Privacy ‘Incidents’ at DHS on the Rise, Report Says

A brand new authorities examine principally lauding the Homeland Security Department’s dealing with of Americans’ private info nonetheless detected “gaps” within the methods a couple of of its companies have adopted procedures designed to push back safety threats.

Analyzing information from six main DHS elements, a Government Accountability Office (GAO) report launched this month discovered sure IT techniques managed by third-party contractors are “at increased risk of misuse and insufficient protection” as a result of a handful of key safety insurance policies reportedly unfollowed at DHS headquarters and on the U.S. Coast Guard, the division’s solely army department.

“While contractor personnel who operate systems and provide services to federal agencies can provide significant benefits,” GAO stated, “they can also introduce risks to agency information and systems, such as the unauthorized access, use, disclosure, and modification of federal data.”

The report, requested by Sen. Margaret Hassan, chair of the Subcommittee on Emerging Threats and Spending Oversight, discovered that DHS elements such because the Federal Emergency Management Agency (FEMA) and Immigration and Customs Enforcement (ICE) have been largely following procedures designed to reduce dangers to the unprecedented quantities of personally identifiable info collected by its contractors. (Personally identifiable info, or “PII,” can embrace an individual’s identify, date of start, and Social Security quantity, together with details about their well being, funds, or employment.)

Still, the GAO discovered that DHS headquarters, which allotted $7.6 billion for IT spending final yr, had failed to supply important privateness coaching to its contractors, and that the Coast Guard had no documentation proving it was able to figuring out and addressing gaps in its personal safety; a lapse that GAO says locations contractor techniques “at increased risk of unauthorized disclosure.”

What’s extra, the congressional watchdog stated it remained unconvinced that both the Coast Guard or the Transportation Security Administration (TSA)—the DHS element mainly involved with air journey—had appropriate processes in place for evaluating whether or not and when to share private information with new contractors for the primary time; processes it describes as essential to lowering the percentages of abuse by contractors harnessing monumental volumes of private information.

The GAO issued a complete of seven suggestions, to which DHS totally agreed; nonetheless, DHS additionally requested that three of the suggestions be thought-about already in power. It supplied no documentation, GAO stated, that might assist a choice to do so. 

DHS didn’t reply to a request for remark earlier than press time. A spokesperson for Sen. Hassan couldn’t be instantly reached.

“Until DHS follows through on ensuring that components fully implement key privacy and remediation activities, PII is at increased risk of misuse and insufficient protection,” the GAO stated, noting that DHS, amongst different companies, have reported “increasing numbers of privacy incidents that have placed sensitive information at risk, with potentially serious impacts on federal operations, assets, and people.”

Data supplied by DHS additional revealed a 26% improve in so-called “privacy incidents” between 2015 and 2019, with a rise of greater than 140 “incidents” within the remaining yr. According to DHS, a “privacy incident,” is any occasion involving the “loss of control, compromise, unauthorized disclosure, [or] unauthorized acquisition” of confidential private information.

Inspector basic audits lately have discovered failures at DHS to adjust to fundamental cybersecurity requirements. A 2019 audit, for instance, assigned its safety program the bottom potential grade; “effectively a letter grade of F,” famous a Senate report, revealed in August. Twenty-six “high vulnerabilities” have been found at three DHS elements, the report stated, providing hackers a foothold in vital techniques internet hosting extremely delicate information.