Original URL: http://www.theregister.co.uk/2000/09/12/congress_slams_us_govt_net/

Congress slams US Govt net security, privacy

Easy pickings for the malicious or the criminal

By Thomas C Greene

Posted in Media, 12th September 2000 16:32 GMT

Congress' investigative arm, the General Accounting Office (GAO), is proving to be a thorn in the side of US government information administrators, having the audacity to go out and actually test federal agencies' network security and Web site privacy controls.

The vast majority of federal Web sites fail to achieve Federal Trade Commission (FTC) standards for Internet privacy, and this, ironically, includes the FTC's own Web site.

The GAO measured 65 of the government's most popular Web sites on four criteria: adequate notice of privacy practices, user choice in disclosing information, the ability to change personal information, and assurance that information is stored securely. The GAO found that only a piddling three per cent of federal sites pass on all the criteria.

"You are required to give information to the government - you have no choice. You don't have to use a commercial Web site if you feel it has a bad privacy policy. Which worries you more?" US Representative Dick Armey (Republican, Texas), who ordered the survey, asked rhetorically.

As for network security, the US government lags far behind the private sector with numerous glaring deficiencies, the GAO found.

The House Government Reform Subcommittee on Technology convened hearings Monday to consider the implications of the GAO report on network security. Committee Chairman Stephen Horn (Republican California) issued a report card on which several agencies which handle extremely sensitive data scored miserably. The Departments of Defence and the Treasury received a D plus and a D, while the Departments of Justice, Labour, and Health and Human Services all received an F.

"Our auditors have been successful, in almost every test, in readily gaining unauthorized access that would allow intruders to read, modify or delete data for whatever purpose they have in mind," the GAO report said.

"The underlying problem is poor security programme management and poor administration of available control techniques," the GAO concluded.

Many of the security problems could be addressed with basic, common-sense hygiene, like changing passwords regularly and shutting down PCs and workstations after working hours, Chairman Horn said. "That doesn't cost a thing," he observed.

"The amount of detailed information about private citizens in federal files has grown by leaps and bounds," CATO Institute Information Studies Director Solveg Singleton noted during the hearing.

"The growth of these databases makes security and the need for internal controls against unauthorised use by government employees a systemic rather than an occasional problem" which "threatens to shift the balance of power between individuals and the federal government," she observed.

The twin GAO reports are, or soon will be, available for download from the reports page on the GAO Web site. ®