The growth in information technology, networking, and electronic storage has made it ever easier to collect and maintain information about individuals. An accompanying growth in incidents of loss and unauthorized use of such information has led to increased concerns about protecting this information on federal systems. As a result, the basic law governing privacy protections, the Privacy Act of 1974, has been supplemented by more recent laws and guidance that are particularly concerned with the protection of personally identifiable information maintained in automated information systems. Protecting personally identifiable information in federal systems is critical because its loss or unauthorized disclosure can lead to serious consequences for individuals. These consequences include identity theft or other fraudulent activity, which can result in substantial harm, embarrassment, and inconvenience. In 2006, the estimated losses associated with identity theft to U.S. organizations were $49.3 billion. Like other sectors, the federal government has seen significant exposures of personally identifiable information. According to a 2006 congressional staff report, since January 2003, 19 departments and agencies reported at least one loss of personally identifiable information that could expose individuals to identity theft. (App. II provides selected examples of these and other incidents.) A series of data breaches at federal agencies have involved system intrusion, phishing scams, and the physical loss or theft of portable computers, hard drives, and disks. During fiscal year 2006, federal agencies reported a record number of incidents to the U.S. Computer Emergency Readiness Team (US-CERT). For example, in 2006 there were 5,146 incident reports—a substantial increase over the 3,569 incidents reported in 2005. During this period, US-CERT recorded a dramatic rise in incidents where either physical loss or theft or system compromise resulted in the loss of personally identifiable information. As illustrated by recent security incidents and as we have previously reported, significant weaknesses continued to threaten the confidentiality, integrity, and availability of critical information and information systems used to support the operations, assets, and personnel of federal agencies. In their fiscal year 2006 financial statement audit reports, 21 of 24 major agencies indicated that deficient information security controls were either a reportable condition or a material weakness. Our audits continue to identify similar weaknesses in nonfinancial systems. Similarly, in their annual reporting under 31 U.S.C. § 3512 (commonly referred to as the Federal Managers’ Financial Integrity Act of 1982), 17 of 24 agencies reported shortcomings in information security, including 7 that considered it a material weakness. Agency inspectors general have also noted the seriousness of information security, with 21 of 24 including it as a “major management challenge” for their agencies. According to our reports and those of inspectors general, persistent weaknesses appear in the five major categories of information system controls: (1) access controls, which ensure that only authorized individuals can read, alter, or delete data; (2) configuration management controls, which provide assurance that only authorized software programs are implemented; (3) segregation of duties, which reduces the risk that one individual can independently perform inappropriate actions without detection; (4) continuity of operations planning, which provides for the prevention of significant disruptions of computer-dependent operations; and (5) an agencywide information security program, which provides the framework for ensuring that risks are understood and that effective controls are selected and properly implemented. Most agencies had weaknesses in each of these categories. Accordingly, we have designated information security as a governmentwide high-risk issue in reports to Congress since 1997—a designation that remains in force today. The primary laws that provide privacy protections to personal information are the Privacy Act of 1974 and the E-Government Act of 2002; these laws describe, among other things, agency responsibilities with regard to personally identifiable information, which include providing security. The security of information held by the federal government is specifically addressed by FISMA, which requires agencies to develop, document, and implement agencywide programs to provide security for their information and information systems, including personally identifiable information. Along with technical guidance from NIST, FISMA establishes a risk-based approach to security management, which requires an agency, among other things, to categorize its information and systems according to the potential impact to the agency should the information be jeopardized. In the wake of recent incidents of security breaches involving personal data, OMB has issued guidance reiterating the requirements of these laws and guidance, drawing particular attention to those associated with personally identifiable information. In addition, OMB updated and added to requirements for reporting security breaches and the loss or unauthorized access of personally identifiable information. The major requirements for the protection of personal privacy by federal agencies come from two laws, the Privacy Act of 1974 and the privacy provisions of the E-Government Act of 2002. In addition, FISMA, which is included in the E-Government Act of 2002, addresses the protection of personal information in the context of securing federal agency information and information systems. To protect personal privacy, the Privacy Act places limitations on agencies’ collection, disclosure, and use of personal information maintained in systems of records. The act describes a “record” as any item, collection, or grouping of information about an individual that is maintained by an agency and contains his or her name or another personal identifier. It also defines “system of records” as a group of records under the control of any agency from which information is retrieved by the name of the individual or by an individual identifier. The Privacy Act