Sen. Ben Cardin, D-Md., will introduce a bill. Cliff Owen/AP
Lawmaker Pledges Legislation to Better Protect Hacked Feds as Another Union Sues OPM
Senator looks to boost credit monitoring and increase loss limits.
This story has been updated.
A Democratic senator will soon introduce legislation to give current and former federal employees, and other individuals affected by the breach of personal information maintained by the Office of Personnel Management, more protections from financial fraud than the government has already offered.
A spokeswoman for Sen. Ben Cardin, D-Md., said on Wednesday the details of the bill -- such as the length of the free credit monitoring, the cap on the insurance affected individuals could claim if their identity was stolen and how those services would be paid -- are still being worked out, but the senator plans to unveil the bill in the coming days. Currently, OPM has offered 18 months of credit monitoring and up to $1 million of identity theft insurance.
The bill would “better protect all individuals affected by the OPM data breach,” a spokeswoman said. Del. Eleanor Holmes Norton, D-D.C., is working on similar legislation in the House.
Cardin’s plans comes as the National Treasury Employees Union announced on Wednesday it has also filed a lawsuit against OPM Director Katherine Archuleta in federal district court in California. In addition to seeking injunctive relief mandating OPM shore up its data protections and that the agency stop collecting NTEU members’ personal information digitally until those protections have been put in place, the union is seeking free lifetime credit monitoring and identity theft protection for its members.
“Federal employees entrust highly personal information to OPM with the expectation that it will be kept confidential and safe from unauthorized access,” said NTEU National President Colleen M. Kelley. “OPM’s failure to do so violated our members’ constitutional right to informational privacy. We believe that a lawsuit is the best way to force OPM to take immediate steps to safeguard personnel data, prevent such attacks in the future and help our members protect themselves against the fallout.”
The lawsuit is entirely separate from the legal action taken by the American Federation of Government Employees, which filed suit in June. NTEU President Colleen Kelley said its case follows a “different legal theory” than the case presented by AFGE.
Whereas AFGE is relying on the 1974 Privacy Act to make its claim, NTEU is pointing to the Fifth Amendment to the U.S. Constitution as its legal basis that federal employees have a right to informational privacy. Greg O’Duden, NTEU’s general counsel, said it is “very difficult” to prevail in court under the Privacy Act. Additionally, NTEU is filing its claim only on behalf of its 150,000 members, while AFGE filed its class action suit on behalf of all 4.2 million individuals affected by the initial hack.
Federal employee groups have for weeks called on OPM to boost the services provided to hacked employees, as well as more transparency on the full extent of the breach.
At a congressional hearing on Wednesday, government auditors eviscerated OPM for its lax security and lackluster response to the hack. Michael Esser, OPM’s assistant inspector general, told members of the House Science, Space and Technology Committee’s Research and Technology panel OPM had an “historical negligence of IT security.” He added OPM’s decision to just now shut down e-QIP demonstrates the agency’s inability follow guidance from auditors.
Gregory Wilshusen, director of information security issues at the Government Accountability Office, gave the federal government a “D” grade on federal IT security, saying agencies have a long way to go to reach the standards set by Federal Information Security Management Act and other statutes.
Lawmakers continued to criticize OPM’s handling of the breach, with several committee members saying the agency “failed in its responsibility” to protect the personal information of the federal workforce.
Rep. Lamar Smith, R-Texas, noted Archuleta saying in a previous hearing that no one at OPM was “personally responsible” for the breach.
“That is not believable,” Smith said. “In fact it’s an insult to the American people who pay her salary.”