BIA begins phased reconnection to the Internet

A federal judge has ruled that FISMA effectively cancels a 2001 court order that prohibited the Bureau of Indian Affairs from connecting to the Internet without the court’s consent.

Judge James Robertson of the U.S. District Court for the District of Columbia ruled that FISMA, which was enacted after the 2001 court order, puts accountability for computer information systems security in the hands of the top leader at federal departments and agencies. That being the case, Robertson ruled that the standing court order is moot. “Under FISMA, it is the agency head who is responsible for . . . providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification or destruction of information,” Robertson wrote. “Notably absent from FISMA is a role for the judicial branch,” he added. In this latest ruling in the class-action lawsuit against Interior, Robertson acknowledged he is troubled by congressional and inspectors general reports that show Interior receiving failing grades on its information security report card. However, he concluded, “it is not my role to weigh IT security risks.” On the federal government’s annual FISMA report card, released today, Interior received an F, the same grade it received the previous year. A spokesman for Elouise Cobell, a member of the Blackfeet tribe in Montana, which brought the lawsuit against Interior, said the plaintiffs hope to see the case brought to a close. The plaintiff's' lawyers have not decided whether to appeal the ruling, said Bill McAllister, Cobell’s spokesman. “We’re getting ready for a trial set for June 6,” he said. “This will be what the judge hopes will be the final trial in the case.” Howell said the court order has impaired BIA’s ability to provide services and communicate with the tribes for which the agency has trust responsibility. Internally, he added, BIA has been communicating very inefficiently. “We’ve been burning up fax machines and sneaker net.”

A federal judge, lifting a court order that lasted nearly seven years, has told the Bureau of Indian Affairs it can reconnect employees’ desktop PCs to the Internet. The judge ruled that federal law — the Federal Information Security Management Act of 2002 —  effectively cancels a 2001 court order that prohibited BIA from connecting to the Internet without the court’s consent.

The May 14 ruling came in a long-running class-action suit brought against the Interior Department for allegedly mishandling Indian trust records. The ruling means that BIA and employees in four other offices affected by the court order can get back to normal: They will no longer have to leave their desks to do work on a limited number of Internet access computers set up without connections to the department’s internal computer networks.

“We’ve been anticipating this [ruling] for a long time,” said Michael Howell, Interior’s chief information officer. The department’s plans for reconnecting BIA and four other offices have been sitting on a shelf waiting for the disconnection order to be lifted, Howell said.

“We have a very detailed recconnection plan that we’re executing now,” he said.

The reconnection order, which affects about 10,000 employees in hundreds of locations nationwide, will permit the Office of the Special Trustee, the Office of Historical Trust Accounting, the Office of Hearing Appeals and the Office of the Solicitor, in addition to BIA, to reconnect to the Internet. Howell said it will take a couple of months to complete the phased reconnection plan.

Cobell v. Kempthorne