[House Hearing, 111 Congress]
[From the U.S. Government Publishing Office]
THE NATIONAL ARCHIVES' ABILITY TO SAFEGUARD THE NATION'S ELECTRONIC
RECORDS
=======================================================================
HEARING
before the
SUBCOMMITTEE ON INFORMATION POLICY,
CENSUS, AND NATIONAL ARCHIVES
of the
COMMITTEE ON OVERSIGHT
AND GOVERNMENT REFORM
HOUSE OF REPRESENTATIVES
ONE HUNDRED ELEVENTH CONGRESS
FIRST SESSION
__________
NOVEMBER 5, 2009
__________
Serial No. 111-63
__________
Printed for the use of the Committee on Oversight and Government Reform
Available via the World Wide Web: http://www.gpoaccess.gov/congress/
index.html
http://www.oversight.house.gov
----------
U.S. GOVERNMENT PRINTING OFFICE
57-622 PDF WASHINGTON : 2010
For sale by the Superintendent of Documents, U.S. Government Printing
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800;
DC area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC,
Washington, DC 20402-0001
COMMITTEE ON OVERSIGHT AND GOVERNMENT REFORM
EDOLPHUS TOWNS, New York, Chairman
PAUL E. KANJORSKI, Pennsylvania DARRELL E. ISSA, California
CAROLYN B. MALONEY, New York DAN BURTON, Indiana
ELIJAH E. CUMMINGS, Maryland JOHN L. MICA, Florida
DENNIS J. KUCINICH, Ohio MARK E. SOUDER, Indiana
JOHN F. TIERNEY, Massachusetts JOHN J. DUNCAN, Jr., Tennessee
WM. LACY CLAY, Missouri MICHAEL R. TURNER, Ohio
DIANE E. WATSON, California LYNN A. WESTMORELAND, Georgia
STEPHEN F. LYNCH, Massachusetts PATRICK T. McHENRY, North Carolina
JIM COOPER, Tennessee BRIAN P. BILBRAY, California
GERALD E. CONNOLLY, Virginia JIM JORDAN, Ohio
MIKE QUIGLEY, Illinois JEFF FLAKE, Arizona
MARCY KAPTUR, Ohio JEFF FORTENBERRY, Nebraska
ELEANOR HOLMES NORTON, District of JASON CHAFFETZ, Utah
Columbia AARON SCHOCK, Illinois
PATRICK J. KENNEDY, Rhode Island BLAINE LUETKEMEYER, Missouri
DANNY K. DAVIS, Illinois ANH ``JOSEPH'' CAO, Louisiana
CHRIS VAN HOLLEN, Maryland
HENRY CUELLAR, Texas
PAUL W. HODES, New Hampshire
CHRISTOPHER S. MURPHY, Connecticut
PETER WELCH, Vermont
BILL FOSTER, Illinois
JACKIE SPEIER, California
STEVE DRIEHAUS, Ohio
JUDY CHU, California
Ron Stroman, Staff Director
Michael McCarthy, Deputy Staff Director
Carla Hultberg, Chief Clerk
Larry Brady, Minority Staff Director
Subcommittee on Information Policy, Census, and National Archives
WM. LACY CLAY, Missouri, Chairman
CAROLYN B. MALONEY, New York PATRICK T. McHENRY, North Carolina
ELEANOR HOLMES NORTON, District of LYNN A. WESTMORELAND, Georgia
Columbia JOHN L. MICA, Florida
DANNY K. DAVIS, Illinois JASON CHAFFETZ, Utah
STEVE DRIEHAUS, Ohio
DIANE E. WATSON, California
HENRY CUELLAR, Texas
Darryl Piggee, Staff Director
C O N T E N T S
----------
Page
Hearing held on November 5, 2009................................. 1
Statement of:
Thomas, Adrienne, Acting Archivist of the United States,
National Archives and Records Administration; Paul
Brachfeld, Inspector General, National Archives and Records
Administration; David Powner, Director, Government
Accountability Office, Information Technology Management
Issues; and Alan E. Brill, Kroll Ontrack, senior managing
director for technology services........................... 13
Brachfeld, Paul.......................................... 30
Brill, Alan E............................................ 57
Powner, David............................................ 42
Thomas, Adrienne......................................... 13
Letters, statements, etc., submitted for the record by:
Brachfeld, Paul, Inspector General, National Archives and
Records Administration, prepared statement of.............. 34
Brill, Alan E., Kroll Ontrack, senior managing director for
technology services, prepared statement of................. 60
Clay, Hon. Wm. Lacy, a Representative in Congress from the
State of Missouri, prepared statement of................... 3
McHenry, Hon. Patrick T., a Representative in Congress from
the State of North Carolina, prepared statement of......... 8
Powner, David, Director, Government Accountability Office,
Information Technology Management Issues, prepared
statement of............................................... 44
Thomas, Adrienne, Acting Archivist of the United States,
National Archives and Records Administration:
Letter dated November 10, 2009........................... 70
Prepared statement of.................................... 17
THE NATIONAL ARCHIVES' ABILITY TO SAFEGUARD THE NATION'S ELECTRONIC
RECORDS
----------
THURSDAY, NOVEMBER 5, 2009
House of Representatives,
Subcommittee on Information Policy, Census, and
National Archives,
Committee on Oversight and Government Reform,
Washington, DC.
The subcommittee met, pursuant to notice, at 2:40 p.m., in
room 2154, Rayburn House Office Building, Hon. Wm. Lacy Clay
(chairman of the subcommittee) presiding.
Present: Representatives Clay, Driehaus, Watson, Cuellar,
and McHenry.
Staff present: Darryl Piggee, staff director/counsel; Jean
Gosa, clerk; Yvette Cravins, counsel; Frank Davis and Anthony
Clark, professional staff members; Charisma Williams, staff
assistant; Leneal Scott, information systems specialist (full
committee); Adam Fromm, minority chief clerk and Member
liaison; and Chapin Fay and Jonathan Skladany, minority
counsels.
Mr. Clay. The hearing will come to order. Good afternoon.
And the Information Policy, Census, and National Archives
Subcommittee of the Oversight and Government Reform Committee,
will now come to order.
Without objection, the Chair and ranking minority member
will have 5 minutes to make opening statements, followed by
opening statements not to exceed 3 minutes by any other Member
who seeks recognition.
And, without objection, Members and witnesses may have 5
legislative days to submit a written statement or extraneous
materials for the record.
Welcome to today's oversight hearing on the ``National
Archives' Ability to Safeguard the Nation's Electronic
Records.'' The purpose of today's hearing is to examine the
National Archives' policies and procedures to protect the
Nation's ever-increasing store of electronic records.
We will consider several important topics, including an
update on the theft or loss from NARA of a portable hard drive
containing Clinton administration electronic records; possible
breaches of electronic records containing personally
identifiable information from NARA operating systems; and the
status of the largest IT project in NARA's history, the
Electronic Records Archives [ERA].
ERA, fully implemented, would cost well over a half a
billion dollars. Over the last 10 years or more, NARA has tried
with varied success not only to develop and test a system but
even to define its scope.
This subcommittee is concerned that such a large and
expensive information system is being developed in an agency
that is already struggling with managing the security of the
systems they currently operate. The theft or loss of the
Clinton hard drive was very disturbing and we look forward to
hearing the status of the agency's efforts to identify and
notify any and all individuals whose PII may have been
compromised.
It is more troubling, however, to hear of new instances of
data breaches, or possible breaches. The circumstances and the
agency's handling of them casts doubt on the National Archives'
ability to understand and mitigate existing and emerging risk
in order to properly safeguard the Nation's electronic records.
It is this subcommittee's hope that through our hearing
today, we can gain a better understanding of NARA's information
technology security, and provide the National Archives with
some important information and direction they can use in order
to increase IT security across the agency.
[The prepared statement of Hon. Wm. Lacy Clay follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Mr. Clay. I would like to introduce our panel. Our first
witness will be Adrienne Thomas, the Acting Archivist of the
United States. Prior to her appointment as Acting Archivist in
December 2008, Ms. Thomas served as the Deputy Archivist of the
United States. Ms. Thomas has been with the National Archives
for 38 years, beginning as an Archivist trainee in the Office
of Presidential Libraries, and subsequently holding a number of
policy and administrative roles. And thank you for being here.
