Information Security: Leadership Needed to Address Weaknesses and Privacy Issues at Veterans Affairs
Published: 2006-06-20T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: The recent information security breach at the Department of Veterans Affairs (VA), in which personal data on millions of veterans were compromised, has highlighted the importance of the department's security weaknesses, as well as the ability of federal agencies to protect personal information. Robust federal security programs are critically important to properly protect this information and the privacy of individuals. GAO was asked to testify on VA's information security program, ways that agencies can prevent improper disclosures of personal information, and issues concerning notifications of privacy breaches. In preparing this testimony, GAO drew on its previous reports and testimonies, as well as on expert opinion provided in congressional testimony and other sources.
section_title: What GAO Found
paragraphs: For many years, significant concerns have been raised about VA's information security--particularly its lack of a robust information security program, which is vital to avoiding the compromise of government information, including sensitive personal information. GAO and the department's inspector general have reported recurring weaknesses throughout VA, including the Veterans Benefits Administration, in such areas as access controls, physical security, and segregation of incompatible duties. The department has taken steps to address these weaknesses, but these have not been sufficient to establish a comprehensive information security program. For example, it is still developing plans to complete a security incident response program to monitor suspicious activity and cyber alerts, events, and incidents. Without an established and implemented security program, the department will continue to have major challenges in protecting its information and information systems from security breaches such as the one it recently experienced. In addition to establishing robust security programs, agencies can take a number of actions to help guard against the possibility that databases of personally identifiable information are inadvertently compromised. A key step is to develop a privacy impact assessment--an analysis of how personal information is collected, stored, shared, and managed--whenever information technology is used to process personal information. In addition, agencies can take more specific practical measures aimed at preventing data breaches, including limiting the collection of personal information, limiting the time that such data are retained, limiting access to personal information and training personnel accordingly, and considering the use of technological controls such as encryption when data need to be stored on portable devices. When data breaches do occur, notification of those affected and/or the public has clear benefits, allowing people the opportunity to protect themselves from identity theft. Although existing laws do not require agencies to notify the public of data breaches, such notification is consistent with agencies' responsibility to inform individuals about how their information is being accessed and used, and it promotes accountability for privacy protection. That said, care is needed in defining appropriate criteria for triggering notification. Notices should be coordinated with law enforcement to avoid impeding ongoing investigations, and in order to be effective, notices should be easy to understand. Because of the possible adverse impact of a compromise of personal information, it is critical that people fully understand the threat and their options for addressing it. Strong leadership, sustained management commitment and effort, disciplined processes, and consistent oversight will be needed for VA to address its persistent, long-standing control weaknesses.

section_title: Letter
paragraphs: Thank you for inviting us to participate in today’s hearing on  information security and privacy at the Department of Veterans  Affairs (VA). For many years, we have identified information  security as a governmentwide high-risk issue and emphasized its  criticality for protecting the government’s information assets. The  recent security breach at VA, involving the loss of personal data on  millions of veterans, also raises important questions about the  protection of personally identifiable information.
Today we will first address VA’s information security program,  including weaknesses reported by us and others, as well as actions  that VA has taken to address past recommendations in this area. We  will then discuss potential measures that federal agencies can take  to help limit the likelihood of personal information being  compromised. Finally, we will highlight key benefits and challenges  associated with effectively notifying the public about security  breaches.
To describe VA’s information security weaknesses, we reviewed our  previous work in this area, as well as reports by VA’s inspector  general (IG) and others. To determine the implementation status of  our open recommendations, we analyzed VA documentation and  met with officials from VA, including security and IG officials. To  address measures that agencies can take to help limit the likelihood  of personal information being compromised, we identified and  summarized issues raised by experts in congressional testimony and  in our previous reports, including our recent work regarding the  federal government’s use of personal information from companies  known as information resellers. To identify benefits and challenges  associated with effectively notifying the public about security  breaches, we reviewed our previous work in this area. We  conducted the work for our previous reports in accordance with  generally accepted government auditing standards. To provide  additional information on our previous work related to VA security  issues and to privacy, we have included, as an attachment, a list of  pertinent GAO publications.
subsections: section_title: Background
paragraphs: Since the early 1990s, increasing computer interconnectivity—most  notably growth in the use of the Internet—has revolutionized the  way that our government, our nation, and much of the world  communicate and conduct business. The benefits have been  enormous, but without proper safeguards in the form of appropriate  information security, this widespread interconnectivity also poses  significant risks to the government’s computer systems and the  critical operations and infrastructures they support.
In prior reviews we have repeatedly identified weaknesses in almost  all areas of information security controls at major federal agencies,  including VA, and we have identified information security as a high  risk area across the federal government since 1997. In July 2005, we  reported that pervasive weaknesses in the 24 major agencies’  information security policies and practices threatened the integrity,  confidentiality, and availability of federal information and  information systems. As we reported, although federal agencies  showed improvement in addressing information security, they also  continued to have significant control weaknesses that put federal  operations and assets at risk of inadvertent or deliberate misuse,  financial information at risk of unauthorized modification or  destruction, sensitive information at risk of inappropriate  disclosure, and critical operations at risk of disruption. These  weaknesses existed primarily because agencies had not yet fully  implemented strong information security programs, as required by  the Federal Information Security Management Act (FISMA).
The significance of these weaknesses led us to conclude in the audit  of the federal government’s fiscal year 2005 financial statements  that information security was a material weakness. Our audits also  identified instances of similar types of weaknesses in nonfinancial  systems. Weaknesses continued to be reported in each of the major  areas of general controls: that is, the policies, procedures, and  technical controls that apply to all or a large segment of an entity’s  information systems and help ensure their proper operation.
