Spending bill targets passport data security

The Senate Appropriations Committee has approved a funding measure that would withhold about $400 million for the State Department’s Border Security program until the department follows recommendations for improving the security of personal information contained in passport files.In March, it became public that three contractors and a State employee snooped into the passport files of three major presidential candidates. The revelation prompted outrage from the candidates, privacy advocates and lawmakers, and prompted an investigation from the department's inspector general.The results of that investigation, released this month, found “many control weaknesses — including a general lack of policies, procedures, guidance and training — relating to the prevention and detection of unauthorized access to passport and applicant information and the subsequent response and disciplinary processes when a potential unauthorized access is substantiated.”The report made 22 recommendations for how the Bureau of Consular Affairs could improve access controls for information contained in the Passport Information Electronic Records System, which contains records on about 192 million passports.The funding measure, approved by the appropriations panel July 17, threatens to withhold 20 percent of the more than $2.1 billion generated by fees collected from issuing passports and other services that would be made available to State in 2009 if the department does not implement all of the recommendations.The six recommendations that were listed in the public version of the IG's report state the consular affairs bureau should:• Develop a comprehensive strategy for preventing and detecting unauthorized access and consider controls that other agencies have used.• Work with State's Bureau of Human Resources to determine the feasibility of establishing specific disciplinary guidelines for snooping in passport files.• Review the privacy impact assessments for the agency’s passport systems.• Work with State's Bureau of Administration to conduct vulnerability and risk assessments for all passport systems and report the results to the department's Bureau of Information Resource Management.• Review memorandums of agreements and memorandums of understanding (MOUs) to make sure that they address passport data security adequately.• Develop policies that address third-party disclosure requirements and breaches and include them in MOUs.The committee's funding measure also supports the Bush administration’s request for a $100 million boost to the department’s Information Technology Central Fund. Specifically, the committee recommended a focus on IT security and further integration with other agencies, particularly the Defense Department and the U.S. Agency for International Development.Overall, the funding measure would provide $36.8 billion for State's programs — about $1.6 billion less than the president requested.