Federal Agency Data Privacy Protection Act

Mr. Speaker, I move to suspend the rules and pass the bill (H.R. 5835) to amend title 38, United States Code, to improve information management within the Department of Veterans Affairs, and for other purposes, as amended.

Mr. Speaker, as chairman of the Committee on Veterans' Affairs, I rise in strong support of H.R. 5835, and I yield myself such time as I may consume.

Mr. Speaker, having moved H.R. 5835, as amended, the Veterans Identity Credit Security Act of 2006, I, along with Ranking Member Lane Evans and Acting Ranking Member Bob Filner, Chairman Davis, and Ranking Member Waxman of the Committee on Government Reform, Chairman Walsh and Ranking Member Edwards on the Appropriations Subcommittee on Military Quality of Life and Veterans Affairs, and other members of this body introduced this legislation on July 19, 2006.

Since 2000, the Veterans' Affairs Committee and our subcommittees have held 16 hearings on information technology at the Department of Veterans Affairs, and as a subset, information security issues. These hearings have covered a variety of IT issues, including the budget, organization, authorities, actions VA has taken regarding its IT programs, and of course information security.

Last year, the House passed H.R. 4061 to address problems in IT at the VA. The Senate and the administration can best be described as having stiff-armed us in our proposals to centralize the IT architecture at the VA, opting for more of what they call now a federated model, or what I will also refer to as an incremental approach. That is how they wanted to proceed. Then bad things happened.

This summer, we held 8 hearings in response to the May 3 theft of a loaned lap-top belonging to the VA that held the sensitive personal data of 26.5 million veterans and 2.2 million Guard and Reserve component servicemembers and families. We heard from 23 witnesses during our hearings. These witnesses included the VA's Secretary, the Inspector General, the General Counsel, as well as others from academia, the Government Accountability Office, and experts in data security, information technology management, and identity theft.

Mr. Speaker, I applaud Secretary of Veterans Affairs Jim Nicholson for his stated commitment to making the VA the gold standard in information security. H.R. 5835, as amended, will provide the Secretary with some of the tools needed to make the VA that gold standard and set an example for the Federal Government.

H.R. 5835, as amended, provides the chief information officer the authority to enforce information security in the Department. It also requires a monthly briefing to the Secretary on VA's compliance with the Information Security Management Act of 2002, which we refer to as

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, I will cherish the sincerity of the compliment from Mr. Filner. I do not question his commitment nor his motive to the service of veterans in this country. I think members of the committee over the last 14 years have recognized that Mr. Filner and I have had some real battles, but at the same time, when it comes to this particular issue on IT, there is no difference. We walk together in lockstep.

It is not just Mr. Filner and I. It is the entire committee over the years we have taken this on, even when I chaired the oversight investigations. So I appreciate the commitment on both sides on improving the IT infrastructure.

I also want to compliment the Government Reform Committee, because they have taken this issue on over the years.

Mr Speaker, I yield 4 minutes to the gentleman from Virginia (Mr. Tom Davis), chairman of the Government Reform Committee, and thank him for his cooperation in working with our committee. He introduced his own bill on notification provisions. He worked with us and waived jurisdiction. We incorporated that in our bill.

Mr. Speaker, the gentleman from South Carolina has requested 2 minutes of me, and I have great fear that the slowest talking man from the First District of South Carolina may not make the mark. But let's see how he does.

I yield 2 minutes to the gentleman from South Carolina (Mr. Brown), the chairman of the Health Subcommittee of the Committee on Veterans' Affairs.

Mr. Speaker, I am so proud of my friend from South Carolina for delivering those remarks within the limits of time.

Mr. Speaker, I yield 2 minutes to the gentleman from Arkansas (Mr. Boozman).

I appreciate the chairman's contribution to the bill. He chairs the Economic Opportunity Subcommittee on Veterans Affairs.

At this time, I yield 2 minutes to Mr. Murphy of Pennsylvania, who also worked with us on the bill. He had his own bill, H.R. 6109, dealing with encryption; and we worked with the gentleman. We have three legacy platforms which are basically older operating systems. We were not able to achieve everything the gentleman has been seeking, but I want to appreciate the gentleman's sincerity and his effort and want to continue to work with the gentleman.

At this time, I would like to yield 1 minute to the gentleman from San Diego, California (Mr. Bilbray), who helped us work on the provisions of the bill.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, I want to thank you for allotting the time for us to bring this bill to the floor. This is bipartisan legislation. It reflects proposals introduced in this Chamber over the past months. I thank the Members and staff who contributed to this legislation. I am especially grateful for the support of Lane Evans and Bob Filner in moving this bill through the committee and to the floor.