To fully understand the significance of the weaknesses we  identified, it is necessary to link them to the risks they present to  federal operations and assets. Virtually all federal operations are  supported by automated systems and electronic data, without which  agencies would find it difficult, if not impossible, to carry out their  missions and account for their resources. The following examples  show the broad array of federal operations and assets placed at risk  by information security weaknesses:  ●  Resources, such as federal payments and collections, could be lost  or stolen.   ●  Computer resources could be used for unauthorized purposes or to  launch attacks on others.   ●  Personal information, such as taxpayer data, social security records,  and medical records, and proprietary business information could be  inappropriately disclosed, browsed, or copied for purposes of  identity theft, industrial espionage, or other types of crime.   ●  Critical operations, such as those supporting national defense and  emergency services, could be disrupted.   ●  Data could be modified or destroyed for purposes of fraud, theft of  assets, or disruption.  ●  Agency missions could be undermined by embarrassing incidents  that result in diminished confidence in their ability to conduct  operations and fulfill their fiduciary responsibilities.
The potential disclosure of personal information raise identity theft and privacy concerns. Identity theft generally involves  the fraudulent use of another person’s identifying information— such as Social Security number, date of birth, or mother’s maiden  name—to establish credit, run up debt, or take over existing  financial accounts. According to identity theft experts, individuals  whose identities have been stolen can spend months or years and  thousands of dollars clearing their names. Some individuals have  lost job opportunities, been refused loans, or even been arrested fo crimes they did not commit as a result of identity theft. The Feder Trade Commission (FTC) reported in 2005 that identity theft  represented about 40 percent of all the consumer fraud complaints  it received during each of the last 3 calendar years. Beyond the  serious issues surrounding identity theft, the unauthorized  disclosure of personal information also represents a breach of  individuals’ privacy rights to have control over their own  information and to be aware of who has access to this information.
subsections: section_title: Key Laws Govern Agency Sec
paragraphs: Federal agencies are subject to security and privacy laws aimed in  part at preventing security breaches, including breaches that could  enable identity theft.
FISMA is the primary l federal government; it also addresses the protection of personal  n  information in the context of securing federal agency informatio r  and information systems. The act defines federal requirements fo securing information and information systems that support federalaw governing information security in the  agency operations and assets. Under FISMA, agencies are requiredto provide sufficient safeguards to cost-effectively protect their  information and information systems from unauthorized access, use disclosure, disruption, modification, or destruction, including  controls necessary to preserve authorized restrictions on access and  disclosure (and thus to protect personal privacy, among other  things). The act requires each agency to develop, document, and  implement an agencywide information security program to provide  ,  security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source.
FISMA describes a comprehensive information security pr including the following elements:   periodic assessments of the risk an result from the unauthorized access, use, disclosure, disruption,  modification, or destruction of information or information systems;  d magnitude of harm that could  risk-based policies and procedures that cost-effectively reduce ris to an acceptable level and ensure that security is addressed  throughout the life cycle of each information system;  security awareness training for agency personnel, including  contractors and other users of information systems th operations and assets of the agency;  periodic testing and evaluation of the effectiveness of information  security policies, procedures, and practices;  ●  a process for planning, implementing, evaluating, and documentingremedial action to address any deficiencies th and milestones; and  procedures for detecting, reporting, and responding to security  incidents.
In particula agencies evaluate the associated risk according to three categories:  (1) confidentiality, which is the risk associated with unauthorized  disclosure of the information; (2) integrity, the risk of unauthorized  modification or destruction of the information; and (3) availability,  which is the risk of disruption of access to or use of information.  Thus, each agency should assess the risk associated with personal  data held by the agency and develop appropriate protections.   r, FISMA requires that for any information they hold,  The agency can use this risk assessment to determine the  appropriate controls (operational, technical, and managerial) th will reduce the risk to an acceptably low level. For exampl agency assesses the confidentiality risk of the personal information as high, the agency could create control mechanisms to help prote  ct  the data from unauthorized disclosure. Besides appropriate policies,at  e, if an  these controls would include access controls and monitoring  systems:   Access con confidentiality of information. Organizations use these controls to  grant employees the authority to read or modify only the  information the employees need to perform their duties. In addition access controls can limit the activities that an employee c perform on data. For example, an employee may be given the right  to read data, but not to modify or copy it. Assignment of right s and  permissions must be carefully considered to avoid giving users  unnecessary access to sensitive files and directories.  trols are key technical controls to protect the  To ensure that controls are, in fact, implemented and that no  violations have occurred, agencies need to monitor compliance with  security policies and investigate security violations. It is crucial to  determine what, when, and by whom specific actions are taken on a  system. Organizations accomplish this by implementing system or  security software that provides an audit trail that they can use to  determine the source of a transaction or attempted transaction and  to monitor users’ activities. The way in which organizations  configure system or security software determines the nature and  extent of information that can be provided by the audit trail. To be  effective, organizations should configure their software to collect  and maintain audit trails that are sufficient to track security events.
A comprehensive security program of the type described is a  prerequisite for the protection of personally identifiable information  held by agencies. In addition, agencies are subject to requirem specifically related to personal privacy protection, which come  primarily from two laws, the Privacy Act of 1974 and the E- Government Act of 2002.
The Privacy Act places lim disclosure, and use of personal information maintained in systems  of records. The act describes a “record” as any item, collect ion, or  grouping of information about an individual that is maintained by an agency and contains his or her name or another personal identifier.itations on agencies’ collection,  It also defines “system of records” as a group of records under the  control of any agency from which information is retrieved by the  name of the individual or by an individual identifier. The Privacy Ac t  requires that when agencies establish or make changes to a system of records, they must notify the public by a “system-of-records  notice”: that is, a notice in the Federal Register identifying, among  other things, the type of data collected, the types of individuals  about whom information is collected, the intended “routine” uses o data, and procedures that individuals can use to review and corr personal information. Among other provisions, the act also requires  agencies to define and limit themselves to specific predefined  purposes.