requires that when agencies establish or make changes to a system of records, they must notify the public by a notice in the Federal Register identifying, among other things, the type of data collected, the types of individuals about whom information is collected, the intended “routine” uses of the data, and procedures that individuals can use to review and correct personal information. The act’s requirements also apply to government contractors when agencies contract for the development and maintenance of a system of records to accomplish an agency function. The provisions of the Privacy Act are consistent with and based primarily on a set of principles for protecting the privacy and security of personal information—the Fair Information Practices. These principles have been widely adopted as the standard benchmark for evaluating the adequacy of privacy protections; one of the principles is security safeguards. In this regard, the Privacy Act requires agencies to “establish appropriate administrative, technical, and physical safeguards to insure the security and confidentiality of records and to protect against any anticipated threats or hazards to their security or integrity which could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual on whom information is maintained.” The E-Government Act of 2002 strives to enhance protection for personal information in government information systems by requiring that agencies conduct privacy impact assessments (PIA). A PIA is an analysis of how personal information is collected, stored, shared, and managed in a federal system. More specifically, according to OMB guidance, a PIA is an analysis of how information is handled (1) to ensure handling conforms to applicable legal, regulatory, and policy requirements regarding privacy; (2) to determine the risks and effects of collecting, maintaining, and disseminating information in identifiable form in an electronic information system; and (3) to examine and evaluate protections and alternative processes for handling information to mitigate potential privacy risks. Agencies must conduct PIAs (1) before developing or procuring information technology that collects, maintains, or disseminates information that is in a personally identifiable form or (2) before initiating any new data collections involving personal information that will be collected, maintained, or disseminated using information technology if the same questions are asked of 10 or more people. OMB guidance also requires agencies to conduct PIAs when a system change creates new privacy risks, for example, changing the way in which personal information is being used. The PIA requirement does not apply to all systems. For example, no assessment is required when the information collected relates to internal government operations, the information has been previously assessed under an evaluation similar to a PIA, or when privacy issues are unchanged. Besides these primary laws, Congress has passed laws requiring protection of personally identifiable information that are agency-specific or that target a specific type of information. For example, the Veterans Benefits, Health Care, and Information Technology Act, enacted in December 2006, establishes information technology security requirements for personally identifiable information that apply specifically to the Department of Veterans Affairs (VA). The act mandates, among other things, that VA develop procedures for detecting, immediately reporting, and responding to security incidents; notify Congress of any significant data breaches involving personally identifiable information; and, if necessary, provide credit protection services to those individuals whose personally identifiable information has been compromised. Another example is the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which requires the Secretary of Health and Human Services to adopt standards for the electronic exchange, privacy, and security of health information. These standards apply to agencies, such as the Department of Defense and VA, to the extent they are covered by HIPAA. FISMA is the primary law governing information security in the federal government; it also addresses the protection of personal information in the context of securing federal agency information and information systems. FISMA, which establishes a risk-based approach to security management, defines federal requirements for securing information and information systems that support federal agency operations and assets. Under the act, agencies are required to provide sufficient safeguards to cost-effectively protect their information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction, including controls necessary to preserve authorized restrictions on access and disclosure (and thus to protect personal privacy, among other things). The act also requires each agency to develop, document, and implement an agencywide information security program to provide security for the information and information systems that support the operations and assets of the agency (including those provided or managed by another agency, contractor, or other source). Specifically, the act requires that these information security programs include, among other things, periodic assessments of the risk and magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information or information systems; risk-based policies and procedures that cost-effectively reduce information security risks to an acceptable level and ensure that information security is addressed throughout the life cycle of each information system; subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems, as appropriate; security awareness training for agency personnel, including contractors and other users of information systems that support the operations and assets of the agency; periodic testing and evaluation of the effectiveness of information security policies, procedures, and practices, performed with a frequency depending on risk, but no less than annually, and that includes testing of management, operational, and technical controls for every system identified in the agency’s required inventory of major information systems; a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency; procedures