I want to thank Chairman Davis and Ranking Member Waxman of the Government Reform Committee in our work on the FISMA component of the bill. I also would like to thank Chairman Oxley and Ranking Member Frank of the Financial Services Committee for their assistance in moving this bill to the floor, as well as the Appropriations Subcommittee on Military Quality of Life and Veterans Affairs Chairman Walsh and Ranking Member Edwards, and to recognize again that information security is crucial to our veterans and have provided valuable support for this legislation.

I also commend Mr. Bilirakis and Mr. Strickland, the chairman and ranking member of the Subcommittee on Oversight and Investigations, for their oversight of IT at the VA. I am indebted to the chairmen and ranking members of the committee's Subcommittees on Health, Disability Assistance and Memorial Affairs and Economic Opportunity for their help in reviewing the VA's data security and coming up with this legislation.

Mr. Speaker, several Members introduced legislation after the May 3 loss, including Representatives Hooley, Salazar, and Bilbray from the Committee on Veterans Affairs. Representatives Blackburn, Andrews, Drake, Capito, and Granger also introduced legislation, and all of this legislation was taken into account to create this product that has come to the floor. So this is a pretty good work product, to also include that of the gentleman from Pennsylvania.

I also want to thank the Subcommittee on Oversight and Investigations; the staff director, Art Wu; and minority staff director, Lynn Sistek, for their work on this legislation.

Mr. Speaker, I urge my colleagues to support our veterans by passing H.R. 5835, the Veterans Identity and Credit Security Act of 2006. This legislation will safeguard the sensitive personal information of veterans, and help lay the groundwork for a national solution

Mr. Speaker, I yield back the balance of my time and urge all Members to support this legislation.

Mr. Speaker, I rise today to support H.R. 5835, to amend Title 38, United States Code 106-348, to improve information management within the Department of Veterans Affairs, and for other purposes.

In June, the Defense Department revealed that the personal information of about 2.2 million National Guard and Reserve troops was stolen from a government employee's house. In August of this year, the Department of Veterans Affairs reported that a subcontractor's missing laptop contained personal information of some 16,000 veterans and their families who were treated in VA medical centers in Pittsburgh and Philadelphia.

Even more astonishing is the fact that earlier this month, the Commerce Department reported that 1,100 of its laptops were missing from the last five years, some containing personal data from the U.S. Census Bureau.

These incidences of missing sensitive personal data are no small matters of concern. All of us as citizens of this great country expect to enjoy the privilege of privacy when it comes to our often sensitive personal data. As we are all well aware, such information can be easily mishandled and misused to the detriment of anyone who becomes so- victimized.

This reason alone is why it is crucial to provide sufficient safeguards to prevent or at the very least minimize the degree to which the privacy of sensitive personal data of our veterans as well as all the citizens of this country may become compromised.

H.R. 5835 provides safeguards to: Amend FISMA (Federal Information Security Management Act) to authorize the Director of OMB to establish data breach policies for agencies to follow in the event of a breach of data security involving the disclosure of sensitive personal information and which harm to an individual could reasonably be expected to result; Amend FISMA to clarify authority of Chief Information Officer to enforce data breach policies and develop and maintain IT inventories; Amend FISMA to define sensitive personal information as ``any information about an individual maintained by an agency, including: education, financial transactions, medical history, criminal or employment history; information that can be used to distinguish or trace the individual's identity, including name, Social Security number, date and place of birth, mother's maiden name, or biometric records; or any other personal information that is linked or linkable to the individual;

Create the position of Under Secretary for Information Services in the VA and mandates that this individual serve as the VA's CIO;

Mandate that the office of the Under Secretary for Information Services shall consist of the three Deputy Under Secretaries (at least one of whom is to be a career employee);

Call for the VA to ensure that the CIO has the authority and control necessary to execute responsibilities under FISMA and requires an annual FISMA compliance report to be submitted to the Committees on Veterans' Affairs of the House and Senate, the House Government Reform Committee, and the Senate Homeland Security and Governmental Affairs Committee; it also requires a monthly report from the VA CIO to the VA Secretary regarding compliance deficiencies; and to require immediate notification by the CIO to the VA Secretary of any data breach, and notice by the VA to the Director of OMB, VA IG, and if appropriate, to the FTC and Secret Service;