Our next witness is Paul Brachfeld, the Inspector General
of the NARA Administration. Mr. Brachfeld previously worked for
the Federal Communications Commission where he served as
Assistant Inspector General for Audits. During his 8 years'
tenure at the FCC, he also served 10 years as Acting Assistant
Inspector General for Investigations. Mr. Brachfeld also served
as Director of Audits for the Federal Election Commission
Office of the Inspector General.
After Mr. Brachfeld, we will hear from David Powner, the
Director of IT Management Issues at the GAO. Mr. Powner is
currently responsible for a large segment of GAO's information
technology work, including systems development, IT investment,
management health IT, and Cyber Critical Infrastructure
Protection Reviews. He has led teams reviewing major IT
modernization efforts at Cheyenne Mountain Air Force Station,
the National Weather Service, the FAA and the IRS. Thank you
for being here, Mr. Powner.
And our final witness will be Alan Brill, the senior
managing director for technology services at Kroll Ontrack, an
industry leader in computer forensics and investigation. Mr.
Brill is recognized internationally as a leader in his fields
of security, computer forensics, and incident response. Mr.
Brill founded Kroll Ontrack global high-technology
investigation practice. He has an international reputation in
the areas of computer communications security and technology
crime investigation.
I thank all of you for being here today and appearing
before us for testimony. It is the policy of the subcommittee
to swear in all witnesses before they testify. Would you all
please stand and raise your right hands?
[Witnesses sworn.]
Mr. Clay. Thank you, you may be seated. And let the record
reflect that the witnesses answered in the affirmative. I ask
that each of the witnesses now give a brief summary of their
testimony. Please limit your summary to 5 minutes and your
complete written statement will be included in the hearing
record.
Before we go to Ms. Thomas, we would like to ask the
ranking member if he has an opening statement.
Mr. McHenry. Thank you, Mr. Chairman, I do. Thank you so
much for continuing to hold good hearings with this
subcommittee. I appreciate your leadership.
In May of this year, this subcommittee first met to discuss
the staggering negligence of National Archives staff in
handling our Nation's valuable records, an issue that was only
just coming to light at the time. We're back again. But back
then we were shocked to hear that a 2 terabyte hard drive had
disappeared from the Archives' storage room where it was kept
in an unsecured location, accessible by many employees.
That device contained the personally identifiable
information of hundreds of thousands of Clinton administration
staff, Secret Service operating procedures, and other highly
sensitive information. Although it was clear that there were
endemic problems with National Archives' management, it
appeared that this loss was an isolated incident and an Acting
Archivist assured this committee that measures were being taken
to address security concerns and prevent any further breaches.
That, unfortunately, is not the case. Now, 6 months down
the road, we're back here again, with more news of lost
electronic storage devices, one of which contains the
personally identifiable information of our Nation's military
veterans on a drive that was sent out to an outside contractor
for maintenance and repair. What's more is that this breach
occurred a year ago, in November 2008, and we're only hearing
about it now. I'm practically speechless.
It is my sincerest hope that, Ms. Thomas, you will tell us
today that the Archives is doing everything possible to ensure
that these veterans do not become victims of identity theft.
The National Archives staff exposed this drive to loss or
theft because they believed it was defective and beyond repair.
Further--they further claim that sending a drive containing
sensitive information to a third party doesn't constitute a
breach of sensitive information, because the contractor is
obligated to keep its contents private.
As the Inspector General of the National Archives will
testify today, the data on this drive is actually retrievable,
using free, publicly available software. In fact, some of my
staff have performed procedures very similar to that. Exposing
a drive like that to eyes outside of the National Archives is
irresponsible, regardless of the technical definition of a
breach.
The National Archives has further claimed to the
subcommittee staff that breaches of this nature will not happen
going forward, because a policy is now in place that prohibits
drives from being sent out to contractors for repair. However,
this policy was actually already in place at the time the drive
with veterans' data was exposed. So that's nothing more than
cover for the past and not real substantive change to ensure
this doesn't happen in the future.
The policy also did not prevent the National Archives from
sending yet another drive containing sensitive records to a
contractor under similar circumstances in April 2009. That
drive contained digitized employee files from the National
Archives, GSA, and OPM. It is unacceptable that the NARA staff
handle any storage devices this carelessly, but it is
particularly disturbing that they are so haphazard with the
Social Security and military identification numbers of our
veterans who have sacrificed so much for this country.
National Archives already uses strict protocols to
safeguard this information contained in Defense Department
files in its possession. Had these same protocols been used for
veterans' data, this incident would have been avoided, in my
opinion.
What is clear is that there is a greater institutional
problem at the Archives that must be fixed, and that is culture
of blatant disregard. It's become very clear that the ongoing
security breaches are not the result of a lack of awareness of
security procedure by staff, but a failure at the managerial
level to enforce the procedure.
Finally, we will also hear from our witnesses about the
National Archives' Electronic Records Archive. As in the case
with NARA as a whole, the ERA is plagued with its own problems.
The ERA, which is the Archives' strategic initiative to
preserve uniquely valuable electronic records in the U.S.
Government, is in the midst of a system development that is
already running far over budget. When fully operational, it
will cost $500 million more than projected.
The GAO has already been critical of this system, citing
methodological weaknesses that could limit NARA's ability to
accurately report on cost schedules and performances, and
concluding that NARA lacks a proper contingency plan should the
electronic record system fail. This really makes me question
the investment overall.
I thank our witnesses for appearing today. I certainly
appreciate and am very interested in Ms. Thomas' testimony
about this recent security breach and what sort of measures are
being taken, if any, to say that this will not happen in the
future.
Thank you, Mr. Chairman, for your leadership and I yield
back.
Mr. Clay. Thank you, Mr. McHenry, for your opening
statement.
[The prepared statement of Hon. Patrick T. McHenry
follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Mr. Clay. I also want to recognize four special guests that
we have here today in the front row, who are here to see their
government in action. One is Dr. Kelly Woestman of Pittsburgh
State University, as well as Jerry Handfield, the State
Archivist for the State of Washington, Andy Maltz, who is the
director of Science and Technology Council for the Pickford
Center for Motion Picture Study, and David McMillen, NARA
external affairs liaison.
Welcome to all of you and all the other ladies and
gentlemen in the audience today.
Ms. Thomas we will begin it with your testimony.
STATEMENTS OF ADRIENNE THOMAS, ACTING ARCHIVIST OF THE UNITED
STATES, NATIONAL ARCHIVES AND RECORDS ADMINISTRATION; PAUL
BRACHFELD, INSPECTOR GENERAL, NATIONAL ARCHIVES AND RECORDS
ADMINISTRATION; DAVID POWNER, DIRECTOR, GOVERNMENT
ACCOUNTABILITY OFFICE, INFORMATION TECHNOLOGY MANAGEMENT
ISSUES; AND ALAN E. BRILL, KROLL ONTRACK, SENIOR MANAGING
DIRECTOR FOR TECHNOLOGY SERVICES
STATEMENT OF ADRIENNE THOMAS
Ms. Thomas. Chairman Clay, Ranking Member McHenry, and
members of subcommittee, thank you for this opportunity to
discuss the National Archives and Records Administration's
safeguarding of electronic records.
At NARA we recognize that the challenge of securing IT
systems and devices, particularly in regard to protecting
personally identifiable information, is never-ending and always
changing. We know that no agency will ever be perfect, but
we're committed to doing the best job that we can, learning
from our own mistakes and the mistakes of others.
I appreciate Paul Brachfeld, NARA's Inspector General, and
David Powner of the Government Accountability Office are
appearing alongside me today. NARA's Office of the Inspector
General has reported a number of vulnerabilities and made
important recommendations on how we can improve our security.
In response to their work we've declared a material weakness
with respect to IT security, and we are taking corrective
actions.
Later in my testimony, I will update you on the Electronic
Records Archives which regularly receives useful guidance from
the GAO and has from the very start of the ERA development.
In late September, I was briefed by the Inspector General
on an allegation that NARA may have improperly disclosed
sensitive personally identifiable information when a defective
disk drive from a veterans' information data base was sent to
an authorized contractor for repair in the fall of 2008, rather
than being destroyed and disposed of at a NARA facility,
according to a new policy that had been issued by the CAO in
August 2008.
