Interior catches flak for breach disclosure

Losing the encrypted CD wasn't the main problem

Interior Department officials took the cautious route — some say too cautious — earlier this month when they disclosed that they could not locate a CD containing personally identifiable information for about 7,500 federal employees, even though it is unlikely anyone could read the CD’s contents because the information is encrypted and password-protected.

The incident occurred on or about May 26, when a procurement specialist at Interior’s National Business Center in Denver reported that the CD, which was sent there by a third-party service provider, could not be located. It was presumed to be lost in the center’s secure, restricted-access area, reported Alice Lipowicz on FCW.com.

Some observers questioned the necessity and wisdom of the announcement and notification to employees whose information was involved.

“It was encrypted and password-protected. So why the notifications?” wrote Sang Lee on the company blog of AlertBoot, a disk encryption vendor. “There is something to the idea of ‘data breach overexposure,’ where people don't pay as much notice once they're acclimated to something.”

A reader of FCW’s story posted an anonymous comment that posed a similar question: “Why, if this CD was properly encrypted with a FIPS 140-2-validated product, is this a news story?” 

A spokeswoman for the National Business Center said the agency followed its breach notification procedures in contacting the federal employees involved, who work for a number of federal agencies. Officials also established an incident call center to provide information and answer questions. Federal privacy regulations require agencies to report breaches of personally identifiable information.

Forty-four states have breach notification laws, wrote AlertBoot’s Lee in another blog post, but they don’t require notification if the lost or stolen data was protected with some kind of security measure such as encryption.

However, some notification laws do not treat all types of data breaches equally. In Ohio, for example, government agencies must notify affected parties of electronic data breaches but are not obligated to report possible breaches involving paper documents, reported Josh Sweigart in the Oxford Press.

That legal omission has been blamed for multiple instances of agencies in Ohio not notifying people whose personal information was potentially compromised because of improper disposal of paper records.

Such examples illustrate why notification laws are necessary when data is not secured and breaches occur, Lee wrote, adding, “Look at what happens when the law doesn't require it: People literally hide this stuff.”

About the Author

John Zyskowski is a senior editor of Federal Computer Week. Follow him on Twitter: @ZyskowskiWriter.

Featured

  • Cybersecurity

    DHS floats 'collective defense' model for cybersecurity

    Homeland Security Secretary Kirstjen Nielsen wants her department to have a more direct role in defending the private sector and critical infrastructure entities from cyberthreats.

  • Defense
    Defense Secretary James Mattis testifies at an April 12 hearing of the House Armed Services Committee.

    Mattis: Cloud deal not tailored for Amazon

    On Capitol Hill, Defense Secretary Jim Mattis sought to quell "rumors" that the Pentagon's planned single-award cloud acquisition was designed with Amazon Web Services in mind.

  • Census
    shutterstock image

    2020 Census to include citizenship question

    The Department of Commerce is breaking with recent practice and restoring a question about respondent citizenship last used in 1950, despite being urged not to by former Census directors and outside experts.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.