OPM Changes Privacy Rules to Let Investigators Inside All Databases

The Office of Personnel Management has rewritten privacy regulations to let investigators probe all of its databases for breaches.

The move to open systems housing medical files, defense mobilization emergency personnel information, and about 40 other types of records, comes after the discovery of significant entryways for hackers in at least three databanks.

The updated so-called "routine use" allows personal information to be shared with outsiders when OPM "suspects or has confirmed" that security has been compromised and disclosure "is reasonably necessary" for responding, according to a notice published Thursday. The new access rights apply to all OPM databases. 

Agency spokesman Sam Schumach told Nextgov, "This new routine use was added as part of OPM’s continuing comprehensive review," which was announced July 9. That was the day U.S. officials divulged that two cyber assaults excised sensitive details on 21.5 million federal employees, national security personnel and their families. The review was launched to find and immediately fix any other security vulnerabilities in OPM systems.

"As items are identified we are addressing them," Schumach said. 

So far, the agency has only revealed one significant weakness, located in an online portal for submitting background check forms on people potentially privy to classified intelligence. The system, called e-QIP, was taken offline last month and remains out of service. 

Under the new rule, external agencies, firms, or any "appropriate persons and entities” can probe data repositories in response to a breach, the notice states. 

OPM says the agency's previous privacy regulations did not slow its initial probe into the attacks, which began in April.  The lack of a breach-response clause "did not impede the investigation," Schumach said.

The provision makes it possible for ID theft protection and notification firms like CSID, the company retained by OPM, to see certain agency-held personal data, such as names and email addresses, said Odia Kagan, a privacy and information security attorney at Ballard Spahr LLP. 

"OPM has been under close scrutiny in the aftermath of the breach, including with respect to the time it took to notify individuals," she said. OPM still has not begun alerting over 15 million victims. 

The intrusion was discovered in April and notifications to 4.2 million affected people began June 8. Kagan questioned whether the absence of a specific breach clause hampered the probe. Without a usage policy, an agency would need to rely on other exceptions, interpretations of existing routine uses or consent “and this would indeed slow down both the investigation process and the post-breach notification process," Kagan said.

The public has until Aug. 17 to comment on the confidentiality changes announced by OPM last week. No comments had been filed as of Sunday. 

The agency’s regulation is reminiscent of contentious information sharing legislation that would make it easier for companies to exchange threat data with the government in the event of a breach. That could include customers' personal information. The goal of the proposals is to assist victimized firms and more quickly forewarn other organizations of possible attacks. 

The Senate’s version of the bill, the Cybersecurity Information Sharing Act, or CISA, reportedly could come up for a vote in August. The House passed companion legislation in April. 

Civil liberties activists say the measures are riddled with loopholes that could expose citizens to improper surveillance. 

"CISA only requires removal of information that is not directly related to a cyberthreat, meaning that victims’ personal information -- which is generally related to the threat -- will often go unprotected," Center for Democracy and Technology fellow Jake Laperruque said in June. 

The Obama administration threatened to veto an earlier incarnation of the bill, the Cyber Intelligence Sharing and Protection Act, better known as CISPA, which lacked certain safeguards to protect personal data during the information-sharing process.

It is unclear if all federal agencies will be adding a breach-response proviso to their database privacy rules. Nextgov has requested comment from the White House.

The OPM systems covered by the privacy change include:

• Civil Service Retirement and Insurance Records
• Inspector General Investigations Case File
• Privacy Act/Freedom of Information Act Case Records
• Personnel Investigations Records
• Presidential Management Fellows Program Records
• Executive Personnel Records
• Debarment or Suspension Records for Federal Employee Health Benefits
• Health Claims Data Warehouse
• Federal Employees Health Benefits Program Claims Data Warehouse
• Federal Competency Assessment Tool
• General Personnel Records
• Employee Performance File System Records
• Records of Adverse Actions, Performance Based Reductions In Grade and Removal Actions, and Terminations of Probationers
• Applicant Race, Sex, National Origin, and Disability Status Records
• Employee Medical File Systems Records 
• Defense Mobilization Emergency Cadre Records
• Employee Counseling Services Program Records
• Telephone Call Detail Records
• Photo Identification and Visitor Access Control Records
• OPM Child Care Tuition Assistance Records
• Investigation Training Records

(Image via Mark Van Scyoc/Shutterstock.com)