The defective disk drive supports the case management
reporting system [CMRS]. CMRS is used by NARA's Military
Personnel Record Center to track over a million requests
annually for the personnel records of veterans, but the system
hardware resides in College Park, MD.
On October 9th we learned that an additional hard drive at
our National Personnel Record Center in St. Louis was returned
to a vendor in April 2009. The drive is from a system that is
used to digitize official personnel files of current government
employees, and we believe it contained digitized files and an
associated index of current employees' records from NARA, the
General Services Administration and the Office of Personnel
Management.
NARA and the Inspector General continue to review these
incidents. However, at this time, there is no evidence that the
defective disk drives were ever in unauthorized hands or that
any PII was accessed from these disks. And my staff and I have
concluded that there was no PII breach.
We have implemented many recommendations made by the
Inspector General to improve PII security at the NPRC,
including removing older data from the CMRS system, performing
annual reviews of CMRS user accounts, compiling updated key
inventories to better protect PII stored on paper, and issuing
policy changes to require verification of data before providing
military records to next of kin.
In light of these two hard drive maintenance incidents, we
are taking a comprehensive look at the internal security
controls related to the protection of PII within IT systems
across NARA. We have undertaken an agency-wide systematic
review of the storage and protection of PII that includes a
review of data base encryption within the system, a review of
our tape backup procedures, a review of all of our computer
acquisition and maintenance contracts to ensure that sensitive
data protection is properly addressed, and a review of our
internal PII awareness and training processes and procedures.
We are also ensuring that we use National Security Agency-
approved media, sanitation, and destruction procedures, and
have engaged expert consultants to review our IT security
incident response procedures.
In order to identify ways to improve security and internal
controls with regards to electronic records, NARA has conducted
an internal audit to identify how well our ITT security program
is functioning. This audit identified 29 recommendations for
improvement in NARA's IT security program. Since then, we have
doubled our IT security staff and much progress has been made
in the area of strengthening our IT security controls.
My written testimony describes many additional corrective
actions that NARA is undertaking to improve IT security. Most
of the original 25--29 recommendations have been completed, and
we continue to work on the remaining actions.
You also asked that I provide an update on our response to
the external hard drive containing copies of Clinton
administration Executive Office of the President data that we
discovered missing in March 2009 from NARA's College Park
facility. The drive is still missing. It contains names, dates
of birth, and Social Security numbers of people who worked in
the Clinton Executive Office of the President, visited the
White House complex, or submitted personal information to the
White House in pursuit of a job or a political appointment.
To date, NARA has mailed approximately 26,000 breach
notification letters to individuals whose names and Social
Security numbers are on the hard drive. We have offered these
individuals 1 year of free credit monitoring. So far, 1,685
persons have taken advantage of the offer. Our contractors are
continuing to search the hard drive for additional names of
individuals whose identity might have been compromised. We
anticipate mailing an additional 120,000 letters in the coming
weeks.
Finally, you asked that I report on the status of the
Electronic Records Archives [ERA]. ERA is a comprehensive
systematic and dynamic means for providing electronic records
that would be free from independent--from dependence on any
specific hardware or software. The primary purpose of this
first-of-a-kind system is to take in, store, and provide access
to records that are born digital, by which we mean the
permanent archival electronic records created by executive
branch agencies, the Congress, Federal courts, and the Office
of the President.
We are currently beginning year 5 and increment 3 of this
7-year, 5-increment system development project. NARA staff is
now using increment 1 to ingest electronic records from legacy
NARA systems and to schedule transfer records from four
agencies serving a pilot capacity for ERA.
Increment 2 of ERA provided support for the transfer of the
electronic Presidential records from the Executive Office of
the Bush administration so that we could preserve and make
these records accessible for archival processing. Increment 2
was delivered in December 2008 to enable NARA to begin the
ingest of 72.32 terabytes of data that legally transferred to
NARA as of January 20, 2009. Ingest of these unclassified
electronic records was completed in October 2009.
Funding in NARA's 2010 budget is dedicated to increment 3
of NARA, which includes a congressional records instance to
provide simplified storage and access capabilities for the
electronic records of Congress. This part of increment 3 is on
schedule and will be delivered to NARA in February 2010.
Increment 3 also provides the capability for the public to
accept access records in ERA. The subcommittee should know,
however, that the start of increment 3 development has not been
as smooth as desired. NARA has raised several concerns with the
contractor related to analysis, design, and architectural
foundation issues. The contractor was receptive to NARA's input
and has taken concrete steps to make improvements in process,
deliverables and staff. At present, the contractor believes it
can deliver increment 3 as scheduled. But you can rest assured
that NARA will continue to monitor progress to ensure that
increment 3 will be delivered within cost and schedule.
In summary, ERA is operating in the way that we now expect
it to at this point in the project. Federal and Presidential
records are stored in the ERA, which operates securely at a
facility on the grounds of U.S. Navy's Allegheny Ballistic Lab
in Rocket Center, WV. Hardware and software failures have been
minimum. We have a staged plan to open the system up to Federal
agencies. The problems we encounter are common to major IT
systems development, but I am confident in the ability of the
ERA program office to manage the development of ERA to a
successful conclusion and to plan for the ongoing operational
phase of ERA after 2012.
Mr. Chairman--that concludes my testimony. I would like to
thank you for inviting me here today and for the helpful
oversight and guidance you and the members of this subcommittee
provide to NARA.
Mr. Clay. Thank you so much.
[The prepared statement of Ms. Thomas follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Mr. Clay. Mr. Brachfeld, you may proceed.
STATEMENT OF PAUL BRACHFELD
Mr. Brachfeld. Mr. Chairman and members of the
subcommittee, I thank you for the opportunity to testify today.
NARA's core mission is to safeguard and preserve the
records of our democracy to make them available for this and
future generation of Americans. The challenge is daunting and
becoming more complex each day in this, the Digital Age. Yet
fundamental truisms still exist in many areas. One fundamental
truism, as solid as granite, is that sound internal controls
should be the foundation upon which all systems and operations
are based.
For a decade as a NARA Inspector General, I have had a
front-row seat observing internal control weaknesses and
internal control deficiencies that have resulted in the loss of
Federal funds and property, compromised the successful delivery
of contractual services and deliverables, impaired operations,
and subjected information to include electronic records
maintained in NARA's systems and facilities to compromise.
However, I am hopeful. I believe that under the leadership
of a new Archivist, NARA has the opportunity to elevate
security to the upper tier of our organizational mission.
The staff in my office is committed to assisting management
in this effort. We also look forward to working with the new
Archivist with an eye toward strengthening a role NARA plays in
ensuring Federal records created by all three branches of
government are properly identified, scheduled, accessioned, and
ultimately injected into a functional electronic records
archive.
Today, at the request of the committee Chair, I will focus
upon the exposure resulting from the compromise of records that
placed personally identifiable information [PII], of our
Nation's veterans, Federal employees, and millions of our
Americans at risk. In the past year alone, OIG investigators
and auditors have performed work specific to the following: the
loss of a computer hard drive from Archives to College Park,
populated with millions of records from the Clinton White
House. Within this population are tens of thousands of records
containing PII as well as other potentially sensitive
information.
The loss of government control over a hard drive we suspect
contained millions of PII records of our Nation's veterans.
Inappropriate controls over information stored in the
automated case management system used in St. Louis to track and
process electronic mail-based requests for official military
personnel files. System vulnerabilities leave veterans' PII
susceptible to unauthorized disclosure.
The improper transmission of veterans' records over an
extended period of time by personnel at the National Personnel
Records Center which exposed veterans' PII to potential
compromise.
The donation and surplus of laptops that were not degaussed
or scrubbed which, at least in one case contained files of the
former Director of the Information Security and Oversight
Office. Among these files was PII-specific and national
security officials from the Clinton administration.
The loss or theft of hundreds of pieces of IT equipment,
written off for the period of fiscal year 2002 to 2006, had had
capacity to store information.
Inappropriate packaging of two backup hard drives
containing limited PII at the FDR Presidential Library,
resulting in their loss during shipping. OIG investigators
subsequently recovered one of the two.
Additionally, this committee was recently notified of
another incident in St. Louis, MO in which failed hard drives
from a drive array used to store PII information for thousands
of Federal employees inappropriately left NARA's physical
control. The array contained mirror images of official
personnel files and related information of employees from three
agencies.