The provisions of the Privacy Act are consistent with and large based on a set of principles for protecting the privacy and security  of personal information, known as the Fair Information Practices,  which have been widely adopted as a standard benchmark for  evaluating the adequacy of privacy protections; they include such  principles as openness (keeping the public informed about privacy  policies and practices) and accountability (those controlling the  collection or use of personal information should be accountable for taking steps to ensure the implementation of these principles).
The E-Government Act of 2002 strives to enhance protection for personal information in government information systems by  requiring that agencies conduct privacy impact assessments (PIA PIA is an analysis of how personal information is collected, st shared, and managed in a federal system. More specifically,  according to OMB guidance, a PIA is to (1) ensure that handling  conforms to applicable legal, regulatory, and policy requirem ents  regarding privacy; (2) determine the risks and effects of collecting maintaining, and disseminating information in identifiable form in  ,  an electronic information system; and (3) examine and evaluate  protections and alternative processes for handling information to mitigate potential privacy risks. To the extent that PIAs are made publicly available,  they provide explanations to the public about  such things as the information that will be collected, why it is bein collected, how it is to be used, and how the system and data will b maintained and protected.
section_title: Interest in Data Breach Notification Legislation Has Increased
paragraphs: Federal laws to date have not required  breaches to the public,  although breac important role in the context of security breaches in the private  sector. For example, requirements of California state law led  ChoicePoint, a large information reseller, to notify its customer a security breach in February 2005. Since the ChoicePoint  notification, bills were introduced in at least 44 states and enacted  in at least 29 that require some form of notification upon a breach.  agencies to report security  h notification has played an  A numbe in 2005 in the wake of the ChoicePoint security breach as well as  incidents at other firms. In March 2005, the House Subcommittee on Commerce, Trade, and Consumer Protection of the House Energy  r of congressional hearings were held and bills introduced  and Commerce Committee held a hearing entitled “Protecting  Consumers’ Data: Policy Issues Raised by ChoicePoint,” which  focused on potential remedies for security and privacy concern s  regarding information resellers. Similar hearings were held by th House Energy and Commerce Committee and by the U.S. Senate  Committee on Commerce, Science, and Transportation in spring  2005.
section_title: VA’s Information Security Is Weak
subsections: section_title: VA’s Information Security Weaknesses Are Long Standing
paragraphs: In carrying out its mission of providing health care and benefits to  veterans, VA relies on a vast array of computer systems and  telecommunications networks to support its operations and store  sensitive information, including personal information on veterans.  VA’s networks are highly interconnected, its systems support many  users, and the department has increasingly moved to more  interactive, Web-based services to better meet the needs of its  customers. Effectively securing these computer systems and  networks is critical to the department’s ability to safeguard its  assets, maintain the confidentiality of sensitive veterans’ health and  disability benefits information, and ensure the integrity of its  financial data.
In this complex IT environment, VA has faced long-standing  challenges in achieving effective information security across the  department. Our reviews identified wide-ranging, often recurring  deficiencies in the department’s information security controls  (attachment 2 provides further detail on our reports and the areas of  weakness they discuss). Examples of areas of deficiency include the  following.   ●  Access authority was not appropriately controlled. A basic  management objective for any organization is to protect the  resources that support its critical operations from unauthorized  access. Electronic access controls are intended to prevent, limit,  and detect unauthorized access to computing resources, programs,  and information and include controls related to user accounts and  passwords, user rights and file permissions, logging and monitoring  of security-relevant events, and network management. Inadequate  controls diminish the reliability of computerized information and  increase the risk of unauthorized disclosure, modification, and  destruction of sensitive information and disruption of service.
However, VA had not established effective electronic access  controls to prevent individuals from gaining unauthorized access to  its systems and sensitive data, as the following examples illustrate:  ●  User accounts and passwords: In 1998, many user accounts at  four VA medical centers and data centers had weaknesses  including passwords that could be easily guessed, null  passwords, and passwords that were set to never expire. We also  found numerous instances where medical and data center staff  members were sharing user IDs and passwords.  ●  User rights and permissions: We reported in 2000 that three VA  health care systems were not ensuring that user accounts with  broad access to financial and sensitive veteran information had  proper authorization for such access, and were not reviewing  these accounts to determine if their level of access remained  appropriate.   ●  Logging and monitoring of security-related events: In 1998, VA  did not have any departmentwide guidance for monitoring both  successful and unsuccessful attempts to access system files  containing key financial information or sensitive veteran data,  and none of the medical and data centers we visited were  actively monitoring network access activity. In 1999, we found  that one data center was monitoring failed access attempts, but  was not monitoring successful accesses to sensitive data and  resources for unusual or suspicious activity.   ●  Network management: In 2000, we reported that one of the  health care systems we visited had not configured a network  parameter to effectively prevent unauthorized access to a  network system; this same health care system had also failed to  keep its network system software up to date.  ●  Physical security controls were inadequate. Physical security  controls are important for protecting computer facilities and  resources from espionage, sabotage, damage, and theft. These  controls restrict physical access to computer resources, usually by  limiting access to the buildings and rooms in which the resources  are housed and by periodically reviewing the access granted, in  order to ensure that access continues to be appropriate. VA had  weaknesses in the physical security for its computer facilities. For  example, in our 1998 and 2000 reports, we stated that none of the VA  facilities we visited were adequately controlling access to their  computer rooms. In addition, in 1998 we reported that sensitive  equipment at two facilities was not adequately protected, increas the risk of disruption to computer operations or network  communications.  ●  mployees were not prevented from performing incompatible  E duties. Segregation of duties refers to the policies, procedures, a organizational structures that help ensure that one individual cannot independently control all key aspects of a process or computer- related operation. Dividing duties among two or more individual organizational groups diminishes the likelihood that errors and s or  wrongful acts will go undetected, because the activities of one  individual or group will serve as a check on the activities of the  other. We determined that VA did not assign employee duties an d  responsibilities in a manner that segregated incompatible function among individuals or groups of individuals. For example, in 1998 we s  reported that some system programmers also had security  administrator privileges, giving them the ability to eliminate  any  evidence of their activity in the system. In 2000, we reported thattwo VA health care systems allowed some employees to request,  approve, and receive medical items without management approva l,  violating both basic segregation of duties principles and VA policy;  in addition, no mitigating controls were found to alert management  of purchases made in this manner.