for detecting, reporting, and responding to security incidents; plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency. In addition, FISMA requires agencies to produce an annually updated inventory of major information systems (including major national security systems) operated by the agency or that are under its control, which includes an identification of the interfaces between each system and all other systems or networks, including those not operated by or under the control of the agency. Like protecting other information and systems, protecting personally identifiable information is dependent on agencies’ having established security programs that include the elements described above. Among other things, agencies must identify the personally identifiable information in their information systems, determine the appropriate risk level associated with it, develop appropriate controls to secure it, and ensure that these controls are applied and maintained. FISMA also establishes evaluation and reporting requirements. Under the act, each agency must have an annual independent evaluation of its information security program and practices, including control testing and compliance assessment. Evaluations of non-national security systems are to be performed by the agency inspectors general or by an independent external auditor, while evaluations related to national security systems are to be performed only by an entity designated by the agency head. FISMA also requires each agency to report annually to OMB, selected congressional committees, and the Comptroller General on the adequacy of information security policies, procedures, and practices, and compliance with the act’s requirements. In addition, agency heads are required to annually report the results of their independent evaluations to OMB. OMB is required to submit a report to Congress each year on agency compliance with the act’s requirements, including a summary of findings of agencies’ independent evaluations. Other major FISMA provisions require NIST to develop, for systems other than national security systems, standards for categorizing information and information systems according to risk levels, guidelines on the types of information and information systems that should be included in each category, and standards for minimum information security requirements for information and information systems in each category. Accordingly, NIST developed the following guidance: Federal Information Processing Standards (FIPS) 199, Standards for Security Categorization of Federal Information and Information Systems. This standard is to be used by all agencies to categorize all their information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels. In addition, NIST has published Special Publication 800-60, to provide guidance on how to implement FIPS 199 and how to determine whether a system or information should be categorized as having a high-, moderate-, or low-risk impact level. FIPS 200, Minimum Security Requirements for Federal Information and Information Systems. This standard provides minimum information security requirements for information and information systems in each risk category. NIST Special Publication 800-53, Recommended Security Controls for Federal Information Systems. The publication provides guidelines for selecting and specifying security controls for information systems supporting the federal government. OMB is responsible for establishing governmentwide policies and for providing guidance to agencies on how to implement the provisions of FISMA, the Privacy Act, and other federal information security and privacy laws. It has issued both recommended steps and required actions to protect federally owned information and information systems. For example, OMB memorandum M-05-08 directs agencies to designate a senior official with overall responsibility for information privacy issues, including taking appropriate steps to protect personally identifiable information from unauthorized use, access, disclosure, or sharing, and to protect related information systems from unauthorized access, modification, disruption, or destruction. Following the May 2006 VA data breach, OMB issued guidance reiterating agency responsibilities under the laws and technical guidance, drawing particular attention to the requirements associated with personally identifiable information. OMB memorandum M-06-15, Safeguarding Personally Identifiable Information, re-emphasizes agency responsibilities to safeguard personally identifiable information and to appropriately train employees in this regard. It also requires agencies to perform a review of their policies and procedures for the protection of personally identifiable information, including an examination of physical security, and to take corrective action. OMB memorandum M-06-16, Protection of Sensitive Agency Information, asks agencies to verify that existing organizational policy adequately addresses the information protection needs associated with personally identifiable information that is accessed remotely or physically removed. It recommends, among other things, that all information on mobile computers and devices be encrypted unless a written waiver is issued certifying that the computer does not contain any sensitive information. In addition, M-06-16 recommends that agencies use a NIST checklist included in the memorandum. The NIST checklist states that agencies should verify that information requiring protection as personally identifiable information is appropriately categorized as such and that it is assigned an appropriate risk impact category. OMB also updated and added to requirements for reporting security breaches and the loss or unauthorized access of personally identifiable information. OMB memorandum M-06-19 directs agencies to report all incidents involving personally identifiable information to US-CERT within 1 hour of discovery of the incident. Further, OMB recommends that agencies establish a core management group responsible for responding to the loss of personal information in a memorandum issued September 20, 2006. In OMB memorandum M-06-20, FY 2006 Reporting Instructions for the Federal Information Security