Government Computer News
Davis seeks standard IT breach notification policy
Federal agencies have been losing laptop computers, including those with personal data, without public notification and sometimes undetected by the government.
Digg
De.licio.us
Slashdot
Technorati
Agencies are finding out now, and disclosing the information, because House Government Reform Committee chairman Tom Davis (R-Va.) requested summaries of data breaches over the last several years.
As a result, the situation requires a strong governmentwide policy on public notification, including strengthening legislation he has introduced, Davis said.
The most flagrant violator among agency responses so far is the Commerce Department, which reported that 1,137 laptops had been lost, stolen or misplaced since 2001. It also is missing 46 flash or “thumb” drives and 16 handheld computers. Of these, 672 of the missing laptops were from the Census Bureau, and 246 of those contained personally identifiable information.
“Perhaps the most shocking thing here is that the public might not have ever known of these breaches and their scope if we hadn’t specifically asked for the information,” Davis said in a statement.
“I’m surprised agencies don’t have this information at hand. That shows we still have a long way to go on agency data security,” he said.
The federal government spends tens of billions of dollars a year on IT, yet the reality is that the government is incapable of storing, moving and accessing information, he said.
Davis plans to pursue whatever legislative fixes are necessary to reduce the losses and, when they happen, to make sure that appropriate officials know and act on the information, and notify those potentially at risk.
The Federal Information Security Management Act guides agencies in protecting federal information, operations and assets. In Davis’ annual FISMA scorecard, the federal government averages D+. Among FISMA provisions, agencies are required to report data breaches to the U.S. Computer Emergency Readiness Team (US-CERT) within the Homeland Security Department. The Office of Management and Budget recently expanded the rule to cover all incidents that include personally identifiable information.
“We may need to update the law regarding notification of Congress, and the Government Reform Committee in particular,” he said.
![1105 Government Information Group [justice]](/images/1105logo_website.gif "Government Computer News [justice]")
© 1996-2008 1105 Media, Inc. All Rights Reserved.
