Data leaks and security breaches happen every day. There is little we can do about it if we want to participate in today’s society, except perhaps replacing the companies we interact with with their competitors if we think one of them is safer. There is one service that we have no choice whether to interact with, no matter how high-profile its security incidents become: .
The Human Resources Hack, announced in 2015, leaked background investigation data that affected 21.5 million people. . Widely advertised Government and business documents discovered in 2020 were disclosed to Russian insiders. Earlier this year, the U.S. Marshals Service of the Department of Justice when hackers stole personal information about the objects of the investigation, personnel and much more.
The attacks were targeted, usually in search of sensitive government information. But we have all the sensitive information held by federal agencies, such as our social security numbers or home addresses. There is probably even more information at stake if you use federal services like Medicare, student loans, or SNAP benefits. We have no choice but to grant the federal government access to our personal information in exchange for certain services, unless you are reading this while living offline.
“If we want to live in the information age and use some of these systems, we are essentially relinquishing control,” Kevin Cleary, clinical assistant professor of control and systems at the University of Buffalo, told Engadget. “You have to trust that the agency has put forward all the best controls and practices.”
In response, the federal government has created agencies such as the Cybersecurity and Infrastructure Security Agency to lead better security initiatives across departments. This is partly intended to help you feel a little better about storing your data on federal servers by setting higher standards for protecting your data. According to Michael Duffy, deputy director of cybersecurity at CISA, since the agency’s inception in 2018, it has spearheaded the most progress he has seen in his cybersecurity career at the federal level.
So things are getting better, and you can probably trust the federal government to keep your data safe the same way you trust the companies you interact with every day. What makes government different is that it is a high-profile goal. Hostile countries want access to state secrets, but at the same time it is difficult for them to prioritize spending on security measures. Obtaining taxpayer funds to fill a pothole on a local highway is difficult when the damage is tangible and obvious, while safety is difficult to quantify until an attack occurs. In other words, the value of investing in security is not proven until it is too late.
It got better. Federal government investment in security . However, this is not enough. “Sometimes their budgets don’t allow them to do every step or everything they would like to do because you just don’t have the money,” said Marisol Cruz Kane, director of information technology and cybersecurity at the GAO.
But the reason the federal government may seem less secure is its commitment to transparency. There is a duty to share the lessons learned after the incident and make sure citizens know what happened. In fact, this is a big part of CISA’s work. “We’re really looking at ways to make it more acceptable to raise your hand and say that’s how we were attacked or the incident happened,” Duffy said.
The government also interacts with certain outside businesses. So let’s say a government contractor has a security breach or security incident, which means data held in federal technology could be exposed. This opens up many new attack vectors and opportunities for malpractice.
In fact, you can see how protected some agencies are thanks to the Government Accountability Office (GAO) and legislation such as the Federal Information Technology Acquisition Reform Act. Last including cyber readiness. The GAO, for its part, reviews cybersecurity efforts and develops these are public descriptions of what information the agency collects, how they use it, and more.
But with all these audits, relatively grim conclusions are coming. Agencies don’t evaluate their policies and procedures to make sure high-profile incidents don’t happen on a regular basis, Cruz Kane said. Your information will be on these servers whether you like it or not.