Date: 2006-09-26
Speaker: TOM DAVIS (republican)
Chamber: H
State: Virginia

Chairman BUYER. I thank you and Mr. FILNER for your leadership on this. Secure information is the lifeblood of effective government policy and management. yet Federal agencies continue to hemorrhage vital data. Recent losses -of personal information compel us to ask. what is being done to protect the sensitive digital identities of millions of Americans. and how can we limit the damage when personal data goes astray? As we all now know. a Department of Veterans Affairs employee reported the theft of computer equipment from his home. equipment that stored more than 26 million records containing personal information. VA leadership delayed acting on the report for almost 2 weeks while millions were at risk of serious harm from identity theft and the agency struggled to determine the exact extent of the breach. But this is only one in a long string of personal information breaches in the public and private sectors. including financial institutions. data brokerage companies. and academic institutions. Just last week. we learned the Census Bureau cannot account for 1.100 laptops issued to employees. These breaches illustrate how far we have to go to reach the goal of strong. uniform governmentwide information security policies and procedures.. On our committee. we focused on governmentwide information management security for a long time. The Privacy Act and the EGovernment Act of 2002 outline the parameters for the protection of personal information. These recent incidents highlight the importance of establishing and following security standards for safeguarding personal information. They also highlight the need for the proactive security breach notification requirements for organizations. including Federal agencies. that deal with sensitive personal information. Congress has been working on requirements for the private sector. but Federal agencies present unique requirements and challenges. and these incidents demonstrate that we need to strengthen laws and rules protecting personal information held by Federal agencies. Given the VA incident. and in order to get a more complete picture of the problems before pursuing legislation. - our Committee sent a request to every Cabinet agency seeking information about data breaches. The results are in. and they are troubling. We have learned there hasbeen a wide range of incidents involving data loss or theft. privacy breaches and security incidents. In almost all of these cases. Congress and the public would not have learned of such events unless we had requested the information. This history of withholding incidents has to stop. Our committee bill. which has been incorporated as a managers amendment in section 2. requires that timely notice be provided to individuals whose sensitive personal information could be compromised by a breach of data security at a Federal agency. Despite the volume of sensitive information held by agencies. until now there has been no requirement that people be notified if their information is compromised. Under this legislation. the administration must establish practices. procedures. and standards for the agencies to follow if sensitive personal information is lost or stolen and there is reasonable risk of harm to an individual. and we provide a clear definition of the type of sensitive information we are trying to protect. We also give the agency CIOs the authority when appropriate and authorized to ensure that agency personnel comply with the information security laws that are already on the books. Finally. we ensure that costly equipment containing potentially sensitive information is accounted for and secure. Half of the lost Census Bureau computers simply werent returned by departing or terminated employees. The agency did not track computer equipment. nor were employees held accountable for failing to return it. This is taxpayerfunded equipment containing sensitive information. and we have to know who has it at all times. Each year our committee releases information security score cards. This year the VA earned an F. the second consecutive year and fourth time in the past 5 years the Department received a failing grade. and the government overall got a Dplus. Our Federal Government has sensitive personal information on every citizen. health records. tax returns. military records. If our government cant secure this information. who can? We need to ensure the public knows when its sensitive personal information has been lost or compromised in some way. I again want to commend my colleagues. Chairman BUYER. Ms. PRYCE.