These cases worked by OIG staff within the past year are
individually egregious, and collectively represent an agency
that is not meeting a core tenet of its mission to safeguard
the records of our democracy. While each case of data breach,
loss, or under risk of loss, represents a unique stanza; the
chorus of the song remains the same.
As an agency, NARA lacks a viable, robust risk
identification and mitigation strategy, and we all paid for
this shortcoming.
In testimony before this committee on July 30th, I provided
details to the internal control weaknesses which result in the
loss of a hard drive containing two terabytes of Clinton
Presidential records. Internal control weaknesses, lapses, and
exercise of questionable judgment tied to other incidents I
have spoken of today, regularly leave me and my staff
frustrated and bewildered.
Allow me to elaborate. Specifics of the case involving the
hard drive potentially holding millions of our Nation's
veterans' PII, NARA officials contracting for what to do with
these type of hard drives initially had two choices. It needs
to be clear that often there is nothing substantially wrong
with failed drives and they are perfectly useful for many
applications.
Accordingly, one contract choice, the secured data option,
would let NARA physically keep all drives identified as failing
or failed.
The second choice of the vendor providing a new drive, but
then the vendor would take back that drive with the information
on it. The vendor would then test the drive to see if anything
was wrong with it, and if there was, it could be economically
repaired and reused. However, if it cost more to fix than the
drive was worth, the drive could be recycled for metals.
NARA opted for choice two. Thus NARA decided to allow the
populated and potentially readable drive to leave NARA control.
However, as drives actually started to fail, NARA was given a
second chance to correct this decision and was presented with a
third choice. NARA could keep the failed drive and pay
approximately $2,000 for each new drive on a one-by-one basis.
Unfortunately, NARA once again chose to let these populated
drives leave their control.
The trail specifically described was subsequently found to
be untraceable and we cannot get possession back. Accordingly,
I cannot tell the committee today whether a breach, as defined
by data being accessed by unauthorized parties, occurred. But I
can state emphatically that NARA's actions to create the risk
of such a breach and a lack of due diligence to protect this
information cannot be ignored and should not be marginalized.
While I have been informed that this situation I just
described has now been fixed contractually, I believe select
narrow managers, from the top down, do not recognize the risk
factors existing in today's environment. Failing to define the
risk, would you not deploy and make the security first
decisions necessary to adjust to real and potential risk before
unfortunate and irreversible events transpire?
In the brief time allotted to me, I would also note--
specifically; it relates to the ERA program--that I have had
professional skepticism about ERA since the first meeting I
attended in 2002. Fearing a worst-case scenario, I went to
then-Archivist Carlin on April 30, 2002, seeking audit staff
resources to provide independent, objective, and skilled
oversight over ERA. Per my notes he responded, ``I could give
you 50 people and you still couldn't cover it. So you think you
can do it with two?''
In December 2003, failing to obtain any ERA dedicated audit
resources, I made a formal request, to the OMB Director stating
ERA is a challenge we are not equipped to address within our
existing fiscal constraints. We are simply unable to provide
the necessary coverage to this mission-critical program.
Failure to fund this initiative will not allow me to obtain
persons with the skills necessary to independently evaluate and
report upon the progress of ERA. Likewise we'll not be able to
support this program of real time, potentially resulting in
less than optimal results. This is a risk that this Nation
should not face.
As I testify today, I continue to have profound concerns
over the status of the ERA program. My concerns are rarely
reflected by management, who throughout program life have
expressed abundant optimism. For example, in April 2007, ACERA
meeting minutes, the ERA director stated--technical director
stated--that the program is succeeding. Yet OIG auditors were
finding this rosy scenario to be anything but the truth.
In a management letter to the Archivist on January 13,
2007, we accurately defined the ERA programs as one ``beset by
delivery delays, cost overruns and staffing shake-ups.''
History shows we were correct.
At the very next ACERA meeting in November 2007, the
minutes report that same ERA technical director made a 100-
degree course correction by defining that sound engineering
methods were not followed in many areas. Lockheed allowed the
schedule to become the priority, rather than ensuring that
requirements were being met in a satisfactory manner ultimately
has failed. NARA issued a curing notice to lock in 2007.
Shortly thereafter, in testimony before a subcommittee of
the Senate Committee on Homeland Security and Government
Affairs, on May 14, 2008, Archivist Weinstein stated We
discovered belatedly that we may not have the A team from
Lockheed Martin, and Lockheed Martin acknowledged this fact.
And so we got the A team, and the A team has been performing
effectively.
I am not sure as to the basis for this testimony, which was
perhaps designed to allay the concerns espoused by Senators at
this hearing. Seventeen months have passed, we are now in
fiscal year 2010, and key staff in NARA and LMC have come and
gone. New voices replace old voices and optimism ebbs and
flows.
At a time when NARA officials publicly voice confidence
that full operating capability will be met by March 2012, a
senior working within the ERA program office spoke to me just
last week of ongoing contract performance and deliverable
deficiencies. Perhaps the A team is sliding down the alphabetic
scale.
The Acting Archivist told me last week the Chief
Information Officer has been made aware of ongoing
deficiencies. However senior NARA management never brought such
information to my attention nor disclosed it to the auditors
assigned to this program area.
As engaged as I have been, I do not know what capabilities
and capacities will reside in ERA when the contractors throw
another party, turn in their badges, shake hands and exit the
door.
Such a statement should be viewed as troubling to all NARA
stakeholders, and particularly this committee. It is my hope
that through this testimony and the support of a new Archivist,
we will begin to see improvements in our system of internal
controls, and that those who fail to discharge their duties
will face appropriate sanctions.
I thank you for this opportunity and I look forward to
responding to your questions, thank you.
Mr. Clay. Thank you so much, Mr. Brachfeld.
[The prepared statement of Mr. Brachfeld follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Mr. Clay. Mr. Powner, you're up.
STATEMENT OF DAVID POWNER
Mr. Powner. Chairman Clay, Ranking Member McHenry, and
members of the subcommittee, we appreciate the opportunity to
testify this afternoon on NARA's electronic records archive
system. This $550 million system is intended to preserve and
provide access to massive amounts of electronic records and is
an investment critical to NARA's mission.
To date, NARA has spent more than half of the $550 million
and has deployed two of the five planned increments. This
afternoon, Chairman Clay, I will comment on NARA's performance
with the first two increments, existing project management
concerns, plans for increments 3 through 5 and recommendations
for improvement.
Starting with performance of the first two increments,
increment 1 was late, over budget, and did not provide the
functionality promised. Specifically, initial operating
capability with four pilot agencies was scheduled for September
2007, but was delayed 9 months to June 2008. This delay
resulted in the cost overrun of $20 million. But even more
troubling is the fact that planned functionality was not
delivered and deferred to later increments.
These delays also squashed NARA's plans to use ERA to
receive the electronic Presidential records of the outgoing
Bush administration in January 2009. Instead, a separate
commercial system with a different architecture from ERA was
used to archive the Bush records. And although NARA certified
the second increment in December 2008, the 73 terabytes of
Presidential records were not ingested into the system until
September 2009. The first two increments are basically
different systems, and integrating these systems in later
increments will need to be addressed.
Managing a project this large requires sound project
management discipline that includes overseeing contractor
performance to ensure that what the government is paying for is
delivered at the agreed-to cost and on time. To date, the ERA
program does not have a good track record here. When we looked
into this last year, we found several weaknesses in NARA's
practice. For example, we found contractor reports on program
funds spent without work completed, and work completed and
funds spent on work that was not in the work plans. NARA is
working to improve the management processes so that the cost
schedule and technical performance can be closely monitored in
the remaining three increments over the next 3 years.
Regarding the remaining three increments, we have reported
and made recommendations to NARA that their outyear increments
need to be clearly defined as to what specific functions will
be delivered when and at what cost. For example, NARA has
significant work ahead in the outyear increments that include
expanding beyond the four pilot agencies, handling classified
information, providing public access capability, and expanding
functionality like access and preservation capabilities. Such
detailed plans are essential if this project is to achieve full
operating capability by 2012 at the $550 million price tag.
Moving forward, NARA needs to closely monitor not only the
cost of each increment, but also needs to monitor the
functionality delivered. Our recommendation to bolster the
program's use of earned value management should help, if
effectively implemented.
