The FBI needs to improve its handling of electronic media designated for destruction at its facilities, according to a scathing audit from the Justice Department’s Inspector General, released publicly last week. .
The memo, issued by DOJ Inspector General Michael Horowitz, highlights that the bureau is failing to properly label and track internal hard drives containing sensitive and top-secret national security information once they are removed from computers and servers.
Storage devices containing sensitive information, including national security data, Foreign Intelligence Surveillance Act (FISA) material, and documents classified as Secret, were often improperly labeled or not labeled at all, heightening the risk of loss or theft.
Additionally, FBI officials are unable to confirm if these drives were destroyed in accordance with bureau policy. The same issues apply to thumb drives, flash drives, and floppy disks, which are also being mishandled in violation of FBI protocols.
“The lack of accountability for these media increases the risk of loss or theft without the possibility of detection,” Horowitz stated.
The OIG’s report, addressed to FBI Director Christopher Wray, highlights the gravity of these findings. Despite FBI protocols mandating strict procedures for labeling and securing such data, the agency failed to consistently adhere to these guidelines.
The report highlights instances where media containing classified information was stored in unapproved containers or locations, significantly compromising security. Additionally, the FBI’s process for the destruction of these devices was found to be inadequate, with critical gaps that could potentially expose sensitive information to unauthorized access.
Cigent CGO Brett Hansen comments: “Meeting mission requirements and the ever-evolving threat landscape can make ensuring the integrity of data throughout its lifecycle a daunting task. Organizations like the FBI first need to universally adopt proven techniques and technology for safeguarding vulnerable data at the edge.
Hansens says these include Hardware Full Drive Encryption with Pre-boot Authentication and Multi-Factor Authentication. Proper data disposal is also imperative; again, there are technologies that can verify that all data is permanently erased.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.