Most sensitive data on government laptops unencrypted

Only 30 percent of sensitive information stored on U.S. government laptops and mobile devices, including the personal information of U.S. residents, was encrypted a year ago, despite a series of data breaches at government agencies in recent years, according to an auditor's report.

The report, by the U.S. Government Accountability Office, found that 70 percent of sensitive information held on laptops and mobile devices at 24 major U.S. agencies was unencrypted as of last September. The GAO report defined several types of data as sensitive, including personal medical records, other personal information, law enforcement data and records essential for homeland security.

"While all agencies have initiated efforts to deploy encryption technologies, none had documented comprehensive plans to guide encryption implementation activities," the report said. "As a result federal information may remain at increased risk of unauthorized disclosure, loss, and modification."

The report follows a series of security mishaps by U.S. government agencies in recent years. In March 2007, the U.S. Internal Revenue Service reported that 490 laptops went missing or were stolen in a three-year period. It was likely that many of those laptops contained personal information about U.S. taxpayers, according to an IRS auditor's report.

In September 2006, the U.S. Department of Commerce reported that 1,137 laptops were lost or stolen since 2001, with 249 of them containing some personal data. Other U.S. agencies also reported missing or stolen laptops.

In May 2006, the Department of Veterans Affairs reported that a laptop and hard drive containing personal information of 26.5 million military veterans and their spouses was stolen from the home of an employee at the agency. Law enforcement officers recovered the hardware, and the agency began encrypting its laptops later that year.

The GAO report notes that several laws, including the Federal Information Security Management Act (FISMA) of 2002, require agencies to protect their data. In addition, the White House Office of Management and Budget (OMB) first recommended in 2006, then required in May 2007, that agencies encrypt all sensitive data on mobile computers.

But the OMB mandate and the GAO report largely miss a larger need for information security in the U.S. government, said Phil Dunkelberger, CEO of PGP, a vendor of encryption and other security products, in an interview. The U.S. government needs to focus on a broader approach to cybersecurity, including better protection of data on government networks, he said.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine