Federal data breaches: How long is too long to inform victims?

Negotiating data breaches can mean a tricky balancing act for government agencies. There’s the need to secure information, determine what has happened, alert potential victims and face the public relations firestorm that, if it’s a big enough problem, will ensue. With so many different competing priorities, what’s the right way?

In the Twitter era – when an incident can be publicized to millions within seconds, by just about anyone – it’s difficult to weigh transparency demands against the internal chaos that follows a data breach. Over the past years it’s a struggle a number of federal agencies have had to face. Case in point: This summer, the Environmental Protection Agency admitted their servers had been hacked in a breach that affected some 8,000 users. It took five months for the EPA to come forward with the information.

What took so long? Why the lack of clarity?

According to cybersecurity experts and other inside sources, it takes time to determine what has actually happened. It doesn’t help that there is little in the way of a legal blueprint for dealing with such events.

“What’s going on is that once it’s discovered, there’s a bunch of corrective action happening. They’re figuring out exactly how it was done so they can plug that hole. Many vendors are selling in the broader marketplace, so they have to determine if they’re doing the same thing in, say, the financial sector and if they need to take time to go correct that as well,” said Trey Hodgkins, TechAmerica senior vice president of global public sector government affairs.

According to Hodgkins, that delay is necessary for adequate protection of a number of different interests.

“Much of [the delay] is designed to protect the economic structure of the U.S. If there’s a vulnerability that’s used in the defense industrial base, but it’s also the same practice or technology that’s deployed in other areas…we don’t want to disclose how it happened and then someone say, ‘Oh, look, we can go over here and get all this information,” he said. “That’s generally why there’s a lag – because this corrective action needs to be taken to make sure the damage isn’t worse and more bad actors don’t discover avenues to get in.”

There are also legal concerns, and there can be questions about what has actually happened. Recently, the FBI was said to have been breached by the hacker group Anonymous, resulting in the release of a million Apple user IDs. The FBI denied any of their computers or information had been stolen, and on Sept. 10 – nearly a week after the story broke – the New York Times reported that Orlando-based company Blue Toad said they had been the victims of the breach.

“Some organizations have internal battles over saying something, whether they can definitively say data was taken; maybe wait to see if the information is used,” said Richard Bejtlich, chief security officer at Mandiant. “A lot of the time you’re not trying to figure out how they got in, but where they are and how much of the enterprise they have. Then it becomes a matter of containment, clean-up and investigation of when the [incident] started.”

But what are agencies required to say about data breaches? There are state-by-state requirements, but so far no uniform standard. Some states require that breaches don’t have to be reported if the information stolen was encrypted; others have to report even encrypted-data theft, Bejtlich said. At the Defense Department, most contracts have provisions for the reporting of breaches to the contract authority or an organization like the Defense Security Service.

Other data security statutes are so outdated, they were written before the Internet era – and are more than ready for a re-write, Hodgkins pointed out.

“The data breach discussion is one of the elements proposed for reform…if you look at many of the statutes, they were passed decades before the Internet existed. Disclosing to someone when things happen – the framework was designed before we had the Internet. The concept that your data would be stolen that way was foreign. That’s the policy debate we’ve been having for some time – what would data breach legislation look like?” he said.

Hodgkins noted that the failed Cybersecurity Act of 2012 included some provisions addressing the issue, which he said he expects will be tackled again in the next Congress, even if not in the form of all-encompassing legislation.

“When you reach this kind of an impasse, it’s time to start looking at breaking things up and starting to pass them individually. Then you actually can move the needle – maybe not in one big chunk, but you can substantially move the needle if you pass any one of these different elements, focusing on one given piece,” Hodgkins said.

But will more laws make a difference?

“It’s tough to legislate excellence – it’s better to [identify] a result, and letting organizations figure out what works for them to get to that result,” Bejtlich said. “These delays are a sign of a broken process, a lack of forensic capability and a lack of data to analyze. It takes a multi-million-dollar program to protect a large enterprise against a well-sourced enemy. A lot of agencies and non-top-tier defense contractors don’t have the DOD or [intelligence community] resources; they’re really struggling.”

About the Author

Amber Corrin is a former staff writer for FCW and Defense Systems.

The Fed 100

Read the profiles of all this year's winners.


  • Then-presidential candidate Donald Trump at a 2016 campaign event. Image: Shutterstock

    'Buy American' order puts procurement in the spotlight

    Some IT contractors are worried that the "buy American" executive order from President Trump could squeeze key innovators out of the market.

  • OMB chief Mick Mulvaney, shown here in as a member of Congress in 2013. (Photo credit Gage Skidmore/Flickr)

    White House taps old policies for new government makeover

    New guidance from OMB advises agencies to use shared services, GWACs and federal schedules for acquisition, and to leverage IT wherever possible in restructuring plans.

  • Shutterstock image (by Everett Historical): aerial of the Pentagon.

    What DOD's next CIO will have to deal with

    It could be months before the Defense Department has a new CIO, and he or she will face a host of organizational and operational challenges from Day One

  • USAF Gen. John Hyten

    General: Cyber Command needs new platform before NSA split

    U.S. Cyber Command should be elevated to a full combatant command as soon as possible, the head of Strategic Command told Congress, but it cannot be separated from the NSA until it has its own cyber platform.

  • Image from Shutterstock.

    DLA goes virtual

    The Defense Logistics Agency is in the midst of an ambitious campaign to eliminate its IT infrastructure and transition to using exclusively shared, hosted and virtual services.

  • Fed 100 logo

    The 2017 Federal 100

    The women and men who make up this year's Fed 100 are proof positive of what one person can make possibile in federal IT. Read on to learn more about each and every winner's accomplishments.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group