The program also needs to ensure integration plans are in
place to merge the differing architectures used in the ERA base
system and the Presidential record system. And also NARA needs
to define in great detail the functions to be delivered in
increments 3 through 5. This includes aligning detailed
requirements and the cost with each increment. Failing to
address these recommendations will clearly jeopardize the
chances of achieving full operating capability by 2012.
Mr. Chairman, this concludes my statement. Thank you for
your oversight of this project, and I look forward to your
questions.
Mr. Clay. Thank you so much Mr. Powner.
[The prepared statement of Mr. Powner follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Mr. Clay. Mr. Brill you have 5 minutes.
STATEMENT OF ALAN E. BRILL
Mr. Brill. Thank you, sir. Chairman Clay, Ranking Member
McHenry, members of the committee and members of the staff,
good afternoon. My name is Alan Brill. I'm currently senior
managing director for secure information services at Kroll
Ontrack. I am not here today as a representative of Kroll
Ontrack, but as an individual to share whatever knowledge and
experience I have in the fields of information security, data
protection and data recovery, to assist the subcommittee with
the vital work it performs. And I'm grateful to you for the
opportunity to speak today.
A substantial proportion of the information that is being
created within our government is generated, exchanged, and
stored digitally. It is produced and stored on computers
ranking from the desktop or laptop computers of individuals, to
the massive processing arrays in networks of large agencies. It
is also a simple fact that most of the data that is created,
and which may have historical import for extended periods of
time, will never in the course of normal use be printed.
How do we safely and efficiently preserve electronic
records when the technologies involved in producing and storing
those records is clearly evolving at a breakneck speed?
I've been involved in the security and recovery of data
from computers for more than 40 years. My recent experience has
involved working with private-sector organizations to safeguard
sensitive data and help those organizations respond to data
security incidents. I've learned a few lessons that I hope will
be helpful to the subcommittee when it considers how best to
carry out its oversight role in assuring the preservation of
electronic records which are a vital part of our national
heritage.
First, don't assume that the devices currently used to
store data will be commonly used, or even reasonably available
in the future. Above all else, we must ensure not only that we
can store the data but that we can completely and accurately
access it on the physical media that we preserve. This means
that we either have to also preserve workable reading
mechanisms or periodically transfer the data to contemporary
storage media, as new storage technology obsoletes the old.
Don't assume data can't be restored, even if the storage
medium appears to be damaged. Consider a quick example.
Following the tragic loss of the Space Shuttle Columbia in
2003, NASA located a hard drive in the debris field. The Glenn
Research Center sent it to my organization for examination.
Although the electronics on that drive had been literally
fried, the case burned and plastic from the innards of the
device had melted onto the surface of the drives, we were able
to rebuild the mechanical components, clean the disk and
recover over 99 percent of the data, which turned out to be
vital for completing a long-term experiment in basic physics.
With today's technology, unless the media containing the
data is utterly destroyed, the data is at least potentially
recoverable. I believe that the best practice is that when a
device contains sensitive data, assume it might be potentially
recoverable, unless you have taken proper systems steps to
render that data permanently unreadable.
Third, what you see is very often not all that you can get.
There are a number of data fields that are automatically
created and maintained by the program that all of us use. Some
are obvious. The date and time that a file was originally
written, how many times it was edited, when it was last opened,
but it can contain more. It may contain a record of changes
made in the course of revision and review. This information is
called metadata. It is important to the understanding of the
file with which it is associated.
People think that things like this are a brand-new issue,
Mr. Chairman, but they are not. If you look at Abraham
Lincoln's handwritten manuscript of the Gettysburg Address, you
can see how he edited it, what it looked like before he made
the changes, what he crossed out and what he added. The same
can often be done with digital records through examination of
the metadata, but only if that metadata is preserved.
Unfortunately, unless care is taken in regard to the
preservation process, metadata can inadvertently be changed or
lost. To ignore metadata is to constrain future understanding
of the file.
Next, ensuring data security must be more than an
afterthought. There is a cost to data protection, but, planned
effectively, those costs can be controlled. There will always
be a tradeoff between cost and protection.
While I'm not an expert in the various security standards
that are used by Federal agencies, I found there are a number
of centers of knowledge that can be an immense value in
understanding the risks and alternatives. The work of
professionals at NIST comes to mind. I have no doubt that this
subcommittee is aware of the ongoing work there to identify
risks, protective measures, and to provide publications that
help professionals and managers in both the public and private
sector to do a better job of security sensitive data.
Sir, the cost of not protecting data appropriately can be
very, very high. What is the cost to future knowledge if
electronic records of today's decisions and activities are lost
through security failures?
I believe that the expertise exists to assist and advise
our government on this complete and continually changing issue.
There are many specialists like myself who recognize that
service on advisory councils and other appropriate mechanisms
is really part of our civic and professional personal duty. Why
not call on this pool of knowledge?
If we don't collect data and collect it properly, if we
don't maintain it in a usable and complete form, and if we
don't safeguard it appropriately, it won't be there for the
benefit of future generations.
Finally, we must assure that both public and private sector
organizations have a plan for exactly what they will do if
there is a data protection incident. Trying to develop a crisis
management plan in the middle of a crisis is difficult at best.
Recognizing that incidents can occur, and if they do occur, is
far more effective in terms of responding to the incident.
I want to thank the subcommittee for inviting me here
today. Sir, over the years I've had the opportunity to work
with information security professionals in government, at the
FBI, the Defense Department, the Secret Service, I am very
proud of the work that they do. Their public service at a time
when they could earn far more in the private sector is a
measure of devotion. Anything that we in the private sector can
do to add to the knowledge, to make sure that we keep up with
the changes, is more than just something that could be done;
it's something that ought to be done.
Thank you very much for inviting me here today, sir.
Mr. Clay. Thank you, too, Mr. Brill, especially for your
passion in regard to this subject. And we appreciate your
service.
[The prepared statement of Mr. Brill follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Mr. Clay. I thank the entire panel for their testimony.
I also want to welcome our newest member to the
subcommittee, the gentleman from Texas, Mr. Henry Cuellar.
Welcome aboard and we look forward to your involvement in the
subcommittee. We will go into the question-and-answer period,
and we will recognize the gentleman from Ohio for 5 minutes to
begin the questioning.
Mr. Driehaus. Thank you very much, Mr. Chairman, and I
thank you for calling this hearing and I appreciate very much
the testimony.
This certainly hits home to me. I remember when I was a
State Representative, and one of my colleagues called me and
recited my Social Security number to me after looking at a
county--I believe it was the county auditor or the county
recorder or something like that, the Clerk of Courts, whose son
had developed a new Web site. They decided it would be great if
we scanned every document in the county that came through the
Clerk of Courts and they scanned it onto the Web site, not
thinking that, you know, perhaps some of these parking tickets
out there--and mine was a traffic violation--contained some
sensitive information.
But what it brought to mind was that there was no standard
operating procedure at all in the county, in the State,
anywhere, when it came to not just archiving the data but
dealing with the data at all. And so, Mr. Brachfeld, when I
hear your testimony, it strikes me as very concerning.
Earlier this year I introduced legislation dealing with
classification of documents, because there is no standard
operating procedure in the Federal Government when it comes to
standard classifications. We find that, you know, the Federal
Government exists in silos, and there are different standard
operating procedures when it deals to just classifying
documents and classifying certain information.
So if you could help me, Mr. Brachfeld, I am very
interested--any of you--as to our status as a Federal
Government. In terms of coming up with standard procedures for
dealing with sensitive documentation and sensitive information,
not only how do we collect it but how was it dealt with, and
certainly when it was archived, how do we then deal with this
archive? Give us a score as to how we are in standardizing this
as a process.
Mr. Brachfeld. Actually the focus of my work is doing
investigations and audits. In terms of policy and procedures
and classification of documents, that's not my bailiwick.
Mr. Driehaus. Not just classification. I'm talking about
the sensitive information that you were talking about and how
vulnerable we are to losing that information. It strikes me
that within departments we don't have standard operating
procedures to deal with this appropriately. I'm wondering if
you have any observations as to how far we've come or how far
we still have to go in terms of the various departments in
collecting and classifying and archiving that data?
