recommended reading Security Gaps Identified in Contractor Documents

House Oversight Committee Chairman Rep. Darrell Issa, R-Calif.

House Oversight Committee Chairman Rep. Darrell Issa, R-Calif. // J. Scott Applewhite/AP

This story has been updated to include comment from HHS and Rep. Elijah Cummings, D-Md.

A congressional watchdog investigating the troubled launch of the Obama administration’s online health insurance marketplace released a handful of contractors’ statements on Tuesday showing they were concerned about security vulnerabilities before and soon after the site launched.

In response to the release from House Oversight and Government Reform Committee Chairman Rep. Darrell Issa, R-Calif., a Health and Human Services Department spokeswoman said all of the concerns noted by the contractors had been addressed or were being addressed and that the entire system met federal standards for information security. 

There have been no sucessful cyberattacks against to date and no one has maliciously gathered citizens' personal data, spokeswoman Joanne Peters said.

Contractors last week turned over a cache of documents to Issa in response to a subpoena. They released the documents over the objection of HHS officials who argued releasing the documents publicly could give hackers a roadmap to the site’s security vulnerabilities and endanger insurance seekers’ personal information.

Issa has said he does not intend to release information in a way that would endanger Americans’ security but feels compelled to warn Americans about security risks if they’re entering personal information into

Issa is consulting with security experts to determine what information from the contractors is safe to release, he said in a letter on Tuesday to Health and Human Services Secretary Kathleen Sebelius. He also agreed to meet with Sebelius and said he would “welcome a page-by-page discussion of the [subpoenaed contractor] documents and [about] any concerns about the public release of any information.”

Seblius' office said it would respond to Issa directly. 

Issa quoted a handful of statements from the subpoenaed documents in a press release on Tuesday. The documents showed that the contractor MITRE Corp., which concluded a security assessment of about two weeks after its Oct. 1 launch, was concerned about gaps in the site’s security

The Oct. 11 assessment described 19 security threats that had not been addressed at that point. It’s not clear how many of MITRE’s concerns have been fixed in the roughly two months since the report was issued.

In describing one vulnerability, the report stated, “any malicious user having knowledge of this can perform unauthorized functions.” Regarding another vulnerability, the report stated, “The [cyber] attacker is able to see and edit [personally identifying information] of the [insurance seeker].”

Oversight's ranking member Rep. Elijah Cummings, D-Md., disputed the second claim in a letter to House Speaker John Boehner on Tuesday, saying Issa failed to disclose that the MITRE report noted the issue had been resolved. 

Cummings accused Issa of "cherry picking" half-sentences from the documents in "a reckless and transparent attempt to frighten Americans away from the website and deny them health insurance."

MITRE also omitted large parts of the system from its security assessment because those parts were not yet prepared to be tested, according to selections from the documents.

A rush before the launch date and limited testing were early suspects in the investigation into’s poor performance.

Issa and other oversight committee members were previously given redacted copies of the contractors’ documents and allowed to read, but not keep, unredacted copies. His subpoena was aimed at securing unredacted copies that he could keep and potentially release to the public.

Democratic committee members have accused Issa of grandstanding at the expense of Americans’ security and asked House leadership to intervene.

Since a self-imposed repair deadline of Nov. 30, officials say has been functioning smoothly with error rates lower than 1 percent and page response times of less than 1 second. It’s still unclear whether the upgraded site will draw in enough insurance seekers to make a key element of President Obama’s landmark health care reform law sustainable.

Under the terms of Obamacare, uninsured people must purchase insurance or pay a penalty beginning in 2014. If too many young and healthy people choose to pay the penalty rather than buy insurance, that could increase the risk in insurance pools, making older and sicker people’s premiums unsustainably costly.

Enthusiasm for the site may be further dampened by concerns about security vulnerabilities. 

Threatwatch Alert

Thousands of cyber attacks occur each day

See the latest threats


Close [ x ] More from Nextgov

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

  • Effective Ransomware Response

    This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.

  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.


When you download a report, your information may be shared with the underwriters of that document.