Data held by feds, vendors at risk

Federal contractors that agencies rely on for IT management services are responsible for many of the data breaches that agencies reported to the House Government Reform Committee, which today released its findings on past data loss across government.That is just one of the conclusions from the committee staff , which also found that data loss occurs in all major agencies, and that those agencies don’t always know what was lost.Following a flood of data breaches earlier this year, committee chairman Tom Davis (R-Va.) a summary from major agencies about past data losses over the past three years.Agencies, who also notified those potentially affected by the breaches, reported these and other data losses in the report:“The agency responses show a wide range of incidents involving data loss or theft, privacy breaches and security incidents. Agency responses to data losses appear to vary as well, with some notifying all potentially affected individuals, and others not performing such notifications,” said committee spokesman Dave Marin.The agency reports to the committee varied in level of detail, so this report cannot be seen as a comprehensive review of data loss by federal agencies, Marin added.In addition to not knowing what information has been lost or how many individuals could be affected by a particular data loss, agencies do not appear to be tracking all possible losses of personal information. That makes it likely that their reports to the committee are incomplete, according to Marin. For example, prior to the May 2006 Veterans Affairs Department data breach, the Justice Department reported that "it did not track the content of lost, stolen, or otherwise compromised devices," Marin said.Despite the volume of sensitive information held by agencies, there is no requirement that the public be notified if their sensitive personal information is compromised. The House recently the Veterans Identity and Credit Security Act of 2006, which includes legislation that Davis authored, that would strengthen federal security requirements and provide for notification.Only a small number of the data breaches reported to the committee were caused by hackers breaking into computer systems online. The vast majority arose from physical theft of portable computers, drives and disks, or from unauthorized use of data by employees, the report said.In a related action, the House Government Reform Committee today also sent a letter to agencies seeking information about the risk posed by inappropriate Internet use by federal employees.The request came on the heels of findings by the Interior Department’s Office of Inspector General that agency employees have accessed sexually explicit, gambling, gaming and auction Web sites at a high rate. By Oct. 27, agencies are to inform the committee: