Security Ranked by State - IRS - General Accounting Office online Security
BACK TO SECURITYProtection of Privacy by States Is Ranked
Robert Ellis Smith, publisher of the monthly Study by Privacy Journal says ...
The federal government does a terrible job would rank in the 4th tier if it were a state.
The U.S.A. Patriot Act had diminished privacy. "The antiterrorist legislation in significant ways
made
it easier for law enforcement to conduct electronic surveillance," he said. "I don't think
they were gross invasions of privacy, but the changes have to be regarded as a net loss of
privacy."
The federal government has no regulation or guarantees privacy for
- 1) medical records, and the regime scheduled to go into effect next year is "weak."
- 2) financial privacy
- 3) no protection for the privacy of library records. "Most states do have laws that give great leverage to reject most requests" for information on users, though all have exceptions for formal law enforcement requests.
California and Minnesota protect the privacy of their citizens better than any other states, they have a
commitment to privacy rights, though he ranked California marginally ahead. Both have a permanent office
in
state government looking after privacy and both state supreme courts have reaffirmed the right to privacy.
Minnesota and California were also among the leaders in a 1999 version of the survey, which ranks states
on
whether they have privacy guarantees in their constitutions, laws protecting financial, medical, library
and
government files, and have fair credit reporting laws stronger than federal legislation. States are given
extra credit when their highest courts have strong records on privacy and receive deductions for
antiprivacy
actions by state agencies or legislatures.
California has a privacy office, and its Legislature is continually "tweaking" privacy laws to
stay on top of new intrusions.The court ruled that constitutional protections for privacy apply to private
as well as government actions.
Minnesota, the court has ruled that disclosure of private facts is a tort and law applies to local
governments as well as state government, and the state has the oldest established privacy office in the
country, always fully staffed and financed. He said Minnesota also received credit for an effective
lawsuit
in which Attorney General Mike Hatch won large damages from banks for selling information to
telemarketers.
The journal ranked states in five tiers.
Top Tier
California, Minnesota, Connecticut, Florida, Hawaii, Illinois, Massachusetts, New York, Washington and
Wisconsin.
Second Tier
Alaska, Arizona, Colorado, Georgia, Maine, Oklahoma, Rhode Island, Utah and Vermont.
Third Tier
Indiana, Louisiana, Maryland, Michigan, Montana, New Jersey, Nevada, Ohio, Oregon and Virginia.
Fourth Tier
District of Columbia, Alabama, North Dakota, Nebraska, New Hampshire, New Mexico, Pennsylvania, South
Carolina, Tennessee and West Virginia.
Fifth Tier
Arkansas, Delaware, Idaho, Iowa, Kansas, Kentucky, Mississippi, Missouri, North Carolina, South Dakota,
Texas and Wyoming.
Texas, ranked in 1999 as "not on the radar screen," improved its standing by
1) enacting laws restricting the use of genetic information by insurance companies and employers, and
the
2) requiring telemarketers not to call individuals who have entered their names on a state "do not
call" list.
Critical information security weaknesses at the Internal Revenue Service
http://www.fcw.com/fcw/articles/2003/0602/web-irs-06-02-03.asp
Critical information security weaknesses at the Internal Revenue Service demonstrate the
importance of moving past the development of an information security program to actually implement the
measures outlined in the plan.
The General Accounting Office found almost 900 weaknesses across the 11 IRS organizations included in its
review, particularly in the areas of access and authorization. All of the weaknesses can be traced to
IRS' incomplete implementation of its agencywide security program, according to the report dated May
30.
The IRS has made progress toward addressing security, including developing a milestone-based plan to fix
vulnerabilities -- a step required by the Office of Management and Budget under the Government Information
Security Reform Act of 2000 and continued under the Federal Information Security Management Act of
2002.
The tax agency also has increased the number of resources and people devoted to information security and
created an around-the-clock incident response team.
But the many weaknesses that still exist and the lack of an agencywide process to identify and address
future vulnerabilities leave sensitive personal data open to unauthorized users.
"Such individuals could possibly obtain personal taxpayer information and use it to commit financial
crimes in the taxpayer's name (identity fraud), such as establishing credit and incurring debt,"
the report states.
Beyond the need to meet all of the standard requirements, such as performing risk assessments and
certifying
and accrediting systems, GAO also strongly recommended incorporating accountability for security controls
into employee performance appraisals.
"Until such performance standards and measures are developed and incorporated into the appraisal
process, agency personnel may not devote sufficient attention and effort to implementing effective
security
controls," the report states.
In a written response to GAO, new IRS Commissioner Mark Everson said that his agency plans to address each
of the report's recommendations this year, although incorporating security into performance appraisals
will have to wait until fiscal 2004 because of legal constraints.