S oftware change control procedures were not consistently  implemented. It is important to ensure that only authorized  tested systems are placed in operation. To ensure that changes to  systems are necessary, work as intended, and do not result in the  loss of data or program integrity, such changes should be  documented, authorized, tested, and independently review ed. We  found that VA did not adequately control changes to its operating  systems. For example, in 1998 we reported that one VA data centerhad not established detailed written procedures or formal guidance  for modifying operating system software, for approving and testing  operating system software changes, or for implementing these  changes. The data center had made more than 100 system softw changes during fiscal year 1997, but none of the changes included  evidence of testing, independent review, or acceptance. We reporte d  in 2000 that two VA health care systems had not established  procedures for periodically reviewing changes to standard  application programs to ensure that only authorized program was implemented.  ervice continuity planning was not complete. In addition to  S protecting data and programs from misuse, organizations must  ensure that they are adequately prepared to cope with a loss of  operational capability due to earthquakes, fires, accidents, sabo or any other disruption. An essential element in preparing for such  catastrophes is an up-to-date, detailed, and fully tested service  continuity plan. Such a plan is critical for helping to ensure thatinformation system operations and data can be promptly restore the event of a disaster. We reported that VA had not completed or  tested service continuity plans for several systems. For example, in1998 we reported that one VA data center had 17 individual disaster  recovery plans covering various segments of the organization, but it  did not have an overall document that integrated the 17 separate  plans and defined the roles and responsibilities for the disaster  recovery teams. In 2000, we determined that the service continu plans for two of the three health care systems we visited did not  include critical elements such as detailed recovery procedures,  provisions for restoring mission-critical systems, and a list of key contacts; in addition, none of the health care systems we visited  were fully testing their service continuity plans.  hese deficiencies existed, in part, because VA had not implemented  T key components of a comprehensive computer security program.  Specifically, VA’s computer security efforts lacked   ●  clearly delineated security roles and responsibilities;  ●  regular, periodic assessments of risk;  ●  security policies and procedures that a VA’s interconnected environment;  an ongoing security monitoring pro investigate unauthorized, unusual, or suspicious access a and  ctivity;  ●  a process to measure, test, and report on the continued  effectiveness of computer system, network, and process controls.
As a result, we made a number of recommendations in 2002 that  were aimed at improving VA’s security management. Among the  primary elements of these recommendations were that (1) VA  centralize its security management functions and (2) it perform  other actions to establish an information security program,  including actions related to risk assessments, security policies and  procedures, security awareness, and monitoring and evaluating  computer controls.
section_title: VA’s Efforts to Address Information Security Weaknesses Have Been Limited
paragraphs: The department has taken steps to address the weaknesses that we  described, but these have not been sufficient to fully implement a  comprehensive information security program. Examples of actions  that VA has taken and still needs to take include the following:   ●  Central security management function: The department realigned  its information technology resources to place administration and  field office security functions more directly under the oversight of  the department’s CIO, consolidating all administration-level cyber  security functions under the department’s cyber security office. In  addition, to provide greater management accountability for  information security, the Secretary instituted information security  standards for members of the department’s senior executive service.  The cyber security officer organized his office to focus more directly  on critical elements of information security control, and he updated  the department’s security management plan and information  security policies and procedures. However, the department still  needed to develop policy and guidance to ensure (1) authority and  independence for security officers and (2) departmentwide  coordination of security functions.  ●  Periodic risk assessments: VA is implementing a commercial tool to  identify the level of risk associated with system changes and also to  conduct information security risk assessments. It also created a  methodology that establishes minimum requirements for such risk  assessments. However, it has not yet completed its risk assessment  policy and guidance. VA reported that such guidance was  forthcoming as part of an overarching information system security  certification and accreditation policy that was to be developed  during 2006. Without these elements, VA cannot be assured that it is  appropriately performing risk assessments departmentwide.  ●  Security policies and procedures: VA’s cyber security officer  reported that VA has action ongoing to develop a process for  collecting and tracking performance data, ensuring management  action when needed, and providing independent validation of  reported issues. VA also has ongoing efforts in the area of detecting,  reporting, and responding to security incidents. For example, it  established network intrusion prevention capability at its four  enterprise gateways. It is also developing strategic and tactical plans  to complete a security incident response program to monitor  suspicious activity and cyber alerts, events, and incidents. However,  these plans are not complete.   ●  Security awareness: VA has taken steps to improve security  awareness training. It holds an annual department information  security conference, and it has developed a Web portal for security  training, policy, and procedures, as well as a security awareness  course that VA employees are required to review annually. However,  VA has not demonstrated that it has a process to ensure compliance.  ●  Monitoring and evaluating computer controls: VA established a  process to better monitor and evaluate computer controls by  tracking the status of security weaknesses, corrective actions taken,  and independent validations of corrective actions through a  software data base. However, more remains to be done in t For example, although certain components of VA reported  vulnerability and penetration testing to evaluate controls on intern and external access to VA systems, t o ngoing departmentwide program. his area. his testing was not part of an  Since our last report in 2002, VA’s IG and independent auditors  continued to report serious weaknesses with the department’s  information security controls. The auditors’ report on interna l  controls, prepared at the completion of VA’s 2005 financial  statement audit, identified weaknesses related to access control,  segregation of duties, change control, and service continuity—a  of weaknesses that are virtually identical to those we identified  years earlier. The department’s FY 2005 Annual Performance a Accountability Report states that the IG determined that many  information system security vulnerabilities reported in nationa l  audits from 2001 through 2004 remain unresolved, despite the  department’s actions to implement IG recommendations in pre audits. The IG also reported specific security weaknesses and  vulnerabilities at 45 of 60 VA health care facilities and 11 of 21 VA  regional offices where security issues were reviewed, placing VA at  ss and  risk that sensitive data may be exposed to unauthorized acce improper disclosure, among other things. As a result, the IG  determined that weaknesses in VA’s i controls were a material weakness.