Mr. Brachfeld. I think there are standards available. For
example, in the cases I was talking about specific to the loss
of data and the breach of data, there is, as Mr. Brill noted as
well, there's NIST standards; OMB puts out regulations
requirements; agencies establish and define their own internal
requirements. The problem is, it shouldn't just be a paper
exercise where you can hold up to the world that we have
policies and we have procedures, and then you can put your head
on your pillow and think that you can rest assured.
No, you have to actually train people and you have to
actually hold people to those standards, and you have to test
and you have to drill down, you have to ensure they are
enforced and protected at all times.
I think that's what happened many times in Federal
agencies, at least through my 30 years now of experience, which
is that it is easy to write policy, especially in this day and
age, to get contractors and pay them to write policy for you.
But to actually instill that work ethic, to actually instill
those morals, to actually enforce the proper treatment of
records and protection of records, that's the problem.
And that's where in my testimony I talk about where I
believe that NARA has fallen short in terms of lack of
training, lack of oversight, and then lack of appropriate
action when people violate NARA policy and procedures which
were drafted in response to OMB requirements. So we don't have
a pass and we don't have a buy. These are things we should be
doing, and these are things that we fail to do at the National
Archives.
Mr. Driehaus. So it is not just a matter of
standardization. It is a matter of following through and making
sure that the processes are being followed and enforced if they
are not followed.
Mr. Brachfeld. That's correct. And that's why as an
Inspector General, I'm first of all very happy to be testifying
today and get the attention to this subject. I am also proud of
my staff, that we're putting forward very sound recommendations
that, should management opt to accept them and adopt them, I
think will bring far increased levels of internal control
security, and maybe we won't be here next year talking about
further breaches. Maybe we'll actually have a pretty tight shop
if we do some of the stuff we're recommending.
Mr. Driehaus. Well, I guess following up on the issue of
holding people accountable, Ms. Thomas, when you were here in
July with regard to the theft of the Clinton administration
hard drive, you at the time stated that you would act with
swift and appropriate disciplinary action if we found out that
there were people to be held accountable. Have you followed up
on that, and what steps have been taken?
Ms. Thomas. Well, at this point in time, we have held off
on taking disciplinary actions, although we are ready to do so
basically at the request of the Inspector General, so that they
can finish their investigation. But once that is finished and
they give us the go-ahead, then disciplinary actions will be
taken.
Mr. Driehaus. So the disciplinary action is pending?
Ms. Thomas. Pending.
Mr. Driehaus. That's all, Mr. Chairman.
Mr. Clay. Thank you, Mr. Driehaus. Mr. McHenry, you may
proceed for 5 minutes.
Mr. McHenry. Thank you, Mr. Chairman.
Ms. Thomas, how long have you been in your current
position?
Ms. Thomas. As Acting Archivist? Since mid-December of last
year.
Mr. McHenry. OK. And I ask that just for context, so that
is on the record. You know, this committee--I don't think
Congress looks at you as the culprit here, but we're asking for
your assistance in--well, in light of the fact the Senate has
not acted upon the President's nomination of the next Archivist
of the United States. But having said that, what policies have
changed in light of this additional security breach with the
loss of these Veterans' records?
Ms. Thomas. Mr. Congressman, I think I have to say that our
own determination is that we used a governmentwide contract,
that other agencies used, that have the appropriate privacy
protections written into the contract. And so that our use of
that contract was a valid way of sending back a disk.
Now, we've cited that we need to be beyond what's
acceptable. And we've adopted a policy; the CIO has, of not
sending disks back to the vendor. But we do not believe that
any breach has actually occurred, because the material was in
the hands of authorized people all along the process.
Mr. McHenry. So you have changed policy in that you don't
send out----
Ms. Thomas. We----
Mr. McHenry. If I may finish.
Ms. Thomas. I'm sorry.
Mr. McHenry. The two choices, Mr. Brachfeld, you testified
the two choices were to secure the data and keep even a failed
disk on hand, or send it back and replace it. Those were the
two choices. Now you've switched; is that correct?
Ms. Thomas. The new policy that's been adopted or in place
by the CIO is that we will not send any disks back to the
contractor.
Mr. McHenry. Mr. Brachfeld, thank you for your testimony.
You've always been very direct, as all Inspectors General are
supposed to be, and we certainly appreciate your work.
Has your office commented previously about this policy of
sending these drives out to contractors and getting them back?
Mr. Brachfeld. It simply never should have happened. Let me
read you a sentence, sir, or two. This is when one of the
contractors'--the most recent case is Dell. This is what Dell
said. ``Dell assumes no responsibility for the destruction of
data returned on such drives. Dell strongly encourages you to
remove all confidential, proprietary, or personal information
from any storage device before it is returned to Dell.'' We
didn't do that.
I brought with me a properly scrubbed, sanitized--this is a
drive right here. This drive for the purpose of this hearing,
this drive has veterans' information for millions of veterans.
It's mobile. I'm carrying it. It is a mobile device. It's game,
set, match.
If you go to NIST standards or if your go to OMB
requirements or if you go to NARA's own internal policy and
procedures, once you have PII data stored on a mobile device,
it must be encrypted. It must be encrypted, simple fact.
Furthermore, should you ship that or lose custody or give
up custody and control, it must be scrubbed, wiped, degaussed.
In neither case that we're talking about today was that done.
This data went out.
Now it's true. There is a language, boilerplate language,
that NARA found about 3 or 4 weeks ago in a contract, and
that's what they feel comfortable in telling you; that the
vendor, once they received this drive, was supposed to maintain
the confidentiality of the data.
But let's go with the first case, the CMRS drive. It didn't
just go to one vendor; it went to two, then three, then four.
It followed a food chain. First it went back to the company we
had a contract with. They sent it to another company to analyze
the data on the drive and see if the drive sectors failed. Then
it went to another company. And, finally, the fourth stop was a
scrap company for the metal scrap.
Now, that's pretty far down the food chain to lose control.
We don't know who had access to that within that company. We
don't know if it was stored physically in a safe location. We
don't know if somebody was embedded in one of these companies
who might see this as an opportunity to find Social Security
numbers or mine whatever data came their way for profit,
national security, etc. We don't know.
So what the National Archives did was violated their own
policy, which is derived from NIST standards and OMB
regulations, and lost control of millions of veterans' files
and records, and now, in the most recent case, thousands of
Federal employees. Those are the simple facts.
Mr. McHenry. Thank you, Mr. Brachfeld. Now, there was
originally veterans' data on that. What process did you go
through--is that currently encrypted or did you delete
information from that file?
Mr. Brachfeld. This--this drive did not--I'm very careful,
I am careful about what I do. This drive, I have the proper
certifications, before I would leave the building with this,
that it was wiped. And I have the technology that was used to
wipe the drive. I have it certified that it has no information
on it at this point. It is clear and again----
Mr. McHenry. Mr. Brill, could your company retrieve data
off of that ``wiped'' hard drive?
Mr. Brill. Sir, if the drive is wiped properly and
completely, the answer is generally you cannot. Here is the
problem. Either there's a big difference between ``I believe I
wiped the drive'' and ``I wiped the drive.'' We find, for
example, that organizations sometimes discover that a
disgruntled employee may have run a wiping program to get rid
of data that would incriminate them. But not all wiping
programs are created equally effectively. And some of them work
very, very well and some of them work not well at all. That's
why it's important not just to say ``wipe the drive'' but as I
think the Inspector General has suggested, that it be wiped in
a forensically acceptable way and possibly tested afterwards to
make sure that when we say there's no data that, in fact, there
is no data.
Mr. McHenry. Thank you for your testimony. I certainly
appreciate it. And I don't think this is necessarily about
contractors is Mr. Brachfeld's point; it is about secure chain
of possession of sensitive information.
And, Mr. Chairman, I think this is a larger cultural issue
with archives in terms of employee satisfaction and following
basic procedures. And I certainly appreciate your leadership in
making sure that we have good oversight of this to make sure we
correct this.
Mr. Clay. Thank you, Mr. McHenry, for your line of
questioning. Mr. Cuellar is recognized for 5 minutes.
Mr. Cuellar. Thank you very much, Mr. Chairman.
Ms. Thomas, let me ask you, looking at the big picture,
looking at this in hindsight, what do you think the weaknesses
are in this IT security? And also as the colleague just
mentioned, when you look at not only in your area, but in the
food chain or the custody down the line.
