Federal data breaches: How long is too long to inform victims?

Negotiating data breaches can mean a tricky balancing act for government agencies. There’s the need to secure information, determine what has happened, alert potential victims and face the public relations firestorm that, if it’s a big enough problem, will ensue. With so many different competing priorities, what’s the right way?

In the Twitter era – when an incident can be publicized to millions within seconds, by just about anyone – it’s difficult to weigh transparency demands against the internal chaos that follows a data breach. Over the past years it’s a struggle a number of federal agencies have had to face. Case in point: This summer, the Environmental Protection Agency admitted their servers had been hacked in a breach that affected some 8,000 users. It took five months for the EPA to come forward with the information.

What took so long? Why the lack of clarity?

According to cybersecurity experts and other inside sources, it takes time to determine what has actually happened. It doesn’t help that there is little in the way of a legal blueprint for dealing with such events.

“What’s going on is that once it’s discovered, there’s a bunch of corrective action happening. They’re figuring out exactly how it was done so they can plug that hole. Many vendors are selling in the broader marketplace, so they have to determine if they’re doing the same thing in, say, the financial sector and if they need to take time to go correct that as well,” said Trey Hodgkins, TechAmerica senior vice president of global public sector government affairs.

According to Hodgkins, that delay is necessary for adequate protection of a number of different interests.

“Much of [the delay] is designed to protect the economic structure of the U.S. If there’s a vulnerability that’s used in the defense industrial base, but it’s also the same practice or technology that’s deployed in other areas…we don’t want to disclose how it happened and then someone say, ‘Oh, look, we can go over here and get all this information,” he said. “That’s generally why there’s a lag – because this corrective action needs to be taken to make sure the damage isn’t worse and more bad actors don’t discover avenues to get in.”

There are also legal concerns, and there can be questions about what has actually happened. Recently, the FBI was said to have been breached by the hacker group Anonymous, resulting in the release of a million Apple user IDs. The FBI denied any of their computers or information had been stolen, and on Sept. 10 – nearly a week after the story broke – the New York Times reported that Orlando-based company Blue Toad said they had been the victims of the breach.

“Some organizations have internal battles over saying something, whether they can definitively say data was taken; maybe wait to see if the information is used,” said Richard Bejtlich, chief security officer at Mandiant. “A lot of the time you’re not trying to figure out how they got in, but where they are and how much of the enterprise they have. Then it becomes a matter of containment, clean-up and investigation of when the [incident] started.”

But what are agencies required to say about data breaches? There are state-by-state requirements, but so far no uniform standard. Some states require that breaches don’t have to be reported if the information stolen was encrypted; others have to report even encrypted-data theft, Bejtlich said. At the Defense Department, most contracts have provisions for the reporting of breaches to the contract authority or an organization like the Defense Security Service.

Other data security statutes are so outdated, they were written before the Internet era – and are more than ready for a re-write, Hodgkins pointed out.

“The data breach discussion is one of the elements proposed for reform…if you look at many of the statutes, they were passed decades before the Internet existed. Disclosing to someone when things happen – the framework was designed before we had the Internet. The concept that your data would be stolen that way was foreign. That’s the policy debate we’ve been having for some time – what would data breach legislation look like?” he said.

Hodgkins noted that the failed Cybersecurity Act of 2012 included some provisions addressing the issue, which he said he expects will be tackled again in the next Congress, even if not in the form of all-encompassing legislation.

“When you reach this kind of an impasse, it’s time to start looking at breaking things up and starting to pass them individually. Then you actually can move the needle – maybe not in one big chunk, but you can substantially move the needle if you pass any one of these different elements, focusing on one given piece,” Hodgkins said.

But will more laws make a difference?

“It’s tough to legislate excellence – it’s better to [identify] a result, and letting organizations figure out what works for them to get to that result,” Bejtlich said. “These delays are a sign of a broken process, a lack of forensic capability and a lack of data to analyze. It takes a multi-million-dollar program to protect a large enterprise against a well-sourced enemy. A lot of agencies and non-top-tier defense contractors don’t have the DOD or [intelligence community] resources; they’re really struggling.”