Most Sensitive Data on Government Laptops Unencrypted

by Grant Gross

Only 30 percent of sensitive information stored on U.S. government laptops and mobile devices, including the personal information of U.S. residents, was encrypted a year ago, despite a series of data breaches at government agencies in recent years, according to an auditor's report.

The report, by the U.S. Government Accountability Office, found that 70 percent of sensitive information held on laptops and mobile devices at 24 major U.S. agencies was unencrypted as of last September. The GAO report defined several types of data as sensitive, including personal medical records, other personal information, law enforcement data and records essential for homeland security.

"While all agencies have initiated efforts to deploy encryption technologies, none had documented comprehensive plans to guide encryption implementation activities," the report said. "As a result federal information may remain at increased risk of unauthorized disclosure, loss, and modification."

The report follows a series of security mishaps by U.S. government agencies in recent years. In March 2007, the U.S. Internal Revenue Service reported that 490 laptops went missing or were stolen in a three-year period. It was likely that many of those laptops contained personal information about U.S. taxpayers, according to an IRS auditor's report.

In September 2006, the U.S. Department of Commerce reported that 1,137 laptops were lost or stolen since 2001, with 249 of them containing some personal data. Other U.S. agencies also reported missing or stolen laptops.

In May 2006, the Department of Veterans Affairs reported that a laptop and hard drive containing personal information of 26.5 million military veterans and their spouses was stolen from the home of an employee at the agency. Law enforcement officers recovered the hardware, and the agency began encrypting its laptops later that year.

The GAO report notes that several laws, including the Federal Information Security Management Act (FISMA) of 2002, require agencies to protect their data. In addition, the White House Office of Management and Budget (OMB) first recommended in 2006, then required in May 2007, that agencies encrypt all sensitive data on mobile computers.

But the OMB mandate and the GAO report largely miss a larger need for information security in the U.S. government, said Phil Dunkelberger, CEO of PGP, a vendor of encryption and other security products, in an interview. The U.S. government needs to focus on a broader approach to cybersecurity, including better protection of data on government networks, he said.

"When are we going to get serious about protecting data -- role-based and policy-based encryption, not just device encryption?" he said. "Until we're serious about taking a strategic view of data ... we're not going to have a big impact."

Even if laptops are encrypted, the government still faces security problems with removable media such as thumb drives, he added. And many U.S. agencies face challenges with finding time to encrypt thousands of laptops and with managing encryption keys once devices are encrypted, he said.

Many government devices may be too old to use recent encryption technology, and government workers may be using nonstandard devices for accessing sensitive information, Dunkelberger added. With all those issues, Dunkelberger said he's not surprised by the GAO report.
The U.S. government has "very well-intentioned mandates to secure data, and yet, the way they've gone about it is kind of a fallacy," Dunkelberger added. "The idea that you can send out a circular from OMB and suddenly, everything magically gets fixed ... is a completely wrong expectation."

Two democratic members of the U.S. House of Representatives Homeland Security Committee said they were disappointed with U.S. agency encryption efforts. The committee announced the GAO report late Monday.

"Encryption is not an option, it is a mandate," Representative Bennie Thompson, a Mississippi Democrat and chairman of the committee, said in a statement. "Unfortunately, I'm not surprised that despite mandates by OMB, the federal government is only 30 percent of the way there. Making the right investments in cybersecurity today will keep us from paying dearly in the long run."

Federal agencies "lag far behind the private sector" in protecting and encrypting data, Representative Zoe Lofgren, a California Democrat, added in a statement. "I'm concerned that our government is not moving fast enough in its efforts to secure its systems and procedures," she added.