	Background

Virtually all federal operations are supported by automated systems,  mobile devices, and electronic media that may contain sensitive  information such as Social Security numbers, medical records, law  enforcement data, national or homeland security information, and  proprietary information that could be inappropriately disclosed, browsed,  or copied for improper or criminal purposes. Implementation of a risk-based framework of management,  operational, and technical controls that includes controls such as  encryption technology can help guard against the inadvertent compromise  of sensitive information. Using  small, easily pilferable devices such as laptop computers, handheld  personal digital assistants, thumb-sized Universal Serial Bus (USB) flash  drives, and portable electronic media such as CD-ROMs and DVDs,  employees can access their agency’s systems and information from  anywhere. Commercially Available Encryption Technologies Can Help Agencies Reduce Risks

Commercially available encryption technologies can help federal agencies  protect sensitive information and reduce the risks of its unauthorized  disclosure and modification. While many technologies exist to protect data, implementing them  incorrectly—such as failing to properly configure the product, secure  encryption keys, or train users—can result in a false sense of security or  even render data permanently inaccessible. Key Laws Frame Practices for Information Protection, while Federal Policies and Guidance Address Use of Encryption

Although federal laws do not specifically require agencies to encrypt sensitive  information, they give federal agencies responsibilities for protecting it. In  addition, other laws frame practices for protecting specific types of sensitive  information. Efforts to Encrypt Sensitive Information Varied among Agencies

The extent to which 24 major federal agencies reported that they had  implemented encryption and developed plans to implement encryption  varied across agencies. As a result of these weaknesses, federal information  may remain at increased risk of unauthorized disclosure, loss, and  modification. Overall, the 24 agencies reported that about 70  percent of laptop computers and handheld devices had not been  encrypted. However, while agencies were encrypting  sensitive data on mobile computers and devices such as laptop computers  and handheld devices (e.g. In addition, agencies had not documented  comprehensive plans to guide activities for effectively implementing  encryption. We also recommend that the Secretary of the Department of Education  direct the chief information officer to take the following five actions to  improve the life cycle management of encryption technologies:    evaluate, select, and install FIPS 140-compliant products for all encryption  needs and document a plan for implementation that addresses protection  of all sensitive information stored and transmitted by the agency;    configure installed FIPS-compliant encryption technologies in accordance  with FIPS-validated cryptographic modules security settings for the  product;   develop and implement departmentwide policy and procedures for  encryption key establishment and management;   develop and implement departmentwide procedures for use of FIPS-   develop and implement a training program that provides technical support  and end-user personnel with adequate training on encryption concepts,  including proper operation of the specific encryption products used. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to determine (1) how commercially  available encryption technologies could help federal agencies protect  sensitive information and reduce risks; (2) the federal laws, policies, and  guidance for using encryption technologies to protect sensitive  information; and (3) the extent to which agencies have implemented, or  planned to implement, encryption technologies to protect sensitive  information. To address the second objective, we reviewed prior GAO and agency  inspector general reports to identify relevant laws and guidance such as  the Federal Information Security Management Act of 2002 (FISMA) and  the Privacy Act of 1974 to identify mandatory and optional practices for  protecting sensitive information (including personally identifiable  information but excluding classified national security information) that  federal agencies collect, process, store, and transmit.
Why GAO Did This Study

Many federal operations are supported by automated systems that may contain sensitive information such as national security information that, if lost or stolen, could be disclosed for improper purposes. Compromises of sensitive information at numerous federal agencies have raised concerns about the extent to which such information is vulnerable. The use of technological controls such as encryption--the process of changing plaintext into ciphertext--can help guard against the unauthorized disclosure of sensitive information. GAO was asked to determine (1) how commercially available encryption technologies can help agencies protect sensitive information and reduce risks; (2) the federal laws, policies, and guidance for using encryption technologies; and (3) the extent to which agencies have implemented, or plan to implement, encryption technologies. To address these objectives, GAO identified and evaluated commercially available encryption technologies, reviewed relevant laws and guidance, and surveyed 24 major federal agencies.

What GAO Found

Commercially available encryption technologies can help federal agencies protect sensitive information that is stored on mobile computers and devices (such as laptop computers, handheld devices such as personal digital assistants, and portable media such as flash drives and CD-ROMs) as well as information that is transmitted over wired or wireless networks by reducing the risks of its unauthorized disclosure and modification. For example, information stored in individual files, folders, or entire hard drives can be encrypted. Encryption technologies can also be used to establish secure communication paths for protecting data transmitted over networks. While many products to encrypt data exist, implementing them incorrectly------such as failing to properly configure the product, secure encryption keys, or train users------can result in a false sense of security and render data permanently inaccessible. Key laws frame practices for information protection, while federal policies and guidance address the use of encryption. The Federal Information Security Management Act of 2002 mandates that agencies implement information security programs to protect agency information and systems. In addition, other laws provide guidance and direction for protecting specific types of information, including agency-specific information. For example, the Privacy Act of 1974 requires that agencies adequately protect personal information, and the Health Insurance Portability and Accountability Act of 1996 requires additional protections for sensitive health care information. The Office of Management and Budget has issued policy requiring federal agencies to encrypt all data on mobile computers and devices that carry agency data and use products that have been approved by the National Institute for Standards and Technology (NIST) cryptographic validation program. Further, NIST guidance recommends that agencies adequately plan for the selection, installation, configuration, and management of encryption technologies. The extent to which 24 major federal agencies reported that they have implemented encryption and developed plans to implement encryption of sensitive information varied across agencies. From July through September 2007, the major agencies collectively reported that they had not yet installed encryption technology to protect sensitive information on about 70 percent of their laptop computers and handheld devices. Additionally, agencies reported uncertainty regarding the applicability of OMB's encryption requirements for mobile devices, specifically portable media. While all agencies have initiated efforts to deploy encryption technologies, none had documented comprehensive plans to guide encryption implementation activities such as installing and configuring appropriate technologies in accordance with federal guidelines, developing and documenting policies and procedures for managing encryption technologies, and training users. As a result federal information may remain at increased risk of unauthorized disclosure, loss, and modification.