Management Act and Agency Privacy Management, OMB asks agencies to identify in their yearly FISMA reports any physical or electronic incidents involving the loss of or unauthorized access to personally identifiable information. In these annual reports, agencies also are required to report numbers of incidents for the reporting period, the number of incidents the agency reported to US-CERT, and the number reported to law enforcement. Most recently, OMB memorandum M-07-16, Safeguarding Against and Responding to the Breach of Personally Identifiable Information, requires agencies to develop and implement breach notification policies— that is, policies governing how and under what circumstances affected parties are notified in case of a security breach. Agencies were to develop and implement such policies and associated plans within 120 days from the issuance of the memorandum (May 22, 2007). The memorandum also reiterates four particularly important existing security requirements that agencies should already have been implementing: (1) assigning an impact level to all information and information systems, (2) implementing the minimum security requirements and controls in FIPS 200 and NIST Special Publication 800- 53 respectively, (3) certifying and accrediting information systems, and (4) training employees. With regard to the first of these, OMB stressed that agencies should generally consider categorizing sensitive personally identifiable information (and information systems within which such information resides) as moderate or high impact. In addition, this memorandum reiterates the guidance provided in memorandum M-06-16 on protection of personally identifiable information and changes earlier recommendations to requirements. These and other OMB memorandums significant to the protection of personally identifiable information are briefly described in table 1. Ensuring that agency policies and procedures appropriately emphasize the protection of personally identifiable information in accordance with applicable laws and guidance is an important aspect of protecting personal privacy. In recent guidance, OMB directed agencies to encrypt and otherwise protect personally identifiable information that is either accessed remotely or physically transported outside an agency’s secured physical perimeter. Specifically, agencies were required to encrypt all data on mobile computers or devices that carry agency data, unless the data are determined to be nonsensitive; allow remote access only with two-factor authentication, where one of the factors is provided by a device separate from the computer gaining access; use a “time-out” function for remote access and mobile devices that requires that users re-authenticate after 30 minutes of inactivity; and log all instances in which computer-readable data are extracted from databases holding sensitive information, and verify that each extract including sensitive data has been erased within 90 days or that its use is still required. OMB also recommended the use of a NIST-provided checklist for the protection of remote information, which was included in memorandum M- 06-16. The checklist provides specific actions to be taken by federal agencies for the protection of personally identifiable information that is categorized as moderate or high impact and that is either accessed remotely or physically transported outside an agency’s secured, physical perimeter, including information transported on removable media and on portable or mobile devices such as laptop computers and personal digital assistants. The controls and assessment methods and procedures in the checklist are a subset of what is currently required under NIST Special Publications 800-53 and 800-53A for moderate- and high-impact information systems. In addition, NIST standard (FIPS 140-2, Security Requirements for Cryptographic Modules) is to be used by federal organizations when it is specified that cryptographic-based security systems are to be used to provide protection for sensitive or valuable data. All encryption modules that protect sensitive data must follow this standard. However, not all agencies had developed policies and procedures reflecting OMB guidance for protecting personally identifiable information that is accessed remotely or physically transported outside an agency’s secured perimeter. Of the 24 major agencies, 22 had developed policies requiring personally identifiable information to be encrypted on mobile computers and devices. A smaller number of agencies had policies to provide other protections recommended by OMB, 14 of the agencies had two-factor authentication policies for remote access. Fifteen of the agencies had policies to use a “time-out” function for remote access and mobile devices requiring user reauthentication after 30 minutes of inactivity. One agency used a reauthentication time shorter than 30 minutes (15 minutes). Fewer agencies (11) had established policies to log computer-readable data extracts from databases holding sensitive information and erase the data within 90 days after extraction. However, several of the agencies that had not established such policies indicated that they were researching technical solutions to address these issues. Four agencies had policies requiring the use of the NIST checklist recommended by OMB. In addition, 20 agencies had written policies that require encryption software to be NIST FIPS 140-2 compliant. Gaps in their policies and procedures reduce agencies’ ability to protect personally identifiable information from improper disclosure. The loss of personally identifiable information can result in substantial harm, embarrassment, and inconvenience to individuals and may lead to identity theft or other fraudulent use of the information. Because agencies maintain significant amounts of information concerning individuals, agencies should be more vigilant to protect that information from loss and misuse. At the conclusion of our review and with the recent release of OMB’s President’s Management Agenda Scorecard for the fourth quarter of fiscal year 2007, OMB announced that agencies that did not complete all the privacy and security requirements identified in OMB memorandum M-07- 16, which included the