Feeds

Congress slams US Govt net security, privacy

Easy pickings for the malicious or the criminal

  • alert
  • submit to reddit

The essential guide to IT transformation

Congress' investigative arm, the General Accounting Office (GAO), is proving to be a thorn in the side of US government information administrators, having the audacity to go out and actually test federal agencies' network security and Web site privacy controls.

The vast majority of federal Web sites fail to achieve Federal Trade Commission (FTC) standards for Internet privacy, and this, ironically, includes the FTC's own Web site.

The GAO measured 65 of the government's most popular Web sites on four criteria: adequate notice of privacy practices, user choice in disclosing information, the ability to change personal information, and assurance that information is stored securely. The GAO found that only a piddling three per cent of federal sites pass on all the criteria.

"You are required to give information to the government - you have no choice. You don't have to use a commercial Web site if you feel it has a bad privacy policy. Which worries you more?" US Representative Dick Armey (Republican, Texas), who ordered the survey, asked rhetorically.

As for network security, the US government lags far behind the private sector with numerous glaring deficiencies, the GAO found.

The House Government Reform Subcommittee on Technology convened hearings Monday to consider the implications of the GAO report on network security. Committee Chairman Stephen Horn (Republican California) issued a report card on which several agencies which handle extremely sensitive data scored miserably. The Departments of Defence and the Treasury received a D plus and a D, while the Departments of Justice, Labour, and Health and Human Services all received an F.

"Our auditors have been successful, in almost every test, in readily gaining unauthorized access that would allow intruders to read, modify or delete data for whatever purpose they have in mind," the GAO report said.

"The underlying problem is poor security programme management and poor administration of available control techniques," the GAO concluded.

Many of the security problems could be addressed with basic, common-sense hygiene, like changing passwords regularly and shutting down PCs and workstations after working hours, Chairman Horn said. "That doesn't cost a thing," he observed.

"The amount of detailed information about private citizens in federal files has grown by leaps and bounds," CATO Institute Information Studies Director Solveg Singleton noted during the hearing.

"The growth of these databases makes security and the need for internal controls against unauthorised use by government employees a systemic rather than an occasional problem" which "threatens to shift the balance of power between individuals and the federal government," she observed.

The twin GAO reports are, or soon will be, available for download from the reports page on the GAO Web site. ®

5 things you didn’t know about cloud backup

More from The Register

next story
Microsoft exits climate denier lobby group
ALEC will have to do without Redmond, it seems
Caught red-handed: UK cops, PCSOs, specials behaving badly… on social media
No Mr Fuzz, don't ask a crime victim to be your pal on Facebook
Barnes & Noble: Swallow a Samsung Nook tablet, please ... pretty please
Novelslab finally on sale with ($199 - $20) price tag
Ballmer leaves Microsoft board to spend more time with his b-balls
From Clippy to Clippers: Hi, I see you're running an NBA team now ...
Kate Bush: Don't make me HAVE CONTACT with your iPHONE
Can't face sea of wobbling fondle implements. What happened to lighters, eh?
Video of US journalist 'beheading' pulled from social media
Yanked footage featured British-accented attacker and US journo James Foley
True fact: 1 in 4 Brits are now TERRORISTS
YouGov poll reveals terrible truth about the enemy within
Assange™: Hey world, I'M STILL HERE, ignore that Snowden guy
Press conference: ME ME ME ME ME ME ME (cont'd pg 94)
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?