Interior catches flak for breach disclosure

Losing the encrypted CD wasn't the main problem

Interior Department officials took the cautious route — some say too cautious — earlier this month when they disclosed that they could not locate a CD containing personally identifiable information for about 7,500 federal employees, even though it is unlikely anyone could read the CD’s contents because the information is encrypted and password-protected.

The incident occurred on or about May 26, when a procurement specialist at Interior’s National Business Center in Denver reported that the CD, which was sent there by a third-party service provider, could not be located. It was presumed to be lost in the center’s secure, restricted-access area, reported Alice Lipowicz on FCW.com.

Some observers questioned the necessity and wisdom of the announcement and notification to employees whose information was involved.

“It was encrypted and password-protected. So why the notifications?” wrote Sang Lee on the company blog of AlertBoot, a disk encryption vendor. “There is something to the idea of ‘data breach overexposure,’ where people don't pay as much notice once they're acclimated to something.”

A reader of FCW’s story posted an anonymous comment that posed a similar question: “Why, if this CD was properly encrypted with a FIPS 140-2-validated product, is this a news story?” 

A spokeswoman for the National Business Center said the agency followed its breach notification procedures in contacting the federal employees involved, who work for a number of federal agencies. Officials also established an incident call center to provide information and answer questions. Federal privacy regulations require agencies to report breaches of personally identifiable information.

Forty-four states have breach notification laws, wrote AlertBoot’s Lee in another blog post, but they don’t require notification if the lost or stolen data was protected with some kind of security measure such as encryption.

However, some notification laws do not treat all types of data breaches equally. In Ohio, for example, government agencies must notify affected parties of electronic data breaches but are not obligated to report possible breaches involving paper documents, reported Josh Sweigart in the Oxford Press.

That legal omission has been blamed for multiple instances of agencies in Ohio not notifying people whose personal information was potentially compromised because of improper disposal of paper records.

Such examples illustrate why notification laws are necessary when data is not secured and breaches occur, Lee wrote, adding, “Look at what happens when the law doesn't require it: People literally hide this stuff.”

About the Author

John Zyskowski is a senior editor of Federal Computer Week. Follow him on Twitter: @ZyskowskiWriter.

The Fed 100

Save the date for 28th annual Federal 100 Awards Gala.

Featured

  • computer network

    How Einstein changes the way government does business

    The Department of Commerce is revising its confidentiality agreement for statistical data survey respondents to reflect the fact that the Department of Homeland Security could see some of that data if it is captured by the Einstein system.

  • Defense Secretary Jim Mattis. Army photo by Monica King. Jan. 26, 2017.

    Mattis mulls consolidation in IT, cyber

    In a Feb. 17 memo, Defense Secretary Jim Mattis told senior leadership to establish teams to look for duplication across the armed services in business operations, including in IT and cybersecurity.

  • Image from Shutterstock.com

    DHS vague on rules for election aid, say states

    State election officials had more questions than answers after a Department of Homeland Security presentation on the designation of election systems as critical U.S. infrastructure.

  • Org Chart Stock Art - Shutterstock

    How the hiring freeze targets millennials

    The government desperately needs younger talent to replace an aging workforce, and experts say that a freeze on hiring doesn't help.

  • Shutterstock image: healthcare digital interface.

    VA moves ahead with homegrown scheduling IT

    The Department of Veterans Affairs will test an internally developed scheduling module at primary care sites nationwide to see if it's ready to service the entire agency.

  • Shutterstock images (honglouwawa & 0beron): Bitcoin image overlay replaced with a dollar sign on a hardware circuit.

    MGT Act poised for a comeback

    After missing in the last Congress, drafters of a bill to encourage cloud adoption are looking for a new plan.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group