requirements just described, received a downgrade in their scores for E-Government progress. According to OMB, it will continue working with agencies to help them strengthen their information security and privacy programs, especially as they relate to the protection of personally identifiable information. In view of OMB’s recent actions in this area, we are making no recommendations at this time. We reiterate, however, as we have in the past, that although having specific policies and procedures in place is an important factor in helping agencies to secure their information systems and to protect personally identifiable information, proper implementation of these policies and procedures remains crucial. Agencies’ implementation of OMB’s guidance on personally identifiable information, as well as our previous recommendations on improving agency information security and implementation of FISMA requirements, will be essential in improving the protection of personally identifiable information. In providing oral comments on a draft of this report, OMB representatives stated that they generally agreed with the report’s contents. In addition, they provided technical comments that we incorporated into the report. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to interested congressional committees and other interested parties. We will also make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at www.gao.gov. If you have questions about this report, please contact me at (202) 512- 6244. I can also be reached by e-mail at wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix III. Our objectives were to (1) identify the federal laws and guidance issued to protect personally identifiable information from unauthorized use or disclosure and (2) describe agencies’ policies and documented procedures that respond to recent Office of Management and Budget (OMB) guidance to protect personally identifiable information that is either accessed remotely or physically transported outside an agency’s secured physical perimeter. To address our first objective, we identified and reviewed legislative requirements for the protection of personally identifiable information by federal agencies. Specifically, we reviewed the Privacy Act of 1974; the E-Government Act of 2002; the Federal Information Security Management Act of 2002; the Veterans Benefits, Health Care, and Information Technology Act of 2006; and the Health Insurance Portability and Accountability Act of 1996. We also reviewed policy and guidance issued by OMB and National Institute of Standards and Technology (NIST) relevant to agencies’ policies and procedures to safeguard personally identifiable information. To address our second objective, we selected 24 major agencies and assessed the status of their policies and procedures addressing recent OMB guidance addressing personally identifiable information. At our request, each agency completed a survey of personally identifiable information practices and provided related policies and procedures. The survey and document request were based on requirements and recommendations in the OMB guidance. We examined survey responses and compared agency-documented policies and procedures to OMB’s requirements and guidance for consistency and sufficiency. We did not evaluate the effectiveness of agencies’ implementation of the practices. However, we reviewed applicable prior GAO and agency inspector general reports and discussed whether agency policies had been fully implemented with applicable agency information technology officials. We conducted this performance audit from September 2006 to January 2008 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The incidents noted here were reported by government agencies between November 2004 and January 2007. Many of these incidents included the loss of personally identifiable information. These incidents were selected to provide illustrative examples of the types of incidents that occurred during this period. November 3, 2004, Department of Education: information of 8,290 individuals lost in the mail A contractor to the Federal Student Aid program sent the personal information of 8,290 individuals via a commercial shipping company. After determining that the package had been lost in transit, the department decided not to notify the affected individuals. It discontinued using that carrier for that facility as a result. November 24, 2004, Department of Veterans Affairs (VA): personal information accidentally disclosed on public drive of VA e-mail system A public drive on a VA e-mail system permitted entry by all users to folders and files containing personally identifiable information (name, Social Security number, date of birth, and in some cases personal health information such as surgery schedules, diagnosis, status, etc.) of veterans after computer system changes were made. All folders were then restricted and the individual services were contacted to limit user access. December 6, 2004, Department of Veterans Affairs: two personal computers stolen, exposing data of 2,000 research subjects Two desktop personal computers were stolen from a locked office in the research office of a medical center. One of the computers had files containing names, Social Security numbers, next of kin, addresses, and phone numbers of approximately 2,000 research subjects. The computers were password protected by the standard VA password system. The medical center immediately contacted the agency privacy officer for guidance. Letters were mailed to all research subjects informing them of the computer theft and potential for identity theft. VA enclosed letters addressed to three major credit agencies and postage paid envelopes. This incident was reported to VA and federal incident offices. December 17, 2004, Department of Agriculture: e-mail sent out to 1,537 individuals whose personally identifiable information was potentially exposed An e-mail was sent to 1,537 people that included an attachment with the Social Security numbers and other personal information of all 1,537 individuals. In response to the event, a letter of apology was sent and training on appropriate security measures was developed. February 24, 2005, Department of Agriculture: hacker obtains