DHS Exempts Expanded Insider Threat Program From Key Privacy Act Provisions

The Homeland Security Department has instituted a new, broadened insider threat program that covers anyone who has ever touched agency data or systems and, on Tuesday, will finalize a rule exempting that expanded system from several provisions in a key privacy law.

In June, DHS security officials announced a policy change expanding the purview of its insider threat program beyond security clearance holders with access to top-level information. Under the new rule, all DHS employees—past and present—as well as contractors and anyone else with access to agency systems are now covered under the Insider Threat Program. The policy update also greatly expands the kind, amount and sources of data the program can legally collect.

Now, the department is finalizing a rule exempting parts of the program and mass data collection from provisions under the Privacy Act.

Per a 2016 memo from DHS Chief Security Officer Richard McComb, sensitive information is at risk of being exposed by more than just security clearance holders with a grudge.

Rather than focus on only the most protected information, McComb and then-Homeland Security Secretary Jeh Johnson agreed the program should be expanded “to include the threats posed to the department by all individuals with access to the department’s facilities, information, equipment, networks or systems,” with or without security clearances, and regardless of whether the individual is a DHS employee, contractor or member of the public.

“Originally, the ITP focused on the detection, prevention, and mitigation of unauthorized disclosure of classified information by DHS personnel with active security clearances,” according to a privacy impact assessment published in June. “The memorandum expands the scope of the ITP to its current breadth: threats posed to the department by all individuals who have or had access to the department’s facilities, information, equipment, networks, or systems.”

Along with the wider focus, the Insider Threat Program will also cast a wider net in its own data collection for investigations.

New information sources include “any DHS component, office, program, record or source, including records from information security, personnel security and systems security for both internal and external security threats,” as well as data “lawfully obtained” through “access from any United States government agency, other domestic or foreign government entity, and from a private sector entity,” the PIA states.

The new data collections will include “current employment and performance information, contract information, personnel files containing information about misconduct and adverse actions, and current and former security clearance status,” according to the document.

That added data collection brings with it new privacy concerns, which the agency attempts to address in the PIA. However, those collections, at times, will run afoul of the Privacy Act, prompting DHS to seek exemptions.

The agency published a proposed rule in March exempting portions of the system of record from laws enacted under the Privacy Act, including:

• A provision preventing an agency or program from sharing data on an individual without that individual’s consent.
• A requirement to allow an individual to review and request amendments to data about their person.
• Informing a person that information is being collected and what that information is.
• Informing individuals and the public about data sharing—matching—agreements with other organizations.
• Preventing over-collection of data that is not relevant to the mission—in this case, preventing disclosure of protected information.

DHS officials argued that the first four privacy protections cannot be followed, as that would alert the subject of an investigation to the existence of an investigation.

With regard to the last issue, officials said it is not always clear what data will be relevant at the time it is collected, and limitations due to relevance would hamstring investigations.

“With the collection of information for law enforcement purposes, it is impossible to determine in advance what information is accurate, relevant, timely, and complete,” the final rule states. “Compliance … would preclude DHS agents from using their investigative training and exercise of good judgment to both conduct and report on investigations.”

The program will also carry over exemptions for data collected by other agencies and systems, the document states.

The proposed rule received six comments from the public, four of which DHS officials determined were out of scope as “regarding the collection of information by DHS generally, and not specific to the Insider Threat Program system of records,” according to the latest Federal Register notice set to publish Tuesday.

The other two comments were more germane to the issue at hand, one focused on the proposed rule and the other on the system of record itself.

The first relevant comment pertained to the rule change exempting the program from the aspects of the Privacy Act cited above.

“In short, the comment argues that DHS’s proposed use of these exemptions would circumvent Privacy Act safeguards and contravene legislative intent by permitting DHS to collect records that are not relevant and necessary, failing to disclose its sources of records, and preventing individuals from accessing and amending their records,” according to a summary included in the final rule notice.

In the final rule notice, officials cite the PIA, which broaches this issue but says the violations of the Privacy Act are justified by necessity and claims internal DHS policies will prevent potential abuses.

“DHS believes the explanations and justifications provided in the [notice of proposed rulemaking] and this final rule fully support DHS’s uses of these exemptions,” the document states.

With regard to the proposed data collection, a commenter made three suggestions: that DHS minimize the amount of data collected, citing the potential for data breaches; exclude collecting information on “individuals and relevant personal associations, including those not under investigation by DHS;” and prohibit the use of data for purposes other than intended at the time of collection—i.e., don’t use information submitted for health insurance eligibility for insider threat determinations.

Ultimately, DHS thanked the public for the input but made no changes.

“DHS appreciates the public comment and strives to be transparent regarding all insider threat collections. After consideration of the public comment, DHS has determined that the [system of records notice] should remain in place,” the document states, offering no other details.