recommended reading

OPM Changes Privacy Rules to Let Investigators Inside All Databases

WASHINGTON, DC - JUNE 6: Sign at the Office of Personnel Management (OPM) in Washington, DC on June 6, 2015. OPM manages the civil service of the federal government.

WASHINGTON, DC - JUNE 6: Sign at the Office of Personnel Management (OPM) in Washington, DC on June 6, 2015. OPM manages the civil service of the federal government. // Mark Van Scyoc / Shutterstock.com

The Office of Personnel Management has rewritten privacy regulations to let investigators probe all of its databases for breaches.

The move to open systems housing medical files, defense mobilization emergency personnel information, and about 40 other types of records, comes after the discovery of significant entryways for hackers in at least three databanks.

The updated so-called "routine use" allows personal information to be shared with outsiders when OPM "suspects or has confirmed" that security has been compromised and disclosure "is reasonably necessary" for responding, according to a notice published Thursday. The new access rights apply to all OPM databases. 

Agency spokesman Sam Schumach told Nextgov, "This new routine use was added as part of OPM’s continuing comprehensive review," which was announced July 9. That was the day U.S. officials divulged that two cyber assaults excised sensitive details on 21.5 million federal employees, national security personnel and their families. The review was launched to find and immediately fix any other security vulnerabilities in OPM systems.

"As items are identified we are addressing them," Schumach said. 

So far, the agency has only revealed one significant weakness, located in an online portal for submitting background check forms on people potentially privy to classified intelligence. The system, called e-QIP, was taken offline last month and remains out of service. 

Under the new rule, external agencies, firms, or any "appropriate persons and entities” can probe data repositories in response to a breach, the notice states. 

OPM says the agency's previous privacy regulations did not slow its initial probe into the attacks, which began in April.  The lack of a breach-response clause "did not impede the investigation," Schumach said.

The provision makes it possible for ID theft protection and notification firms like CSID, the company retained by OPM, to see certain agency-held personal data, such as names and email addresses, said Odia Kagan, a privacy and information security attorney at Ballard Spahr LLP. 

"OPM has been under close scrutiny in the aftermath of the breach, including with respect to the time it took to notify individuals," she said. OPM still has not begun alerting over 15 million victims. 

The intrusion was discovered in April and notifications to 4.2 million affected people began June 8. Kagan questioned whether the absence of a specific breach clause hampered the probe. Without a usage policy, an agency would need to rely on other exceptions, interpretations of existing routine uses or consent “and this would indeed slow down both the investigation process and the post-breach notification process," Kagan said.

The public has until Aug. 17 to comment on the confidentiality changes announced by OPM last week. No comments had been filed as of Sunday. 

The agency’s regulation is reminiscent of contentious information sharing legislation that would make it easier for companies to exchange threat data with the government in the event of a breach. That could include customers' personal information. The goal of the proposals is to assist victimized firms and more quickly forewarn other organizations of possible attacks. 

The Senate’s version of the bill, the Cybersecurity Information Sharing Act, or CISA, reportedly could come up for a vote in August. The House passed companion legislation in April. 

Civil liberties activists say the measures are riddled with loopholes that could expose citizens to improper surveillance. 

"CISA only requires removal of information that is not directly related to a cyberthreat, meaning that victims’ personal information -- which is generally related to the threat -- will often go unprotected," Center for Democracy and Technology fellow Jake Laperruque said in June. 

The Obama administration threatened to veto an earlier incarnation of the bill, the Cyber Intelligence Sharing and Protection Act, better known as CISPA, which lacked certain safeguards to protect personal data during the information-sharing process.

It is unclear if all federal agencies will be adding a breach-response proviso to their database privacy rules. Nextgov has requested comment from the White House.

The OPM systems covered by the privacy change include:

  • Civil Service Retirement and Insurance Records
  • Inspector General Investigations Case File
  • Privacy Act/Freedom of Information Act Case Records
  • Personnel Investigations Records
  • Presidential Management Fellows Program Records
  • Executive Personnel Records
  • Debarment or Suspension Records for Federal Employee Health Benefits
  • Health Claims Data Warehouse
  • Federal Employees Health Benefits Program Claims Data Warehouse
  • Federal Competency Assessment Tool
  • General Personnel Records
  • Employee Performance File System Records
  • Records of Adverse Actions, Performance Based Reductions In Grade and Removal Actions, and Terminations of Probationers
  • Applicant Race, Sex, National Origin, and Disability Status Records
  • Employee Medical File Systems Records 
  • Defense Mobilization Emergency Cadre Records
  • Employee Counseling Services Program Records
  • Telephone Call Detail Records
  • Photo Identification and Visitor Access Control Records
  • OPM Child Care Tuition Assistance Records
  • Investigation Training Records

(Image via Mark Van Scyoc/Shutterstock.com)

Threatwatch Alert

Thousands of cyber attacks occur each day

See the latest threats

JOIN THE DISCUSSION

Close [ x ] More from Nextgov
 
 

Thank you for subscribing to newsletters from Nextgov.com.
We think these reports might interest you:

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

    Download
  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

    Download
  • Effective Ransomware Response

    This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.

    Download
  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

    Download
  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.

    Download

When you download a report, your information may be shared with the underwriters of that document.