Privacy Breach Panel 11/16/2009 Brian T. Zickel, HQDA Privacy Office…….Background & Process Chris Kaloudis, HQDA Privacy Office……..Metrics and Template Walkthrough Jennifer Nikolaisen, National Guard…………….Major Breach Best Practices Anastasia Kakel, TRADOC……………….................Remedial Action Richard Frank, Corps of Engineers……………Notification Linda Genovese, Corps of Engineers………..Reporting

Personally Identifiable Information (PII) Defined Personally Identifiable Information (PII) is data that links or can be combined with other PII elements to link to an individual. PII can be used to distinguish or trace an individual’s identity * OMB M-07-16 PII can be on stored in hard copy or electronic media form. The type of storage does not affect its status as PII or alter reporting requirements* Types of PII* Social Security Number regardless of truncation Physical Characteristics Race/Ethnicity, Biometrics etc) ID Numbers (i.e. badge numbers, driver's license etc.) Civilian Information (Dependant data, emergency contact info) Social/non-business data (religious affiliation, marital status) Truncated SSN Name You Home Address Ethnicity = FOUO Name SSN Brian T. Zickel 703-428-6791 brian.t.zickel@us.army.mil 11/162009

Reporting Loss or Suspected Breach of PII Flow Chart A BREACH OCCURS WHEN….* AN ACTUAL OR POSSIBLE LOSS OF CONTROL, UNAUTHORIZED DISCLOSURE, OR ACCESS, OCCURS REGARDLESS OF WHETHER DATA WAS EXPOSED INTERALLY OR EXTERNALLY *OMB M-07-16 Discoverer of the PII Breach Your Chain of Command cc: piireporting@us.army.mil Within 24 hours U.S. Computer Emergency Response Team (USCERT) http://www.us-cert.gov HQDA Privacy Office https://www.rmda.army.mil/privacy/foia-incidentreport1.asp Immediately Within 1 hour Remedial Training Work with local Privacy Office to determine notification procedures Internal/External Investigation Notify Affected Individuals Within 10 days DAASA DoD Privacy Office Public Affairs CIO-G6 Brian T. Zickel 703-428-6791 brian.t.zickel@us.army.mil 11/16/2009 2

Tracking PII Incidents Keep leadership informed Track success of PII Safeguarding Training Purposes Trends of Breach Chris Kaloudis 703-428-7499 Chris.kaloudis@us.army.mil 11/16/2009

Laptop Incidents Chris Kaloudis 703-428-7499 Chris.kaloudis@us.army.mil 11/16/2009

Thumbdrive Incidents Chris Kaloudis 703-428-7499 Chris.kaloudis@us.army.mil 11/16/2009

Individuals Potentially Affected Chris Kaloudis 703-428-7499 Chris.kaloudis@us.army.mil 11/16/2009

DoD - PII Reporting Template DoD Component and organization involved: Component Name       Organization POC Title/Organization Telephone Email 6. Total number of individuals affected by the breach: # Unknown       6a. Breakout number by category: Government Civilians       Government Contractors Military (Reserve) Military (Dependent) Military (Active) Military (Retired) Other/Unknown (please specify)       Chris Kaloudis 703-428-7499 11/16/2009

PII Breach Lessons Learned Establishment of call center procedures/script News release template & public website Leadership brief/daily SITREP templates Media inquiries/interview requests Privacy complaint handling procedures Internal announcements about incident Contract review/accountability Process for non-deliverable notice letters Answering Congressional committee inquiries Jennifer Nikolaisen 11/16/2009

What to Expect After A Major Breach Increased Privacy focus from leadership Requests for privacy training for personnel DoD attention on PIA completion on systems Scrutiny and more review of program Revision/development of procedures Possible increase in complaints/FOIAs Credit monitoring requests from those impacted Planning/preparation to avoid another one! Jennifer Nikolaisen 9/18/2018

Remediation Remedial actions: If negligence or failure to follow established policy and procedures Counseling/additional training/removal of authority to access information or systems /administrative and/or disciplinary actions Financial liability investigation of property loss (FLIPL) or statement of charges Criminal penalties (Privacy Act – guilty of a misdemeanor and fined up to $5,000) Anastasia Kakel / DSN 680-2035 11/16/2009

TRADOC Case Study Soldier left laptop unsecure in car at mall Failure to follow policy Investigation FLIPL: Soldier required to pay for replacement of computer ($1200.00) Counseling Anastasia Kakel / DSN 680-2035 11/16/2009

Good to know Conduct spot checks of security and data at rest encryption Information Assurance Manager (NETCOM/TNOSC/DOIM) – force protection and OPSEC review info loss Scrutinize the collection of PII, in particular SSNs; ensure the DTM 07-015-USD(P&R) – DOD SSN Reduction Plan DOD “acceptable uses” apply Anastasia Kakel / DSN 680-2035 11/16/2009

Good to know Sources of breach identification Data mining to verify PII is contained Update PII loss policy for common issues New system of records in APMS Follow record disposition schedules Anastasia Kakel / DSN 680-2035 11/16/2009

External Notification Is Breach Notification Required? Response Team Risk of Harm (5 factors) and Level of Risk/Impact Timeliness of Notification Within 10 days of discovering breach and identifying individuals Source of Notification Component Head or Senior Official Contents of Notification What happened, type of data, was it protected, individual steps, agency actions, agency contact - See DoD list Means of Providing Notification First Class Mail, Telephone, E-mail, Generalized (substitute) Who Receives Notification Individuals, Media, Businesses POC: Richard Frank, (202)761-8557 11/16/2009

External Notification Is Breach Notification Required? Response Team Risk of Harm (5 Factors) Nature of Data Elements - Type of Data in Context Number Affected Accessible and Usable Likelihood Breach May Lead to Harm Ability to Mitigate Risk of Harm Level of Risk/Impact Mitigating Factors - Protections, Chilling Effects, Ongoing Investigation, false alarm 15 POC: Richard Frank, (202) 761-8557 11/16/2009

US Army Corps of Engineers PII Incident Reporting Business Process Linda Genovese 11/16/2009 16