Cybersecurity

Justice IG finds fault with encryption practices

room of computers

A Justice Department component is not following encryption policies and practices regarding laptop computers and electronic tablets that store sensitive and potentially classified data, according to an audit issued March 20 by DOJ Inspector General Michael Horowitz.

The audit identified several weaknesses in the Executive Office for the United States Attorneys’ (EOUSA) adherence to whole-disk encryption on employee, contractor and subcontractor laptops and electronic tablets. The audit examined 120 of 10,790 EOUSA-owned laptops and found six used for unclassified processing were not encrypted. More troubling, according to the IG, is that the laptops in question were for “special purposes” such as jury duty use  and were labeled to identify those purposes. The report found no policies in place to limit the use of the unencrypted laptops to those uses, either.

In addition, the audit sifted through three encryption monitoring scans conducted by EOUSA’s Information Systems Security team and found that eight laptops remained unencrypted for more than one year after they were first identified as such.

Recent headlines involving large private-sector companies, the Department of Veterans Affairs, the Internal Revenue Service and other agencies over information security vulnerabilities, unencrypted laptops and data breaches have put an emphasis on agencies shoring up vulnerabilities before they’re exposed in very public fashion.

“We believe that EOUSA’s lack of encryption on some of its classified devices, in addition to poor inventory management, allow for the potential loss of classified information,” the audit states. “Further, without formal and enforced Security Authorization of classified laptops, EOUSA is not able to maintain appropriate oversight to prevent the unauthorized disclosure, modification, or destruction of classified information. We recommend EOUSA implement procedures to ensure that accurate, current, and reliable information is maintained in an official inventory for unclassified and classified equipment to help EOUSA to ensure that all required laptops are encrypted and deployed in compliance with DOJ policy.”

The IG detailed a variety of other weaknesses in EOUSA’s compliance with DOJ information security guidelines, including: an incomplete equipment inventory; failure to create policies to minimize security risks from the use of tablets under a pilot program; and allowing contractors “to process department data on unencrypted equipment.”

An encryption waiver that once allowed that practice expired in 2011, according to the audit. The audit also found that oversight of contractors was “inconsistent,” and that some department data was not sufficiently monitored, “thereby increasing the risk of data loss.”

In response, the IG made 13 initial recommendations to EOUSA, one of which the IG closed. The office’s response, authored by Norman Wong, deputy director and counsel to the director for EOUSA, was swift: EOUSA agreed with the remaining 12 recommendations and is currently implementing corrective action.

About the Author

Frank Konkel is a former staff writer for FCW.

Featured

  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.