Protecting Data On Government Laptops
FindLawBy Eric Sinrod
In the past couple of months, the Department of Veterans Affairs, the Internal Revenue Service and the Federal Trade Commission have grappled with laptops that have gone missing that contained large amounts of private data.
As a consequence, the Executive Office of the President, Office of Management and Budget (OMB), has issued new security guidelines to address and compensate for the lack of physical security controls when information is removed from or accessed from outside of federal department and agency locations.
Specifically, the OMB recommends that all departments and agencies:
- Encrypt all data on mobile computers/devices that carry governmental data unless the data is determined to be non-sensitive;
- Allow remote access only with “two-factor” authentication where one of the factors is provided by a device separate from the computer gaining access;
- Use a “time-out” function for remote access and mobile devices that requires user re-authentication after 30 minutes of inactivity; and
- Log all computer-readable data extracts from databases holding sensitive information, and verify that each extract including sensitive data has been erased within 90 days or that its use is still required.
The purpose of the foregoing, as stated by OMB, is “to properly safeguard our information assets while using information technology.” While stopping short of issuing requirements, and instead promulgating recommendations, OMB nevertheless asks that the above safeguards be put in place within 45 days by federal departments and agencies.
Hopefully, the expression “good enough for government work” soon will include federal action with respect to OMB’s recommendations, and we will stop hearing about misplaced government laptops that contain easily accessible sensitive data.
Eric Sinrod is a partner in the San Francisco office of Duane Morris LLP (http://www.duanemorris.com) where he focuses on litigation matters of various types, including information technology and intellectual property disputes. His Web site is http://www.sinrodlaw.com and he can be reached at ejsinrod@duanemorris.com. To receive a weekly email link to Mr. Sinrod’s columns, please send an email to him with Subscribe in the Subject line.
This column is prepared and published for informational purposes only and should not be construed as legal advice. The views expressed in this column are those of the author and do not necessarily reflect the views of the author’s law firm or its individual partners.
Hardware
© 2006 FindLaw