access A system containing research data was breached when someone cracking a password or a user account installed hacking software. The agency reports that no data were compromised but that the hacker had read and write access to the server and opened access points. March 4, 2005, Department of Veterans Affairs: list of Social Security numbers of 897 providers inadvertently sent via e-mail An employee reported e-mailing a list of the names and Social Security numbers of 897 providers to a new transcription company. This was immediately reported and a supervisor called the transcription company and spoke with the owner and requested that the company destroy the file immediately. Notification letters were sent out to all 897 providers. Disciplinary action was taken against the employee. June 17, 2005, Department of Defense: potential unauthorized access A systems administrator discovered potential unauthorized access to the Air Force Personnel Center Assignment Management System with personally identifiable information on 33,000 military members. Notifications were sent out to system users and an investigation was begun. Mid 2005, Department of Energy: a hacker accessed more than 1,500 In June 2006, it was announced a hacker had gained access to a file containing the names and Social Security numbers of 1,502 individuals. This event, which was detected in mid 2005, was not reported to senior Department officials until June 2006. October 14, 2005, Department of Veterans Affairs: personal computer stolen, exposing data on 421 patients A personal computer was stolen from a medical center that contained information on 421 patients and included patient names, last four digits of their Social Security number, height, weight, allergies, medications, recent lab results, and diagnoses. The agency’s privacy officer and medical center information security officer were notified. The use of credit monitoring was investigated and it was determined that, because the entire Social Security number was not listed, it would not be necessary to use these services at the time. November 5, 2005, Department of Education: personally identifiable information of 11,329 student borrowers lost The unencrypted magnetic tape was lost from the Federal Student Aid’s Virtual Data Center. After an investigation, no criminal activity was found and the case was closed. November 18, 2005, Department of Health and Human Services: contractor employees steal records of approximately 1,574 Two employees of the Centers for Medicare & Medicaid Services contractor stole records for the purpose of identity theft. The approximately 1,574 individuals were notified. February 15, 2006, Department of Health and Human Services: 22 laptops stolen from contractor site, exposing information on 1,382 The Centers for Disease Control and Prevention reported 22 laptops stolen from a contractor’s facility; 3 of them contained Department of Defense service member information affecting 1,382 personnel. All of the potentially impacted individuals were notified. March 17, 2006, Department of Defense: thumb drive with personally identifiable information of approximately 207,570 Marines lost The information on approximately 207,570 enlisted Marines from 2001 to 2005 was lost. A notification letter was sent to the affected individuals and the Marine Corps. March 28, 2006, Department of Health and Human Services: eight laptops stolen from contractor, exposing information on 10,855 Eight laptops containing beneficiary and supplier information were stolen from the contractor’s office. The beneficiary list on the laptops included 10,855 names, addresses, and dates of birth. April 5, 2006, Department of Defense: hackers access Tricare Management Activity, exposing personal data Hackers accessed a system containing personally identifiable information on military employees. Approximately 14,000 active duty and retired service members and dependents were affected and notified. New security measures were implemented. April 11, 2006, Department of Veterans Affairs: hacker and employee compromise systems, exposing information on 79,000 veterans A former VA employee was suspected of hacking into a medical center computer system with the assistance of a current employee who provided rotating administrator passwords. All systems in the medical center serving 79,000 veterans were compromised. May 3, 2006, Department of Veterans Affairs: computer equipment containing personally identifiable information of approximately 26.5 million veterans and active duty members of the military was stolen Computer equipment containing personally identifiable information on approximately 26.5 million veterans and active duty members of the military was stolen from the home of a VA employee. June 3, 2006, Department of Agriculture: systems compromised and potentially exposed information on 26,000 Three Department of Agriculture computers system were compromised, potentially exposing the personally identifiable information of 26,000 individuals, including photographs. The department notified the individuals. June 19, 2006, Department of Education: package with personally identifiable information of 13,700 study respondents lost The shipping contractor to the department’s National Center for Education Statistics lost a package containing the personally identifiable information of 13,700 study respondents. June 22, 2006, Department of Health and Human Services: laptop stolen from contractor employee, exposing information on 49,572 The theft of a contractor employee’s laptop containing a variety of personally identifiable information including medical information was reported. A total of 49,572 Medicare beneficiaries may have been affected. All were notified. July 1, 2006, Department of Commerce: documents and database copied by a former employee, exposing 934 employees A former employee copied sensitive letters and a database of employee information. The database included information on 883 cases and the letters had medical information on 51 employees. July 27, 2006, Department of Transportation: laptop stolen from car of DOT Inspector General, exposing information on approximately 133,000 A laptop containing personally identifiable information of approximately 