Require quarterly reports from the VA to the Committees on Veterans' Affairs of the House and Senate on any data breach that occurred in the previous quarter and to also require prompt notice in the event of a significant data breach;

Require the VA to undertake, as soon as possible after a data breach, an independent risk analysis (conducted by a non-VA entity). The Secretary shall then make a determination, based upon this analysis, if there exists a reasonable risk for potential misuse of the compromised data. If the Secretary does determine that this potential exists, then the VA is required to provide credit protection services. In the event of any data breach, the VA shall notify all affected individuals of the breach and inform them that they may request, at no charge, a fraud alert and a credit security freeze for a period of one year. The notification is to clearly spell out the advantages and disadvantages to requesting these actions;

Require the VA to provide credit protection services, including data breach analysis, credit monitoring services and identity theft insurance, to covered individuals (defined as individuals whose sensitive personal information is involved in a data breach, on or after August 1, 2005 for which the Secretary determines a reasonable risk exists for the potential misuse of the sensitive personal information). Authorizes the VA to contract with other government agencies and credit reporting agencies to provide these services;

Require that when the VA enters into a contract that the contractor shall not compromise any sensitive personal information. In the event of a breach, the contractor shall pay liquidated damages (which will then be used by the VA to provide credit protection services);

Require the VA to submit a report not later than 180 days after enactment concerning the feasibility of using Personal Identification Numbers for identification purposes in lieu of Social Security numbers;

Require the President to nominate the Under Secretary for Information Services and the VA to appoint the Deputy Under Secretaries within 180 days of enactment. Requires a report on the progress of the nomination and appointments every 30 days.

All of these measures are essential pieces to ensuring that the privacy of personal sensitive data of all of our citizens is not compromised. We are far behind in taking action to ensure that integrity of information in this nation. This bill is an important first step.

I urge my colleagues to support this resolution.

Mr. Speaker, I yield myself such time as I may consume.

As Chairman Buyer stated, a near catastrophe occurred in early May of this year when a lap-top containing 26 million names and data, Social Security data and some medical data, was stolen from a VA employee's home. Now, this theft of data was not just human error, it was not just an accident, it was not just bad luck. As Mr. Buyer had been pointing out for many years, this was a systemic problem, a problem of incredibly bad management of cyberinformation at the VA, a lack of cybersecurity, a lack of centralization of responsibility for cybersecurity, and it could have resulted in identity theft for millions of our Nation's veterans.

We were lucky. Apparently, the lap-top was recovered before the names were stolen. Although I don't have 100 percent confidence in that judgment, that is what we think right now. But the Committee on Veterans' Affairs, under the leadership of Chairman Buyer, saw this as a wake-up call, a time to change failed policies, a time to change directions. Under the leadership of Chairman Buyer, the Committee on Veterans' Affairs took this wake-up call as an opportunity to change the way things were going, to change a backward culture, and to bring the VA into the 21st century.

Now, Mr. Buyer had been saying such things about the need for cybersecurity and the need for centralization for many years. I have to say, Mr. Buyer, that I admire your persistence and your lack of discouragement when people did not pay attention. We should have. But we are now, and we thank you for doing all that work at a time when people did not pay much attention.

I think you have, you have set up a model here in the bill that other Departments in the government should be looking at. You have set up a model where we can in fact say to the people who our government is serving, we are protecting your identity, we are protecting your data, we are making sure that if there is any breach of that, we will take these steps to make sure you don't have any losses, either material or psychological. And that was a real problem in the VA which you recognized.

When this data was stolen, there was incredible fear throughout the country, because the VA did not have the steps ready to take to assure the veterans that they would not suffer any material or other loss. So, Mr. Buyer, I thank you for working not only in a bipartisan manner, but bicameral and bicommittee. You brought everybody into the process.

The committee held hours and hours of hearings. We checked out all the expertise in the country. Our chairman, Mr. Buyer, brought expertise from all around the Nation. I think we took the role of oversight that is appropriate for every committee in this Congress, that is, we had a problem with the executive branch, we went to work to make sure that we had the knowledge, we had the information, we had the attention of the executive branch; and this bill is a result of that effort.

I think Mr. Buyer described what was in the bill. I just want to point out that it establishes data breach notification requirements, it makes substantive changes to how the VA addresses information technology, and it clarifies how the VA is to comply with the Federal Information Security Management Act of 2002.