In response to the IG’s findings, the department indicates tha are being implemented to address the material weakness in  information security. According to the department, it has maximi limited resources to make significant improvement in its overall  security posture in the near term by prioritizing FISMA re activities, and work will continue in the next fiscal year. mediation  Despite these actions, the department has not fully implemented the  key elements of a comprehensive security management program,  and its efforts have not been sufficient to effectively protect its  information systems and information, including personally  identifiable information, from unauthorized disclosure, misuse, or  loss.
section_title: Agencies Can Take Steps to Reduce the Likelihood That Personal Data Will Be Compromised
paragraphs: In addition to establishing a robust information security program,  agencies can take other actions to help guard against the possibility  that personal information they maintain is inadvertently  compromised. These include conducting privacy impact  assessments and taking other practical measures.
subsections: section_title: Conduct Privacy Impact Assessments
paragraphs: It is important that agencies identify the specific instances in which  they collect and maintain personal information and proactively  assess the means they intend to use to protect this information. This  can be done most effectively through the development of privacy  impact assessments (PIAs), which, as previously mentioned, are  required by the E-Government Act of 2002 when agencies use  information technology to process personal information. PIAs are  important because they serve as a tool for agencies to fully consider  the privacy implications of planned systems and data collections  before those systems and collections have been fully implemented,  when it may be relatively easy to make critical adjustments.
In prior work we have found that agencies do not always conduct  PIAs as they are required. For example, our review of selected data  mining efforts at federal agencies determined that PIAs were not  always being done in full compliance with OMB guidance. Similarly,  as identified in our work on federal agency use of information  resellers, few PIAs were being developed for systems or programs  that made use of information reseller data, because officials did not  believe they were required. Complete assessments are an important  tool for agencies to identify areas of noncompliance with federal  privacy laws, evaluate risks arising from electronic collection and  maintenance of information about individuals, and evaluate  protections or alternative processes needed to mitigate the risks  identified. Agencies that do not take all the steps required to protect  the privacy of personal information risk the improper exposure or  alteration of such information. We recommended that the agencies  responsible for the data mining efforts we reviewed complete or  revise PIAs as needed and make them available to the public. We  also recommended that OMB revise its guidance to clarify the  applicability of the E-Gov Act’s PIA requirement to the use of  personal information from resellers. OMB stated that it would  discuss its guidance with agency senior officials for privacy to  determine whether additional guidance concerning reseller data was  needed.
section_title: Employ Measures to Prevent Inadvertent Data Breaches
paragraphs: Besides strategic approaches such as establishing an information  security program and conducting PIAs, agencies can consider a  range of specific practical measures for protecting the privacy and  security of personal information. Several that may be of particular  value in preventing inadvertent data breaches include the following:  Limit collection of personal information. One item to be analyzed  as part of a PIA is the extent to which an agency needs to collect  personal information in order to meet the requirements of a specific  application. Limiting the collection of personal information, among  other things, serves to limit the opportunity for that information to  be compromised. For example, key identifying information—such as  Social Security numbers—may not be needed for many agency  applications that have databases of other personal information.  Limiting the collection of personal information is also one of the fair  information practices, which are fundamental to the Privacy Act and  to good privacy practice in general.
Limit data retention. Closely related to limiting data collection is  limiting retention. Retaining personal data longer than needed by an  agency or statutorily required adds to the risk that the data will be  compromised. In discussing data retention, California’s Office of  Privacy Protection recently reported an example in which a  university experienced a security breach that exposed 15-year-old  data, including Social Security numbers. The university  subsequently reviewed its policies and decided to shorten the  retention period for certain types of information. As part of their  PIAs, federal agencies can make decisions up front about how long  they plan to retain personal data, aiming to retain the data for as  brief a period as necessary.
Limit access to personal information and train personnel  accordingly. Only individuals with a need to access agency  databases of personal information should have such access, and  controls should be in place to monitor that access. Further, agencies  can implement technological controls to prevent personal data from  being readily transferred to unauthorized systems or media, such as  laptop computers, discs, or other electronic storage devices.  Security training, which is required for all federal employees under  FISMA, can include training on the risks of exposing personal data  to potential identity theft, thus helping to reduce the likelihood of  data being exposed inadvertently.
