Analysis: Why did EPA delay notifying data breach victims?

Although it's disturbing enough that about 8,000 people had their personal information compromised when a virus attacked Environmental Protection Agency computers, what is really eyebrow-raising is that EPA didn't notify the victims for several months.

The breach happened in March; EPA alerted the people involved in August.

Tanya Forsheit, a founding partner at InfoLawGroup, told the U.K.'s PC Advisor that there is no single standard for notifying people potentially affected by a breach.

"State and federal breach notification laws govern how quickly an organization is required to notify affected individuals of a breach," Forsheit said. "Those deadlines depend on the particular law involved. The 46 state laws are all different, and the federal laws that do exist…are different still."

The compromised EPA servers contained data related to the Superfund program, the hazardous-waste cleanup effort mandated in 1980. The program is almost entirely managed by contractors. The data — including Social Security numbers, bank account information and home addresses — was exposed after an e-mail attachment with a virus was opened on a computer with access privileges to the breached servers, according to reports.

The breach raises questions about the cybersecurity measures in place at the agency and at agencies throughout government. Technology and policy are critical to the success of any security effort, in addition to education and training, experts say.

“We cannot just have policy-based approaches to cybersecurity; it has to be technology-based, too,” said Tony Busseri, CEO of IT security firm Route1. “If we rely upon the human condition — i.e., we expect someone to adhere to a policy — and that’s the only protection we have, we’re going to have failure. By nature, people are prone to making errors.”

That concern isn’t limited to EPA or to this specific incident. It’s something that must be considered as the federal government increasingly looks to telework and bring-your-own-device policies, Busseri said.

“We’ve forgotten in today’s world some of the simple rules of dealing with data. As soon as we allow data to go beyond the network perimeter, all the firewalls and monitoring tools are rendered useless,” he said. “It comes down to cybersecurity 101.”

Breaches involving government computers seem to be on the rise. Agencies reported 13,000 incidents in 2010 and 15,500 in 2011, according to a report in the Federal Times.

About the Author

Amber Corrin is a former staff writer for FCW and Defense Systems.

FCW in Print

In the latest issue: Looking back on three decades of big stories in federal IT.


  • Anne Rung -- Commerce Department Photo

    Exit interview with Anne Rung

    The government's departing top acquisition official said she leaves behind a solid foundation on which to build more effective and efficient federal IT.

  • Charles Phalen

    Administration appoints first head of NBIB

    The National Background Investigations Bureau announced the appointment of its first director as the agency prepares to take over processing government background checks.

  • Sen. James Lankford (R-Okla.)

    Senator: Rigid hiring process pushes millennials from federal work

    Sen. James Lankford (R-Okla.) said agencies are missing out on younger workers because of the government's rigidity, particularly its protracted hiring process.

  • FCW @ 30 GPS

    FCW @ 30

    Since 1987, FCW has covered it all -- the major contracts, the disruptive technologies, the picayune scandals and the many, many people who make federal IT function. Here's a look back at six of the most significant stories.

  • Shutterstock image.

    A 'minibus' appropriations package could be in the cards

    A short-term funding bill is expected by Sept. 30 to keep the federal government operating through early December, but after that the options get more complicated.

  • Defense Secretary Ash Carter speaks at the TechCrunch Disrupt conference in San Francisco

    DOD launches new tech hub in Austin

    The DOD is opening a new Defense Innovation Unit Experimental office in Austin, Texas, while Congress debates legislation that could defund DIUx.

Reader comments

Mon, Aug 27, 2012 OccupyIT

Any value to add here, Mr. Van Roekel? How about a federal notification standard? Seems like something you should mandate from your bully-pulpit. I don't think it requires an act of congress. Sounds like a reasonable Executive Order. It might even take an item off the Bring Your Own Disaster list...

Fri, Aug 24, 2012 Steve Flyover Country

What gets me is that we are still hearing about breaches where those whose information was taken are not notified for several months or more about the breach. How many times have we seen where some company, government agency or other entity has sat on breach notification, and now everybody affected is livid that they weren't notified sooner? Now they not only look like they have incompetent security, but they also have a willful disregard for the privacy and financial safety of their customers, partners, employees, etc. People may forgive a misstep that caused a problem, they will not forgive the cover up.

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group