recommended reading Security Gaps Identified in Contractor Documents

House Oversight Committee Chairman Rep. Darrell Issa, R-Calif.

House Oversight Committee Chairman Rep. Darrell Issa, R-Calif. // J. Scott Applewhite/AP

This story has been updated to include comment from HHS and Rep. Elijah Cummings, D-Md.

A congressional watchdog investigating the troubled launch of the Obama administration’s online health insurance marketplace released a handful of contractors’ statements on Tuesday showing they were concerned about security vulnerabilities before and soon after the site launched.

In response to the release from House Oversight and Government Reform Committee Chairman Rep. Darrell Issa, R-Calif., a Health and Human Services Department spokeswoman said all of the concerns noted by the contractors had been addressed or were being addressed and that the entire system met federal standards for information security. 

There have been no sucessful cyberattacks against to date and no one has maliciously gathered citizens' personal data, spokeswoman Joanne Peters said.

Contractors last week turned over a cache of documents to Issa in response to a subpoena. They released the documents over the objection of HHS officials who argued releasing the documents publicly could give hackers a roadmap to the site’s security vulnerabilities and endanger insurance seekers’ personal information.

Issa has said he does not intend to release information in a way that would endanger Americans’ security but feels compelled to warn Americans about security risks if they’re entering personal information into

Issa is consulting with security experts to determine what information from the contractors is safe to release, he said in a letter on Tuesday to Health and Human Services Secretary Kathleen Sebelius. He also agreed to meet with Sebelius and said he would “welcome a page-by-page discussion of the [subpoenaed contractor] documents and [about] any concerns about the public release of any information.”

Seblius' office said it would respond to Issa directly. 

Issa quoted a handful of statements from the subpoenaed documents in a press release on Tuesday. The documents showed that the contractor MITRE Corp., which concluded a security assessment of about two weeks after its Oct. 1 launch, was concerned about gaps in the site’s security

The Oct. 11 assessment described 19 security threats that had not been addressed at that point. It’s not clear how many of MITRE’s concerns have been fixed in the roughly two months since the report was issued.

In describing one vulnerability, the report stated, “any malicious user having knowledge of this can perform unauthorized functions.” Regarding another vulnerability, the report stated, “The [cyber] attacker is able to see and edit [personally identifying information] of the [insurance seeker].”

Oversight's ranking member Rep. Elijah Cummings, D-Md., disputed the second claim in a letter to House Speaker John Boehner on Tuesday, saying Issa failed to disclose that the MITRE report noted the issue had been resolved. 

Cummings accused Issa of "cherry picking" half-sentences from the documents in "a reckless and transparent attempt to frighten Americans away from the website and deny them health insurance."

MITRE also omitted large parts of the system from its security assessment because those parts were not yet prepared to be tested, according to selections from the documents.

A rush before the launch date and limited testing were early suspects in the investigation into’s poor performance.

Issa and other oversight committee members were previously given redacted copies of the contractors’ documents and allowed to read, but not keep, unredacted copies. His subpoena was aimed at securing unredacted copies that he could keep and potentially release to the public.

Democratic committee members have accused Issa of grandstanding at the expense of Americans’ security and asked House leadership to intervene.

Since a self-imposed repair deadline of Nov. 30, officials say has been functioning smoothly with error rates lower than 1 percent and page response times of less than 1 second. It’s still unclear whether the upgraded site will draw in enough insurance seekers to make a key element of President Obama’s landmark health care reform law sustainable.

Under the terms of Obamacare, uninsured people must purchase insurance or pay a penalty beginning in 2014. If too many young and healthy people choose to pay the penalty rather than buy insurance, that could increase the risk in insurance pools, making older and sicker people’s premiums unsustainably costly.

Enthusiasm for the site may be further dampened by concerns about security vulnerabilities. 

Threatwatch Alert

Thousands of cyber attacks occur each day

See the latest threats


Close [ x ] More from Nextgov

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Data-Centric Security vs. Database-Level Security

    Database-level encryption had its origins in the 1990s and early 2000s in response to very basic risks which largely revolved around the theft of servers, backup tapes and other physical-layer assets. As noted in Verizon’s 2014, Data Breach Investigations Report (DBIR)1, threats today are far more advanced and dangerous.

  • Featured Content from RSA Conference: Dissed by NIST

    Learn more about the latest draft of the U.S. National Institute of Standards and Technology guidance document on authentication and lifecycle management.

  • PIV- I And Multifactor Authentication: The Best Defense for Federal Government Contractors

    This white paper explores NIST SP 800-171 and why compliance is critical to federal government contractors, especially those that work with the Department of Defense, as well as how leveraging PIV-I credentialing with multifactor authentication can be used as a defense against cyberattacks

  • Toward A More Innovative Government

    This research study aims to understand how state and local leaders regard their agency’s innovation efforts and what they are doing to overcome the challenges they face in successfully implementing these efforts.

  • From Volume to Value: UK’s NHS Digital Provides U.S. Healthcare Agencies A Roadmap For Value-Based Payment Models

    The U.S. healthcare industry is rapidly moving away from traditional fee-for-service models and towards value-based purchasing that reimburses physicians for quality of care in place of frequency of care.

  • GBC Flash Poll: Is Your Agency Safe?

    Federal leaders weigh in on the state of information security


When you download a report, your information may be shared with the underwriters of that document.