DoD orders review of Web sites

Deputy Secretary of Defense John Hamre Friday ordered all Defense Department agencies to conduct a review of information placed on publicly accessible Web sites to ensure it doesn't compromise national security or place DoD employees at risk.

Although Hamre said the Internet has allowed the department to "embrace a revolution in business affairs," he also noted that the Internet may provide U.S. adversaries with a "potent instrument" to obtain information on defense personnel and activities.

"Recently I have become aware that some information provides too much detail on DoD capabilities, infrastructure, personnel and operational procedures," Hamre said in announcing the directive. "Such details, especially when combined with information from other sources, may increase the vulnerability of DoD systems and potentially be used to threaten or harass DoD personnel and their families."

Hamre said his primary concern is the possibility of service members' personal and private information, such as Social Security numbers or home addresses, being posted to publicly accessible sites.

Hamre's order includes the following steps:

• Creation of a task force to develop a security policy for DoD sites. The task force, which will report to the Office of the Assistant Secretary of Defense, is to issue preliminary guidance by November.
• Security assessments of Web sites by each DoD component, to be conducted within three months of receiving the task force guidance.
• Development of a training program on Web information security issues by March 1999.
• Development and implementation of a computer architecture enhancing the protection of sensitive but unclassified information.

• Plans or lessons learned which would reveal sensitive military operations or vulnerabilities.
• Information on sensitive movements of military assets or the location of units, installations, or personnel where uncertainty regarding location is an element of the security of a military plan.
• Personal data such as Social Security numbers, dates of birth and home addresses.

"Security and efficiency can be achieved at the same time," he said.