Consider using technological controls such as encryption when  data need to be stored on portable devices. In certain instances,  agencies may find it necessary to enable employees to have access  to personal data on portable devices such as laptop computers. As  discussed, this should be minimized. However, when absolutely  necessary, the risk that such data could be exposed to unauthorized  individuals can be reduced by using technological controls such as  encryption, which significantly limits the ability of such individuals  to gain access to the data. Although encrypting data adds to the  operational burden on authorized individuals, who must enter pass  codes or use other authentication means to convert the data into  readable text, it can provide reasonable assurance that stolen or lost  computer equipment will not result in personal data being  compromised, as occurred in the recent incident at VA. A decision  about whether to use encryption would logically be made as an  element of the PIA process and an agency’s broader information  security program.
While these suggestions do not amount to a complete prescription  for protecting personal data, they are key elements of an agency’s  strategy for reducing the risks that could lead to identity theft.
section_title: Public Notification of Data Breaches Has Clear Benefits as Well as Challenges
paragraphs: In the event a data breach does occur, agencies must respond  quickly in order to minimize the potential harm associated with  identity theft. The chairman of the Federal Trade Commission has  testified that the Commission believes that if a security breach  creates a significant risk of identity theft or other related harm,  affected consumers should be notified. The Federal Trade  Commission has also reported that the overall cost of an incident of  identity theft, as well as the harm to the victims, is significantly  smaller if the misuse of the victim’s personal information is  discovered quickly.
Applicable laws such as the Privacy Act currently do not require  agencies to notify individuals of security breaches involving their  personal information; however, doing so allows those affected the  opportunity to take steps to protect themselves against the dangers  of identity theft. For example, California’s data breach notification  law is credited with bringing to the public’s notice large data  breaches within the private sector, such as those involving  ChoicePoint and LexisNexis last year. Arguably, the California law  may have mitigated the risk of identity theft to affected individuals  by keeping them informed about data breaches and thus enabling  them to take steps such as contacting credit bureaus to have fraud  alerts placed on their credit files, obtaining copies of their credit  reports, scrutinizing their monthly financial account statements, and  taking other steps to protect themselves.
Breach notification is also important in that it can help an  organization address key privacy rights of individuals, in accordance  with the fair information practices mentioned earlier. Breach  notification is one way that organizations—either in the private  sector or the government—can follow the openness principle and  meet their responsibility for keeping the public informed of how  their personal information is being used and who has access to it.  Equally important, notification is consistent with the principle that  those controlling the collection or use of personal information  should be accountable for taking steps to ensure the implementation  of the other principles, such as use limitation and security  safeguards. Public disclosure of data breaches is a key step in  ensuring that organizations are held accountable for the protection  of personal information.
subsections: section_title: Concerns Have Been Raised About the Criteria for Issuing Notices to the Public
paragraphs: Although the principle of notifying affected individuals (or the  public) about data breaches has clear benefits, determining the  specifics of when and how an agency should issue such notifications  presents challenges, particularly in determining the specific criteria  for incidents that merit notification. In congressional testimony, the  Federal Trade Commission raised concerns about the threshold at  which consumers should be notified of a breach, cautioning that too  strict a standard could have several negative effects. First,  notification of a breach when there is little or no risk of harm might  create unnecessary concern and confusion. Second, a surfeit of  notices, resulting from notification criteria that are too strict, could  render all such notices less effective, because consumers could  become numb to them and fail to act when risks are truly  significant. Finally, the costs to both individuals and business are  not insignificant and may be worth considering. FTC points out that,  in response to a security breach notification, a consumer may cancel  credit cards, contact credit bureaus to place fraud alerts on credit  files, or obtain a new driver’s license number. These actions could  be time-consuming for the individual and costly for the companies  involved. Given these potential negative effects, care is clearly  needed in defining appropriate criteria for required breach  notifications.
While care needs to be taken to avoid requiring agencies to notify  the public of trivial security incidents, concerns have also been  raised about setting criteria that are too open-ended or that rely too  heavily on the discretion of the affected organization. Some public  advocacy groups have cautioned that notification criteria that are  too weak would give companies an incentive not to disclose  potentially harmful breaches, and the same concern would apply to  federal agencies. In congressional testimony last year, the executive  director of the Center for Democracy and Technology argued that if  an entity is not certain whether a breach warrants notification, it  should be able to consult with the Federal Trade Commission. He  went on to suggest that a two-tiered system may be desirable, with  notice to the Federal Trade Commission of all breaches of personal  data and notice to consumers where there is a potential risk of  identity theft. The Center for Democracy and Technology’s  comments regarding the Federal Trade Commission were aimed at  commercial entities such as information resellers. A different  entity—such as OMB, which is responsible for overseeing security  and privacy within the federal government—might be more  appropriate to take on a parallel role with respect to federal  agencies.
section_title: Effective Notices Should Provide Useful Information and Be Easy to Understand
paragraphs: Once a determination has been made that a public notice is to be  issued, care must be taken to ensure that it does its job effectively.  Designing useful, easy-to-understand notices has been cited as a  challenge in other areas where privacy notices are required by law,  such as in the financial industry—where businesses are required by  the Gramm-Leach-Bliley Act to send notices to consumers about  their privacy practices—and in the federal government, which is  required by the Privacy Act to issue public notices in the Federal  Register about its systems of records containing personal  information. For example, as noted during a public workshop  hosted by the Department of Homeland Security’s Privacy Office,  designing easy-to-understand consumer financial privacy notices to  meet Gramm-Leach Bliley Act requirements has been challenging.  Officials from the FTC and Office of the Comptroller of the  Currency described widespread criticism of these notices—that they  were unexpected, too long, filled with legalese, and not  understandable.