Just tell me overall, what do you think the weaknesses are?
Ms. Thomas. I think one of the things that is happening is
that, as Mr. Brill has sort of alluded to, technology is moving
at such a fast pace that things--processes and procedures that
were acceptable 6 months ago may not be acceptable today.
I know that when I moved to Virginia 30 years ago, my
driver's license number was my Social Security number. I think
our Social Security numbers were used on a lot of
documentation. You were asked to, when you wrote a check; write
your driver's license on it. That was your Social Security
number.
When all of the information--not all the information but a
good deal of the information became electronic and much easier
to manipulate and use in nefarious ways and all the data was in
a more concentrated small device, like Paul has mentioned, it's
becoming more and more of a challenge to deal with that and to
protect that information.
So our procedures, our policies, have to catch up to the
reality of today and continuously change as technology changes.
Mr. Cuellar. You said that we got to get our policies to
try--looking at the word ``try''--to catch up, are you caught
up?
Ms. Thomas. I think we are at the moment, but as Mr. Brill
has said, technology tomorrow, I don't know.
Mr. Cuellar. But you should have something in place that
lets you keep up----
Ms. Thomas. And that is certainly what the administration
is doing, that's what OMB is doing, NIST is doing, and we are
following those procedures.
Mr. Cuellar. Let's talk about the internal audit that you
conducted on your IT security. When was that performed and by
whom?
Ms. Thomas. We had a contractor, SAIC, come in and review
all of our IT security.
Mr. Cuellar. When was that?
Ms. Thomas. It was this past year.
Mr. Cuellar. What was the conclusion?
Ms. Thomas. Well, they came up with a series of
recommendations, I think I said 29 recommendations--at least
29--all of which we are working to implement. Most of them have
been by now, and we're working on all of them.
Mr. Cuellar. Out of 29, how many have been implemented?
Ms. Thomas. I would have to provide that for the record. I
don't know how many.
[The information referred to follows:]
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Mr. Cuellar. You don't know right now how many have been
implemented?
Ms. Thomas. I do not know. I know it's more than 50
percent, probably more like three-quarters.
Mr. Cuellar. You can see how that can be a problem. If you
do an internal audit to see what your weaknesses are and we
haven't implemented, how long would it take you to implement
100 percent of the recommendations, of 29 recommendations?
Ms. Thomas. I know that the CIO is working on implementing
all of the recommendations, and I am going to say that within
the next 6 months. And I may have to correct that after I talk
to the CIO. I'm sorry.
Mr. Cuellar. So if we are going to try to keep up with the
changes that you mentioned, have your policy keep up, we have
to wait another 6 months to implement those?
Ms. Thomas. These are identified weaknesses which we are
trying to correct in all instances. Some are more serious than
others. Those are the ones that we have tackled first.
Mr. Cuellar. Well, let me ask you, Mr. Brachfeld, was this
in fact an audit, and who performed it?
Mr. Brachfeld. It technically cannot be considered an
audit. It was performed by SAIC under what is called a Program
Review for Information Service Management Assistance. It's
called PRISMA. So it's not technically allowed to be called an
audit. It was not an audit. It does not--in fact; SAIC in their
PRISMA report, specifically states that it's not an audit.
Mr. Cuellar. What would you classify that?
Mr. Brachfeld. It's a review that was done for management,
in addition to the audit work that we do. Where we have
determined that IT Security is a material weakness, management
opted to get a second opinion, so to speak, and contracted for
SAIC to do that work. They came out with a finding of 29; I
believe it was, weaknesses that they identified.
Mr. Cuellar. Now you have reviewed those, that matter. Do
you know how many of the 29 recommendations NARA has
implemented?
Mr. Brachfeld. My IT auditors, whom I have a tremendous
amount of faith in and who have been right throughout in terms
of their analysis, determined that 27 of the 29 have not been
adopted to date. We believe that only two have been closed out
and completed to our satisfaction.
Mr. Cuellar. Mr. Chairman, can I just follow on up on that?
Twenty-seven out of the 29 have not been implemented?
Mr. Brachfeld. That was reported on September, I believe,
9th or 20th. It was reported just this past month to
management. We put together a matrix defining why we believe 27
to 29 had not been corrected. We requested a meeting in
September to discuss this. And it is now November 5th, and our
request for a meeting has not been addressed.
Mr. Cuellar. And the question, Mr. Chairman, was--I believe
Ms. Thomas' testimony was that more than half or three-quarters
of it had been implemented, and Mr. Brachfeld is saying that,
according to his folks, that only two have been implemented and
the meeting has not been set up, and I find that a little
disturbing.
Mr. Clay. Sounds like there is some discrepancy. Thank you.
Now, Ms. Thomas, you assured the subcommittee in July that
in regard to the theft or loss of the Clinton administration
hard drive, you would act with swift and appropriate
disciplinary action. Have you made your determinations as to
the causes of the theft or loss, and what specific actions have
you taken?
Ms. Thomas. The determination of what, how the hard drive
went missing, was stolen, is an investigatory responsibility of
the Inspector General. So we are waiting for the investigation
to be complete. We have, however, determined that there were
certainly internal control weaknesses that allowed whatever
happened to happen, and we have made substantial changes in the
way the controls of the equipment--who can have access to it--
and we are ready to take disciplinary action against those
people who were not following existing policy. But we are
waiting for the end of the investigation.
Mr. Clay. You could take action now in your agency?
Ms. Thomas. We have been requested not to by the Inspector
General. Yes, but we could take action now, were it not for
that standing request.
Mr. Clay. Mr. Brachfeld, is it complete?
Mr. Brachfeld. The investigation--your question is, is your
investigation complete? No. We are actively investigating it.
We have new information which I cannot discuss publicly at this
open hearing, but we do have progress in our investigation. And
as the nature of the investigation is extremely sensitive, the
acting Archivist is correct. We respectfully requested that
they hold off, because we don't want to do anything at this
point that could damage our investigation.
So in that case, that is correct. We have respectfully
requested that disciplinary action be held back pending the
furtherance of our investigation or in support of our
investigation.
Mr. Clay. Thank you for that response.
Mr. Powner, can you estimate the cost of integrating
increments one and two down the line? I mean, you stated that
it was a project at $550 million?
Mr. Powner. Right, $550 million life cycle cost. We have
spent about half of that to date. We do not have clear
integration costs going forward.
Here is the problem, not only with the integration costs
going forward, but when you look at the outyear increments, 3,
4 and 5, how are we going to allocate the remaining money?
There is a serious question with the remaining money to be
spent, including those integration costs, whether we are going
to get a full operational capability by 2012.
If you look at the track record to date, I think the answer
is likely no. And so what we want to see is real clear plans
for the next three increments and exactly what's going to be
delivered so we can measure to that.
This is similar in cost, Mr. Chairman--we were here a year
ago talking about FTCA. That was a $500 million contract at one
time, a system at one time that doubled quickly. We want to
avoid a situation like that.
Mr. Clay. Has there been a--I guess we will call it a
cavalier attitude with taxpayers' money in this instance?
Mr. Powner. I wouldn't say that. But I would say that the
management discipline that we would like to see from the
government is clearly not where we want it to be. And I will
give you an example where we look at these contractor reports
and we see contractor reports where they're spending money,
receiving funds, but not getting the work done. There's a
program management technique that is OMB-endorsed, called
earned value management. We look at those reports and scrub
them.
And what we need here is we need the program office to pay
close attention to those reports so that we are overseeing the
contractor and the government is in charge, not the contractor.
Mr. Clay. Would you supply this committee with a summary
report of the spending to this date and what problems you see
are on the horizon as far as the spending is concerned with
this program?
Mr. Powner. Yes, we can do that, Mr. Chairman.
Mr. Clay. Thank you so much. And I notice that you may have
wanted to get in on the discussion earlier on whether there are
industry standards that NARA could use that would have helped
this situation. Did you have a comment?
Mr. Powner. Well, the one comment on the multiple
classifications, GAO has done a lot of work on sensitive but
unclassified data. This is dated; but 2 to 3 years ago, there
were over 70 classifications of sensitive but unclassified
data. And I think the quick answer to the Congressman's
question is consolidating those many classifications is a clear
work in progress and it's incomplete.
Mr. Clay. Thank you for that response.
Mr. Brill, any comment on industry standards?
