Justice IG finds fault with encryption practices

room of computers

A Justice Department component is not following encryption policies and practices regarding laptop computers and electronic tablets that store sensitive and potentially classified data, according to an audit issued March 20 by DOJ Inspector General Michael Horowitz.

The audit identified several weaknesses in the Executive Office for the United States Attorneys’ (EOUSA) adherence to whole-disk encryption on employee, contractor and subcontractor laptops and electronic tablets. The audit examined 120 of 10,790 EOUSA-owned laptops and found six used for unclassified processing were not encrypted. More troubling, according to the IG, is that the laptops in question were for “special purposes” such as jury duty use  and were labeled to identify those purposes. The report found no policies in place to limit the use of the unencrypted laptops to those uses, either.

In addition, the audit sifted through three encryption monitoring scans conducted by EOUSA’s Information Systems Security team and found that eight laptops remained unencrypted for more than one year after they were first identified as such.

Recent headlines involving large private-sector companies, the Department of Veterans Affairs, the Internal Revenue Service and other agencies over information security vulnerabilities, unencrypted laptops and data breaches have put an emphasis on agencies shoring up vulnerabilities before they’re exposed in very public fashion.

“We believe that EOUSA’s lack of encryption on some of its classified devices, in addition to poor inventory management, allow for the potential loss of classified information,” the audit states. “Further, without formal and enforced Security Authorization of classified laptops, EOUSA is not able to maintain appropriate oversight to prevent the unauthorized disclosure, modification, or destruction of classified information. We recommend EOUSA implement procedures to ensure that accurate, current, and reliable information is maintained in an official inventory for unclassified and classified equipment to help EOUSA to ensure that all required laptops are encrypted and deployed in compliance with DOJ policy.”

The IG detailed a variety of other weaknesses in EOUSA’s compliance with DOJ information security guidelines, including: an incomplete equipment inventory; failure to create policies to minimize security risks from the use of tablets under a pilot program; and allowing contractors “to process department data on unencrypted equipment.”

An encryption waiver that once allowed that practice expired in 2011, according to the audit. The audit also found that oversight of contractors was “inconsistent,” and that some department data was not sufficiently monitored, “thereby increasing the risk of data loss.”

In response, the IG made 13 initial recommendations to EOUSA, one of which the IG closed. The office’s response, authored by Norman Wong, deputy director and counsel to the director for EOUSA, was swift: EOUSA agreed with the remaining 12 recommendations and is currently implementing corrective action.

About the Author

Frank Konkel is a former staff writer for FCW.


  • Congress
    U.S. Capitol (Photo by M DOGAN / Shutterstock)

    Funding bill clears Congress, heads for president's desk

    The $1.3 trillion spending package passed the House of Representatives on March 22 and the Senate in the early hours of March 23. President Trump is expected to sign the bill, securing government funding for the remainder of fiscal year 2018.

  • 2018 Fed 100

    The 2018 Federal 100

    This year's Fed 100 winners show just how much committed and talented individuals can accomplish in federal IT. Read their profiles to learn more!

  • Census
    How tech can save money for 2020 census

    Trump campaign taps census question as a fund-raising tool

    A fundraising email for the Trump-Pence reelection campaign is trying to get supporters behind a controversial change to the census -- asking respondents whether or not they are U.S. citizens.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.