If an agency is to notify people of a data breach, it should do so in  such a way that they understand the nature of the threat and what  steps need to be taken to protect themselves against identity theft.  In connection with its state law requiring security breach  notifications, the California Office of Privacy Protection has  published recommended practices for designing and issuing security  breach notices. The office recommends that such notifications  include, among other things,  ●  a general description of what happened;  ●  the type of personal information that was involved;  ●  what steps have been taken to prevent further unauthorized  acquisition of personal information;  ●  the types of assistance to be provided to individuals, such as a toll- free contact telephone number for additional information and  assistance;  information on what individuals can do to protect themselves from  identity theft, including contact information for the three credit  reporting agencies; and  information on where individuals can obtain additional information  on protection against identity theft, such as the Federal Trade  Commission’s Identity Theft Web site (www.consumer.gov/idtheft).
The California Office of Privacy Protection also recommends  making notices clear, conspicuous, and helpful by using clear,  simple language and avoiding jargon, and it suggests avoiding using  a standardized format to mitigate the risk that the public will  become complacent about the process.
The Federal Trade Commission has issued guidance to businesses  on notifying individuals of data breaches that reiterates several key  elements of effective notification—describing clearly what is known  about the data compromise, explaining what responses may be  appropriate for the type of information taken, and providing  information and contacts regarding identity theft in general. The  Commission also suggests providing contact information for the law  enforcement officer working on the case, as well as encouraging  individuals who discover that their information has been misused to  file a complaint with the Commission.
Both the state of California and the Federal Trade Commission  recommend consulting with cognizant law-enforcement officers  about an incident before issuing notices to the public. In some  cases, early notification or disclosure of certain facts about an  incident could hamper a law enforcement investigation. For  example, an otherwise unknowing thief could learn of the potential  value of data stored on a laptop computer that was originally stolen  purely for the value of the hardware. Thus it is recommended that  organizations consult with law enforcement regarding the timing  and content of notifications. However, law enforcement  investigations should not necessarily result in lengthy delays in  notification. California’s guidance states that it should not be  necessary for a law enforcement agency to complete an  investigation before notification can be given.
When providing notifications to the public, organizations should  consider how to ensure that these are easily understood. Various  techniques have been suggested to promote comprehension,  including the concept of “layering.” Layering involves providing  only the most important summary facts up front—often in a  graphical format—followed by one or more lengthier, more  narrative versions in order to ensure that all information is  communicated that needs to be. Multilayering may be an option to  achieving an easy-to-understand notice that is still complete.  Similarly, providing context to the notice (explaining to consumers  why they are receiving the notice and what to do with it) has been  found to promote comprehension, as did visual design elements  such as a tabular format, large and legible fonts, appropriate white  space, and simple headings.
Although these techniques were developed for other kinds of  notices, they can be applied to those informing the public of data  breaches. For example, a multilayered security breach notice could  include a brief description of the nature of the security breach, the  potential threat to victims of the incident, and measures to be taken  to protect against identity theft. The notice could provide additional  details about the incident as an attachment or by providing links to  additional information. This would accomplish the purpose of  communicating the key details in a brief format, while still providing  complete information to those who require it. Given that people may  be adversely affected by a compromise of their personal  information, it is critical that they fully understand the nature of the  threat and the options they have to address it.
In summary, the recent security breach at VA has highlighted the  importance of implementing effective information security  practices. Long-standing information security control weaknesses at  VA have placed its information systems and information, including  personally identifiable information, at increased risk of misuse and  unauthorized disclosure. Although VA has taken steps to mitigate  previously reported weaknesses, it has not implemented a  comprehensive, integrated information security program, which it  needs in order to effectively manage risks on an ongoing basis.  Much work remains to be done. Only through strong leadership,  sustained management commitment and effort, disciplined  processes, and consistent oversight can VA address its persistent,  long-standing control weaknesses.
To reduce the likelihood of experiencing such breaches, agencies  can take a number of actions that can help guard against the  possibility that databases of personally identifiable information are  inadvertently compromised: strategically, they should ensure that a  robust information security program is in place and that PIAs are  developed. More specific practical measures aimed at preventing  inadvertent data breaches include limiting the collection of personal  information, limiting data retention, limiting access to personal  information and training personnel accordingly, and considering  using technological controls such as encryption when data need to  be stored on mobile devices.
Nevertheless, data breaches can still occur at any time, and when  they do, notification to the individuals affected and/or the public has  clear benefits, allowing people the opportunity to take steps to  protect themselves against the dangers of identity theft. Care is  needed in defining appropriate criteria if agencies are to be required  to report security breaches to the public. Further, care is also  needed to ensure that notices are useful and easy to understand, so  that they are effective in alerting individuals to actions they may  want to take to minimize the risk of identity theft.
We have previously testified that as Congress considers legislation  requiring agencies to notify individuals or the public about security  breaches, it should ensure that specific criteria are defined for  incidents that merit public notification. It may want to consider  creating a two-tier reporting requirement, in which all security  breaches are reported to OMB, and affected individuals are notified  only of incidents involving significant risk. Further, Congress should  consider requiring OMB to provide guidance to agencies on how to  develop and issue security breach notices to the public.
Messers. Chairmen, this concludes our testimony today. We would  be happy to answer any questions you or other members of the  committee may have.
section_title: Contacts and Acknowledgments
paragraphs: If you have any questions concerning this testimony, please contact  Linda Koontz, Director, Information Management, at (202) 512-6240,  koontzl@gao.gov, or Gregory Wilshusen, Director, Information  Security, at (202) 512-6244, wilshuseng@gao.gov. Other individuals  who made key contributions include Idris Adjerid, Barbara Collier,  William Cook, John de Ferrari, Valerie Hopkins, Suzanne Lightman,  Barbara Oliver, David Plocher, Jamie Pressman, J. Michael Resser,  and Charles Vrabel.
section_title: Attachment 1: Selected GAO Products
subsections: section_title: Products Related to VA Information Security
paragraphs: Information Systems: VA Computer Control Weaknesses Increase  Risk of Fraud, Misuse, and Improper Disclosure. GAO/AIMD-98- 175. Washington, D.C.: September 23, 1998.