Mr. Brill. I think if there is anything to be said about
industry standards, there's recognition that the more complex
you make any program, the more likely you are to have problems.
If you can keep things simple, if you can classify things in a
limited number of buckets, and you have some clear rules about
what to do in each case, then it is much more likely that
you're going to have a very high degree of success in that
program.
We see all the time--you know, my work is kind of divided
in two, sir. In some cases, we are brought in, in advance, to
try and avoid problems. But in a lot of cases, we're the
firemen. We're the guys who get the call when something
terrible happens, and I think it would be fair to tell you that
when that happens, we can end up, in most cases, classifying
the incident into one of two major buckets. One is ``It
happened.'' The other is, ``It happened, but it shouldn't have
happened.'' It was an avoidable problem that, if rules had been
followed--if, for example, something as simple as a patch from
a vendor had been applied to a computer, wouldn't have
happened. If a firewall was properly configured, wouldn't have
happened.
If we can manage those, if we can avoid the avoidable
incidents by simplification, by good management, by good
followup, by good audits, that is key.
There will always be incidents. Human beings will always
make mistakes. Machines are not infallible. So, rather than
sometimes throwing up our hands and saying things happen, let's
classify it simply. Let's stop the things that we can
reasonably prevent through what I consider a commercially
reasonable set of controls, have plans in place for what we are
going to do if something happens in spite of our best efforts,
and recognize, as everybody has said here, that the environment
changes.
The first computer that I used at the Pentagon back in 1968
had 2,000 positions of memory, 2K. The systems in my office now
are measured not in kilobytes but in petabytes. And one
petabyte is 1 million gigabytes. The vast amounts of data mean
that we have to treat it in a systematic fashion. Those who
figure out how to do that, how to build the security into the
network, build it into the systems, tend to have fewer
mistakes. And the mistakes that occur don't fall into that
tragic category of ``We could have prevented this.''
Mr. Clay. Thank you so much. The gentlewoman from
California is recognized for 5 minutes, Ms. Watson.
Ms. Watson. Thank you so much, Mr. Chairman. And I came in
late and probably a lot of this has been already discussed.
But what would each one of you recommend after the
investigation into the breaches, into the delays and so on,
what would you recommend as we move forward? Because this
valuable information that is stored in the Archives, if there
are breaches or if the machinery in some way collapses, what
kind of backup systems do we need to have? What do we need to
build into our base equipment so, as you said, Mr. Brill, these
things should not have happened? Can any of you look forward
and tell us what you would like to see?
Mr. Brachfeld. I guess I'll tackle it. It's my nature; what
can I do.
There are two different issues here in terms of the
breaches and the events that transpired. I think that if you
look at NARA today, we have policies and procedures that are
defined because they have been derived from NIST and OMB. So we
have that piece of the equation.
The question, as we move forward now, is ensuring through
training and oversight that there's compliance with those
requirements and, as appropriate, punishment. Because those
regulations which are on our books, which are in our
requirements, say that if people violate the security
provisions, appropriate administrative and potentially criminal
action and criminal charges----
Ms. Watson. Who should do the oversight?
Mr. Brachfeld. I'm not a program official. I do audits
investigations. The agency is in charge with oversight of
programs, ensuring that their programs are implemented and
successful. So the agency needs to do that piece of the puzzle.
I'm there to provide whatever guidance and support I can in
that regard. And should somebody or an entity fail to live up
to their requirements, I'm there to do investigations. And if
it turns criminal, I'm there to do the criminal
investigations--and my staff.
Ms. Watson. Who determines there should be an
investigation? Whose responsibility would that be?
Mr. Brachfeld. That's my decision. If I'm alerted to--it
happens all the time. We get hotline calls. We get people
coming to us. We get formal referrals. Once my office becomes
aware of an event or events, we make a decision. My Assistant
Inspector General for audits and Assistant Inspector General
for investigations, we work the issue. We make determinations.
If we believe it's a potential for criminal, we work
through the Department of Justice, as we are required by law to
do. If we believe it's administrative, we take a different
track. Or if we believe that nothing inappropriate happened and
it's not my responsibility in that regard, we may just do a
referral. But it weighs on my shoulders and we address that.
Ms. Watson. Mr. Brill, you were mentioning that we should
have standards. What should we do in order to avoid these kinds
of, well, breaches? I don't know what you would do. But what
would you suggest?
Mr. Brill. It's as good a word as any, I suspect. You know,
it's an interesting thing. I have been sitting here thinking
about something and it's this. Back in about 1975, I was an
Army Reserve officer. I served Active and Reserve for 38 years.
And I was assigned to the Office of the Secretary of Defense as
a mobilization designee. And we started looking, even back
then, at information security.
And I remember a meeting that I had with the then-Deputy
Assistant Secretary of Defense for Audits, and I had just
successfully compromised a data center that I had been
requested to test out.
And what I said to him was this. How can you, how can you
go before Congress and have to say that the standards that
you're using maybe would not be acceptable in a major
corporation? I work with corporations primarily, not
governments. But what I found is there is an evolution. The
standards that have come out, the internal controls, as the
Inspector General has said, following things like Sarbanes-
Oxley, following the changes in governance, in the corporate
world, have changed things.
The changes that occurred in 2006 when the Federal Rules of
Civil Procedure were modified as a result of the work of the
Sedona Conference to recognize the importance of digital
records in the civil litigation process--there's been a sea
change. People are realizing that the key to this is good
management. It's no different than it was 100 years ago.
When we had paper records, we could preserve them, but that
didn't mean they were going to be readable unless we preserved
them properly and we protected them properly.
Digital records are no different. The techniques vary, but
the principles are the same. And isn't it always the same,
ma'am, that responsibility has to be taken, somebody has to be
the person that you can to talk to about it, and that there are
standards, whether we use the ISO standards, whether we use the
good work that's been done at NIST, whether we use the
standards of other organizations?
I don't really care what standards there are, but if we
have a standard and we all agree to it, then an agency knows
what to do. You know what you can ask them. The auditors know
that it's a fair game, that you're testing on the basis of
rules.
So I think what I'm seeing is that, just as corporations
have recognized that the way that they handled automated
records in the past is no longer acceptable, if you did what
you did a few years ago you're likely to find a judge holding
that you've committed spoliation, and that there could be
penalties for that.
Just as I said to the guy at the Defense Department years
ago, I think that if we are lucky as citizens, there's a two-
way street between the private sector and the public sector in
terms of exchanging knowledge, research that's done, best
practices. And to the extent that can be done, I think there's
great value to be had.
Let's see what some of the best-run companies are doing.
Let's see why the standards are changing. Let's see what's
being done. I think the real key in getting that information is
perhaps the simplest thing that anyone can do. And I can
express it in one word: Ask.
Ms. Watson. Thank you, Mr. Chairman. I yield back.
Mr. Clay. Thank you, Ms. Watson.
Just as a final question, Ms. Thomas, at a hearing last
month, we heard about your advisory committee on the electronic
records archives. NARA believes that the advisory committee has
been valuable in providing outside expert advice in the
development of ERA. Its members represent expertise in an
extremely wide range of areas. However, as far as we can tell,
the committee does not include one expert or even anyone with
direct experience in the area of information technology
security.
Why isn't this important field represented on your advisory
committee?
Ms. Thomas. I don't know whether there is any specific
person whose profession is information security. I think all of
the members who have responsibility for systems certainly have
responsibility for information security, security over those
systems and therefore come to the committee with a wealth of
experience in how they deal with their own systems.
Mr. Clay. Well, do they bring a knowledge of information
security like, for instance, your fellow panelist, Mr. Brill?
Ms. Thomas. I think Mr. Brill is unique.
Mr. Clay. I do too. But there has to be, just to have
someone----
Mr. McHenry. I think that is a compliment, Mr. Brill.
Ms. Thomas. It is. It is.
Mr. Clay. To have someone else represent that aspect of
information technology would be probably helpful to the
advisory committee.
Ms. Thomas. I think you're probably right, Mr. Chairman,
and we can certainly look at the membership and if we are
deficient in that, having that kind of person--maybe Mr. Brill
would even like to join ECERA.
Mr. Clay. We will let you and Mr. Brill discuss that. If
there are no other questions, the hearing is adjourned. Thank
you.
[Whereupon, at 4 p.m., the subcommittee was adjourned.]