Federal data breaches: How long is too long to inform victims?

Negotiating data breaches can mean a tricky balancing act for government agencies. There’s the need to secure information, determine what has happened, alert potential victims and face the public relations firestorm that, if it’s a big enough problem, will ensue. With so many different competing priorities, what’s the right way?

In the Twitter era – when an incident can be publicized to millions within seconds, by just about anyone – it’s difficult to weigh transparency demands against the internal chaos that follows a data breach. Over the past years it’s a struggle a number of federal agencies have had to face. Case in point: This summer, the Environmental Protection Agency admitted their servers had been hacked in a breach that affected some 8,000 users. It took five months for the EPA to come forward with the information.

What took so long? Why the lack of clarity?

According to cybersecurity experts and other inside sources, it takes time to determine what has actually happened. It doesn’t help that there is little in the way of a legal blueprint for dealing with such events.

“What’s going on is that once it’s discovered, there’s a bunch of corrective action happening. They’re figuring out exactly how it was done so they can plug that hole. Many vendors are selling in the broader marketplace, so they have to determine if they’re doing the same thing in, say, the financial sector and if they need to take time to go correct that as well,” said Trey Hodgkins, TechAmerica senior vice president of global public sector government affairs.

According to Hodgkins, that delay is necessary for adequate protection of a number of different interests.

“Much of [the delay] is designed to protect the economic structure of the U.S. If there’s a vulnerability that’s used in the defense industrial base, but it’s also the same practice or technology that’s deployed in other areas…we don’t want to disclose how it happened and then someone say, ‘Oh, look, we can go over here and get all this information,” he said. “That’s generally why there’s a lag – because this corrective action needs to be taken to make sure the damage isn’t worse and more bad actors don’t discover avenues to get in.”

There are also legal concerns, and there can be questions about what has actually happened. Recently, the FBI was said to have been breached by the hacker group Anonymous, resulting in the release of a million Apple user IDs. The FBI denied any of their computers or information had been stolen, and on Sept. 10 – nearly a week after the story broke – the New York Times reported that Orlando-based company Blue Toad said they had been the victims of the breach.

“Some organizations have internal battles over saying something, whether they can definitively say data was taken; maybe wait to see if the information is used,” said Richard Bejtlich, chief security officer at Mandiant. “A lot of the time you’re not trying to figure out how they got in, but where they are and how much of the enterprise they have. Then it becomes a matter of containment, clean-up and investigation of when the [incident] started.”

But what are agencies required to say about data breaches? There are state-by-state requirements, but so far no uniform standard. Some states require that breaches don’t have to be reported if the information stolen was encrypted; others have to report even encrypted-data theft, Bejtlich said. At the Defense Department, most contracts have provisions for the reporting of breaches to the contract authority or an organization like the Defense Security Service.

Other data security statutes are so outdated, they were written before the Internet era – and are more than ready for a re-write, Hodgkins pointed out.

“The data breach discussion is one of the elements proposed for reform…if you look at many of the statutes, they were passed decades before the Internet existed. Disclosing to someone when things happen – the framework was designed before we had the Internet. The concept that your data would be stolen that way was foreign. That’s the policy debate we’ve been having for some time – what would data breach legislation look like?” he said.

Hodgkins noted that the failed Cybersecurity Act of 2012 included some provisions addressing the issue, which he said he expects will be tackled again in the next Congress, even if not in the form of all-encompassing legislation.

“When you reach this kind of an impasse, it’s time to start looking at breaking things up and starting to pass them individually. Then you actually can move the needle – maybe not in one big chunk, but you can substantially move the needle if you pass any one of these different elements, focusing on one given piece,” Hodgkins said.

But will more laws make a difference?

“It’s tough to legislate excellence – it’s better to [identify] a result, and letting organizations figure out what works for them to get to that result,” Bejtlich said. “These delays are a sign of a broken process, a lack of forensic capability and a lack of data to analyze. It takes a multi-million-dollar program to protect a large enterprise against a well-sourced enemy. A lot of agencies and non-top-tier defense contractors don’t have the DOD or [intelligence community] resources; they’re really struggling.”

About the Author

Amber Corrin is a former staff writer for FCW and Defense Systems.

The Fed 100

Save the date for 28th annual Federal 100 Awards Gala.

Featured

  • computer network

    How Einstein changes the way government does business

    The Department of Commerce is revising its confidentiality agreement for statistical data survey respondents to reflect the fact that the Department of Homeland Security could see some of that data if it is captured by the Einstein system.

  • Defense Secretary Jim Mattis. Army photo by Monica King. Jan. 26, 2017.

    Mattis mulls consolidation in IT, cyber

    In a Feb. 17 memo, Defense Secretary Jim Mattis told senior leadership to establish teams to look for duplication across the armed services in business operations, including in IT and cybersecurity.

  • Image from Shutterstock.com

    DHS vague on rules for election aid, say states

    State election officials had more questions than answers after a Department of Homeland Security presentation on the designation of election systems as critical U.S. infrastructure.

  • Org Chart Stock Art - Shutterstock

    How the hiring freeze targets millennials

    The government desperately needs younger talent to replace an aging workforce, and experts say that a freeze on hiring doesn't help.

  • Shutterstock image: healthcare digital interface.

    VA moves ahead with homegrown scheduling IT

    The Department of Veterans Affairs will test an internally developed scheduling module at primary care sites nationwide to see if it's ready to service the entire agency.

  • Shutterstock images (honglouwawa & 0beron): Bitcoin image overlay replaced with a dollar sign on a hardware circuit.

    MGT Act poised for a comeback

    After missing in the last Congress, drafters of a bill to encourage cloud adoption are looking for a new plan.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group