133,000 Florida pilots, commercial drivers, and other Florida residents was stolen from a government-owned vehicle. August 1, 2006, Department of Defense: laptop falls off motorcycle, losing personally identifiable information of 30,000 A laptop containing personally identifiable information on 30,000 applicants, recruiters, and prospects fell off a motorcycle belonging to a Navy recruiter. August 3, 2006, Department of Veterans Affairs: desktop computer stolen, exposing financial records of approximately 18,000 patients A desktop computer was stolen from a secured area at a contractor’s facility in Virginia that processes financial accounts for VA. The desktop computer was not encrypted. Notification letters were mailed and credit monitoring services offered. September 6, 2006, Department of Veterans Affairs: laptop stolen, exposing patient information on an unknown number of individuals A laptop attached to a medical device was stolen. The information on an unknown number of individuals was exposed. Notification letters and credit protection services were offered to 1,575 patients. January 22, 2007, Department of Veterans Affairs: external hard drive missing or stolen, exposing records on 535,000 veterans and 1.3 million non-VA physician provider records An external hard drive was discovered missing or stolen, exposing records on 535,000 veterans and 1.3 million non-VA physician provider records from a research facility in Birmingham, Alabama. Notification letters were sent to veterans and providers, and credit monitoring services were offered to those individuals whose records contained personally identifiable information. In addition to the individual named above, Shaun Byrnes, Barbara Collier, Susan Czachor, Kristi Dorsey, Nancy Glover, Joshua Hammerstein, Anthony Molet, David Plocher, Charles Vrabel (Assistant Director), and Jeffrey Woodward were key contributors to this report.

Summary: The loss of personally identifiable information can result in substantial harm, embarrassment, and inconvenience to individuals and may lead to identity theft or other fraudulent use of the information. As shown in prior GAO reports, compromises to such information and long-standing weaknesses in federal information security raise important questions about what steps federal agencies should take to prevent them. As the federal government obtains and processes information about individuals in increasingly diverse ways, properly protecting this information and respecting the privacy rights of individuals will remain critically important. GAO was requested to (1) identify the federal laws and guidance issued to protect personally identifiable information from unauthorized use or disclosure and (2) describe agencies' progress in developing policies and documented procedures that respond to recent guidance from the Office of Management and Budget (OMB) to protect personally identifiable information that is either accessed remotely or physically transported outside an agency's secured physical perimeter. To do so, GAO reviewed relevant laws and guidance, surveyed officials at 24 major federal agencies, and examined and analyzed agency documents, including policies, procedures, and plans. In commenting on a draft of this report, OMB stated that it generally agreed with the report's contents. Two primary laws (the Privacy Act of 1974 and the E-Government Act of 2002) give federal agencies responsibilities for protecting personal information, including ensuring its security. Additionally, the Federal Information Security Management Act of 2002 (FISMA) requires agencies to develop, document, and implement agencywide programs to provide security for their information and information systems (which include personally identifiable information and the systems on which it resides). The act also requires the National Institute of Standards and Technology (NIST) to develop technical guidance in specific areas, including minimum information security requirements for information and information systems. In the wake of recent incidents of security breaches involving personal data, OMB issued guidance in 2006 and 2007 reiterating agency responsibilities under these laws and technical guidance, drawing particular attention to the requirements associated with personally identifiable information. In this guidance, OMB directed, among other things, that agencies encrypt data on mobile computers or devices and follow NIST security guidelines regarding personally identifiable information that is accessed outside an agency's physical perimeter. Not all agencies had developed the range of policies and procedures reflecting OMB guidance on protection of personally identifiable information that is either accessed remotely or physically transported outside an agency's secured physical perimeter. Of 24 major agencies, 22 had developed policies requiring personally identifiable information to be encrypted on mobile computers and devices. Fifteen of the 24 agencies had policies to use a "time-out" function for remote access and mobile devices requiring user reauthentication after 30 minutes of inactivity. Fewer agencies (11) had established policies to log computer-readable data extracts from databases holding sensitive information and erase the data within 90 days after extraction. Several agencies indicated that they were researching technical solutions to address these issues. Gaps in their policies and procedures reduced agencies' ability to protect personally identifiable information from improper disclosure. At the conclusion of GAO's review, OMB announced in November 2007 that agencies that did not complete certain privacy and security requirements, including those just described, received a downgrade in their scores for progress in electronic government initiatives. According to OMB, it will continue working with agencies to help them strengthen their information security and privacy programs, especially as they relate to the protection of personally identifiable information. In view of OMB's recent actions in this area and GAO's previous recommendations on improving agency information security and implementation of FISMA requirements, GAO is making no further recommendations at this time.