Reports of federal security breaches double in four months

Federal agencies report an average of 30 incidents a day in which Americans' personally identifiable information is exposed, double the number of incidents reported early this summer, according to the top information technology executive in the Bush administration.

The Office of Management and Budget issued a memo in July 2006 requiring agencies to report security incidents that expose personally identifiable information to the U.S. Computer Emergency Readiness Team within one hour of the incident. By June 2007, 40 agencies reported almost 4,000 incidents, an average of about 14 per day. As of this week, the average had increased to 30 a day, said Karen Evans, administrator of the Office of Electronic Government and Information Technology at OMB.

Evans, who spoke Monday at the Executive Leadership Conference in Williamsburg, Va., an annual gathering of government and industry IT executives, attributed the increase to agencies conducting more thorough reporting on security breaches. "Agencies are erring on the side of [caution], reporting [incidents] first, and then getting more information," Evans said in an interview with Government Executive.

She added that only a small percentage of reported incidents pose a significant risk to Americans' personal information.

But the figure of 30 incidents a day concerned a chief information security officer for a large civilian agency attending the conference. "I was surprised by the number," the CISO said. He added that he reports an average of one security incident a week, which is typically caused by an employee who lost a BlackBerry. Since sensitive data is encrypted and handheld devices can be remotely turned off, the agency avoids security breaches that could result in exposure of personally identifiable information, the CISO said.

OMB's 2006 memo states that agencies should report all incidents involving personally identifiable information in electronic or paper form, and agencies should not distinguish between breaches that are suspected to have resulted in exposing personal information and those that agencies can confirm have resulted in exposing personal information.

"An increase in reporting isn't necessarily a bad thing," Evans said. "It means people don't want to end up on the front of the Washington Post. High [numbers of] reports reflect increased market awareness."

Stay up-to-date with federal news alerts and analysis — Sign up for GovExec's email newsletters.
FROM OUR SPONSORS
JOIN THE DISCUSSION
Close [ x ] More from GovExec
 
 

Thank you for subscribing to newsletters from GovExec.com.
We think these reports might interest you:

  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

    Download
  • The Big Data Campaign Trail

    With everyone so focused on security following recent breaches at federal, state and local government and education institutions, there has been little emphasis on the need for better operations. This report breaks down some of the biggest operational challenges in IT management and provides insight into how agencies and leaders can successfully solve some of the biggest lingering government IT issues.

    Download
  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

    Download
  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.

    Download
  • Ongoing Efforts in Veterans Health Care Modernization

    This report discusses the current state of veterans health care

    Download

When you download a report, your information may be shared with the underwriters of that document.