VA Information Systems: The Austin Automation Center Has  Made Progress in Improving Information System Controls.  GAO/AIMD-99-161. Washington, D.C.: June 8, 1999.
Information Systems: The Status of Computer Security at the  Department of Veterans Affairs. GAO/AIMD-00-5. Washington, D.C.:  October 4, 1999.
VA Systems Security: Information System Controls at the North  Texas Health Care System. GAO/AIMD-00-52R. Washington, D.C.:  February 1, 2000.
VA Systems Security: Information System Controls at the New  Mexico VA Health Care System. GAO/AIMD-00-88R. Washington,  D.C.: March 24, 2000.
VA Systems Security: Information System Controls at the VA  Maryland Health Care System. GAO/AIMD-117R. Washington, D.C.:  April 19, 2000.
Information Technology: Update on VA Actions to Implement  Critical Reforms. GAO/T-AIMD-00-74. Washington, D.C.: May 11,  2000.
VA Information Systems: Computer Security Weaknesses Persist  at the Veterans Health Administration. GAO/AIMD-00-232.  Washington, D.C.: September 8, 2000.
Major Management Challenges and Program Risks: Department of  Veterans Affairs. GAO-01-255. Washington, D.C.: January 2001.
VA Information Technology: Important Initiatives Begun, Yet  Serious Vulnerabilities Persist. GAO-01-550T. Washington, D.C.:  April 4, 2001.
VA Information Technology: Progress Made, but Continued  Management Attention is Key to Achieving Results. GAO-02-369T.  Washington, D.C.: March 13, 2002.
Veterans Affairs: Subcommittee Post-Hearing Questions  Concerning the Department’s Management of Information  Technology. GAO-02-561R. Washington, D.C.: April 5, 2002.
Veterans Affairs: Sustained Management Attention is Key to  Achieving Information Technology Results. GAO-02-703.  Washington, D.C.: June 12, 2002.
VA Information Technology: Management Making Important  Progress in Addressing Key Challenges. GAO-02-1054T.  Washington, D.C.: September 26, 2002.
Information Security: Weaknesses Persist at Federal Agencies  Despite Progress Made in Implementing Related Statutory  Requirements. GAO-05-552. Washington, D.C.: July 15, 2005.
section_title: Products Related to Privacy Issues
paragraphs: Privacy: Key Challenges Facing Federal Agencies. GAO-06-777T.  Washington, D.C.: May 17, 2006.
Personal Information: Agencies and Resellers Vary in Providing  Privacy Protections. GAO-06-609T. Washington, D.C.: April 4, 2006.
Personal Information: Agency and Reseller Adherence to Key  Privacy Principles. GAO-06-421. Washington, D.C.: April 4, 2006.
Data Mining: Agencies Have Taken Key Steps to Protect Privacy in  Selected Efforts, but Significant Compliance Issues Remain. GAO- 05-866. Washington, D.C.: August 15, 2005.
Aviation Security: Transportation Security Administration Did  Not Fully Disclose Uses of Personal Information during Secure  Flight Program Testing in Initial Privacy Notices, but Has  Recently Taken Steps to More Fully Inform the Public. GAO-05- 864R. Washington, D.C.: July 22, 2005.
Identity Theft: Some Outreach Efforts to Promote Awareness of  New Consumer Rights are Under Way. GAO-05-710. Washington,  D.C.: June 30, 2005.
Electronic Government: Federal Agencies Have Made Progress  Implementing the E-Government Act of 2002. GAO-05-12.  Washington, D.C.: December 10, 2004.
Social Security Numbers: Governments Could Do More to Reduce  Display in Public Records and on Identity Cards. GAO-05-59.  Washington, D.C.: November 9, 2004.
Federal Chief Information Officers: Responsibilities, Reporting  Relationships, Tenure, and Challenges, GAO-04-823. Washington,  D.C.: July 21, 2004.
Data Mining: Federal Efforts Cover a Wide Range of Uses, GAO-04- 548. Washington, D.C.: May 4, 2004.
Privacy Act: OMB Leadership Needed to Improve Agency  Compliance. GAO-03-304. Washington, D.C.: June 30, 2003.
Data Mining: Results and Challenges for Government Programs,  Audits, and Investigations. GAO-03-591T. Washington, D.C.: March  25, 2003.
Technology Assessment: Using Biometrics for Border Security.  GAO-03-174. Washington, D.C.: November 15, 2002.
Information Management: Selected Agencies’ Handling of Personal  Information. GAO-02-1058. Washington, D.C.: September 30, 2002.
Identity Theft: Greater Awareness and Use of Existing Data Are  Needed. GAO-02-766. Washington, D.C.: June 28, 2002.
Social Security Numbers: Government Benefits from SSN  Use but Could Provide Better Safeguards. GAO-02-352.  Washington, D.C.: May 31, 2002.
section_title: Attachment 2. Chronology of Information Security Weaknesses Identified by GAO
paragraphs: Full citations are provided in attachment 1.
This  is  a  work  of  the  U.S.  government  and  is  not  subject  to  copyright  protection  in  the  United  States.  It  may  be  reproduced  and  distributed  in  its  entirety  without  further  permission  from  GAO.  However,  because  this  work  may  contain  copyrighted  images  or  other  material,  permission  from  the  copyright  holder  may  be  necessary  if  you  wish  to  reproduce this material separately.