Most importantly, it provides veterans with the tools that they can use immediately to protect themselves in the case of future data breaches. If a veteran's data is compromised, they can immediately request that a fraud alert be placed on their credit files for a period of 1 year, as well as a credit security freeze.

It also mandates that the VA undertake an independent analysis of any data breach, and if it is determined that a reasonable risk of misuse exists, then the VA will provide a range of remediation services, including making available data breach analysis, credit reports, credit monitoring services, and identity theft insurance.

Finally, and again, Mr. Buyer, your creativity here was very important, knowing that an agency like the VA, which does not have the background or information or expertise, you said let's create a scholarship fund so we can train people in this area and that the VA can fund and then draw on that new expertise to improve its services in the cybersecurity area.

So, again, I think this is a model for other agencies to look at, the way you looked at a problem and not only tried to solve it, but moved us forward with a real creative program of scholarship and loan forgiveness that I think will help students in our Nation and, of course, help our Federal Government.

The VA Secretary, Mr. Nicholson, has stated that the goal now is to make the VA the gold standard in data security. I hope he takes advantage of this bill to allow him to reach that goal.

I thank Chairman Buyer for the way he undertook the oversight, the bipartisan way we approached this bill, the drawing on all the Members for their ideas and their expertise, and I urge us all to support this bill.

Mr. Speaker, I reserve the balance of my time.

Mr. Speaker, I yield myself such time as I may consume.

Mr. Speaker, again, to have the chairman of another committee testify to working together is really I think a good model. So thank you again, Mr. Chairman.

Mr. Speaker, I yield such time as she may consume to the gentlewoman from South Dakota (Ms. Herseth), the ranking member of our Economic Opportunities Subcommittee of the VA committee, a lady who has left much of her fingerprints on this bill. We thank you for your expertise, your real ability to stick to the issues here.

Mr. Speaker, again, I think this is an incredibly good bill. It shows the way we ought to work as a Congress and as a committee. Again, I thank one more time Mr. Buyer for his leadership and urge passage of the bill.

I yield back the balance of my time.

Chairman Buyer, I thank you and Mr. Filner for your leadership on this.

Secure information is the lifeblood of effective government policy and management, yet Federal agencies continue to hemorrhage vital data. Recent losses of personal information compel us to ask, what is being done to protect the sensitive digital identities of millions of Americans, and how can we limit the damage when personal data goes astray?

As we all now know, a Department of Veterans Affairs employee reported the theft of computer equipment from his home, equipment that stored more than 26 million records containing personal information. VA leadership delayed acting on the report for almost 2 weeks while millions were at risk of serious harm from identity theft and the agency struggled to determine the exact extent of the breach.

But this is only one in a long string of personal information breaches in the public and private sectors, including financial institutions, data brokerage companies, and academic institutions. Just last week, we learned the Census Bureau cannot account for 1,100 laptops issued to employees. These breaches illustrate how far we have to go to reach the goal of strong, uniform government-wide information security policies and procedures.

On our committee, we focused on government-wide information management security for a long time. The Privacy Act and the E- Government Act of 2002 outline the parameters for the protection of personal information. These recent incidents highlight the importance of establishing and following security standards for safeguarding personal information. They also highlight the need for the proactive security breach notification requirements for organizations, including Federal agencies, that deal with sensitive personal information.

Congress has been working on requirements for the private sector, but Federal agencies present unique requirements and challenges, and these incidents demonstrate that we need to strengthen laws and rules protecting personal information held by Federal agencies.

Given the VA incident, and in order to get a more complete picture of the problems before pursuing legislation, our Committee sent a request to every Cabinet agency seeking information about data breaches.

The results are in, and they are troubling. We have learned there has been a wide range of incidents involving data loss or theft, privacy breaches and security incidents. In almost all of these cases, Congress and the public would not have learned of such events unless we had requested the information. This history of withholding incidents has to stop.

Our committee bill, which has been incorporated as a manager's amendment in section 2, requires that timely notice be provided to individuals whose sensitive personal information could be compromised by a breach of data security at a Federal agency.

Despite the volume of sensitive information held by agencies, until now there has been no requirement that people be notified if their information is compromised. Under this legislation, the administration must establish practices, procedures, and standards for the agencies to follow if sensitive personal information is lost or stolen and there is reasonable risk of harm to an individual; and we provide a clear definition of the type of sensitive information we are trying to protect. We also give the agency CIOs the authority when appropriate and authorized to ensure that agency personnel comply with the information security laws that are already on the books.

