department of Health and Human Services: 22 laptops  stolen from contractor site, exposing information on 1,382 The Centers for Disease Control and Prevention reported 22 laptops stolen  from a contractor’s facility; 3 of them contained Department of Defense  service member information affecting 1,382 personnel. All of the  potentially impacted individuals were notified.
March 17, 2006, Department of Defense: thumb drive with personally  identifiable information of approximately 207,570 Marines lost  The information on approximately 207,570 enlisted Marines from 2001 to  2005 was lost. A notification letter was sent to the affected individuals and  the Marine Corps.
March 28, 2006, Department of Health and Human Services: eight laptops  stolen from contractor, exposing information on 10,855 Eight laptops containing beneficiary and supplier information were stolen  from the contractor’s office. The beneficiary list on the laptops included  10,855 names, addresses, and dates of birth.
April 5, 2006, Department of Defense: hackers access Tricare Management  Activity, exposing personal data Hackers accessed a system containing personally identifiable information  on military employees. Approximately 14,000 active duty and retired  service members and dependents were affected and notified. New security  measures were implemented.
April 11, 2006, Department of Veterans Affairs: hacker and employee  compromise systems, exposing information on 79,000 veterans A former VA employee was suspected of hacking into a medical center  computer system with the assistance of a current employee who provided  rotating administrator passwords. All systems in the medical center  serving 79,000 veterans were compromised.
May 3, 2006, Department of Veterans Affairs: computer equipment  containing personally identifiable information of approximately 26.5  million veterans and active duty members of the military was stolen Computer equipment containing personally identifiable information on  approximately 26.5 million veterans and active duty members of the  military was stolen from the home of a VA employee.
June 3, 2006, Department of Agriculture: systems compromised and  potentially exposed information on 26,000  Three Department of Agriculture computers system were compromised,  potentially exposing the personally identifiable information of 26,000  individuals, including photographs. The department notified the  individuals.
June 19, 2006, Department of Education: package with personally  identifiable information of 13,700 study respondents lost  The shipping contractor to the department’s National Center for Education  Statistics lost a package containing the personally identifiable information  of 13,700 study respondents.
June 22, 2006, Department of Health and Human Services: laptop stolen  from contractor employee, exposing information on 49,572 The theft of a contractor employee’s laptop containing a variety of  personally identifiable information including medical information was  reported. A total of 49,572 Medicare beneficiaries may have been affected.  All were notified.
July 1, 2006, Department of Commerce: documents and database copied  by a former employee, exposing 934 employees  A former employee copied sensitive letters and a database of employee  information. The database included information on 883 cases and the  letters had medical information on 51 employees.
July 27, 2006, Department of Transportation: laptop stolen from car of  DOT Inspector General, exposing information on approximately 133,000 A laptop containing personally identifiable information of approximately  133,000 Florida pilots, commercial drivers, and other Florida residents was  stolen from a government-owned vehicle.
August 1, 2006, Department of Defense: laptop falls off motorcycle, losing  personally identifiable information of 30,000 A laptop containing personally identifiable information on 30,000  applicants, recruiters, and prospects fell off a motorcycle belonging to a  Navy recruiter.
August 3, 2006, Department of Veterans Affairs: desktop computer stolen,  exposing financial records of approximately 18,000 patients  A desktop computer was stolen from a secured area at a contractor’s  facility in Virginia that processes financial accounts for VA. The desktop  computer was not encrypted. Notification letters were mailed and credit  monitoring services offered.
September 6, 2006, Department of Veterans Affairs: laptop stolen,  exposing patient information on an unknown number of individuals  A laptop attached to a medical device was stolen. The information on an  unknown number of individuals was exposed. Notification letters and  credit protection services were offered to 1,575 patients.
January 22, 2007, Department of Veterans Affairs: external hard drive  missing or stolen, exposing records on 535,000 veterans and 1.3 million  non-VA physician provider records An external hard drive was discovered missing or stolen, exposing records  on 535,000 veterans and 1.3 million non-VA physician provider records  from a research facility in Birmingham, Alabama. Notification letters were  sent to veterans and providers, and credit monitoring services were  offered to those individuals whose records contained personally  identifiable information.
section_title: Appendix III: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Staff Acknowledgments
paragraphs: In addition to the individual named above, Shaun Byrnes, Barbara Collier,  Susan Czachor, Kristi Dorsey, Nancy Glover, Joshua Hammerstein,  Anthony Molet, David Plocher, Charles Vrabel (Assistant Director), and  Jeffrey Woodward were key contributors to this report.