Finally, we ensure that costly equipment containing potentially sensitive information is accounted for and secure. Half of the lost Census Bureau computers simply weren't returned by departing or terminated employees. The agency did not track computer equipment, nor were employees held accountable for failing to return it. This is taxpayer-funded equipment containing sensitive information, and we have to know who has it at all times.

Each year our committee releases information security score cards. This year the VA earned an F, the second consecutive year and fourth time in the past 5 years the Department received a failing grade, and the government overall got a D-plus.

Our Federal Government has sensitive personal information on every citizen, health records, tax returns, military records. If our government can't secure this information, who can? We need to ensure the public knows when its sensitive personal information has been lost or compromised in some way.

I again want to commend my colleagues, Chairman Buyer, Ms. Pryce, Mr. Sweeney, Mr. Filner, all who recognize the importance of securing personal information held by agencies. I appreciate their work in supporting this issue. The provisions we have included in this bill are a great first step. If new policies and procedures are not forthcoming quickly or if they fail to have the teeth to get the job done, we will revisit the matter.

Mr. Speaker, I rise in support of H.R. 5835, the Veterans Identity and Credit Security Act.

Earlier this year, millions of veterans saw their economic security threatened when several VA computers were stolen from a Veterans Administration (VA) employee's home. While it appears that no veteran was a victim of ID theft, the VA was ill-prepared to deal with the lost of this highly personal and confidential information.

While I am pleased to support this bill, which will help safeguard veterans' personal information in the future, I urge this Congress to immediately pass legislation that will protect all Americans from ID theft, not just our veterans. The threat of ID theft is too important to ignore any longer.

Data security is an issue that we have labored over for months, and while this will protect America's veterans from breaches of data security, the American public wants Congress to act to protect its private information as well.

As many of my colleagues have outlined during the debate today, this bill takes several steps to empower the VA to combat ID theft. It creates a new Office of the Under Secretary for Information Services within the Department. The bill also requires the VA to notify affected individuals when sensitive, personal information held by VA is lost, stolen, or otherwise compromised. In addition, the bill requires the VA to provide services to alleviate any loss those individuals might suffer, if the Secretary of VA determines there is a risk that the compromised information could be used in a criminal manner. Another important provision in the bill requires contractors to pay damages to VA if the compromised information was under the contractors' control. The combination of these provisions represents a well thought through piece of legislation.

Mr. Speaker, having ones identity stolen can unleash a lifetime of problems for its victims. It can impair buying a home, applying for jobs and loans as well as a host of other problems.

I am pleased to support this bill to help protect our veterans from these personal and economic pitfalls. I urge my colleagues to support this bill.

Mr. STEARNS. Mr. Speaker, I rise to support H.R. 5835, the Veterans Identity and Credit Security Act of 2006. I was deeply concerned that nearly 27 million veterans may have been affected by a data security breach of record proportions, that could have compromised sensitive, personal information. Twenty-six-and-a-half million veterans, and 2.2 million Guards, Reservists, and active duty servicemembers, were at risk. Fortunately, we recovered the stolen laptop and forensic analysis revealed the data was uncompromised. While it turned out that no veterans' information was jeopardized, it was a lesson in carelessness that cannot be repeated. We have learned from this incident what steps we must take to (a) change the organizational structure

and requirements at the VA, and (b) design a meaningful package of action items we will deliver for veterans should a breach ever occur again. Now we must implement them.

Unfortunately, data breaches like this highlight the need for legislation I have authored: H.R. 4127, the Data Accountability and Trust Act (DATA). This bill, which the Energy and Commerce Committee has passed, goes to the heart of this problem of the critical need to protect consumers' personal information. Let's fix this.

I thought, and Chairman Buyer agreed, that while we are instructing the VA when they must notify veterans, let's not limit ourselves to notification by ``snail mail''. I appreciate the Chairman's incorporating my language into H.R. 5835. The standard of business practice is--if a consumer or veteran in this case prefers--to communicate in writing by e-mail, because it is immediate and portable. What if a veteran is now in the Florida National Guard, serving in Iraq, and suffers a breach? We would not want him or her to wait for a hard copy letter to make its way. Secondary to providing better service to the veteran, this would save tremendous money to the VA, money better spent on veterans health care and services: I understand the May 2006 notification mailing cost the VA about $7 million.

Through both of my Committee seats, I will continue to take an active role in ensuring that veterans, and all consumers, feel confident and secure about their financial and personal information. And, thank you, Chairman Buyer, for your steadfast leadership on this issue for years.