A14: GUARANTEE PRIVACY AND SECURITY
CUSTOMERS DESERVE INTEGRITY, AVAILABILITY, AND CONFIDENTIALITY IN ALL ELECTRONIC TRANSACTIONS WITH THE FEDERAL GOVERNMENT Imagine this: A senior citizen, using a personal computer at a public library, can look up current, accurate information on his social security benefits.
A businesswoman sends wage information to the government for tax and social security purposes. She can do so using a desktop computer without risking her employees' or company's privacy.
A small business owner applies for a federal loan over the company's office automation system using the Internet. The integrity of the loan application is maintained by digital authentication, and its confidentiality, by scrambling the information while it is being transmitted.
Interconnecting computers and databases -- integral to many of the Access America initiatives -- increases the need for privacy and security safeguards. Public confidence in the security of the government's electronic information and information technology is essential to creating government services that are more accessible, efficient, and easy to use. Electronic commerce, electronic mail, and electronic benefits transfer share sensitive information within government, between the government and private industry or individuals, and among governments. These electronic systems must protect the information's confidentiality, assure that the information is not altered in an unauthorized way, and be available when they are needed. A corresponding policy and management structure must support those protections. These systems must also be able to support the government's responsibilities to provide for national security, support law enforcement, enhance global competitiveness and productivity for U.S. business and industry, and protect privacy and civil liberties. All this must be done in a flexible, cost-effective manner, through a collaboration among the public, industry, academia, and the government.
This challenge was recognized in the September 1993 Report of the National Performance Review, which set out a series of actions to address it.1 A great deal of progress has been made.
One of the Nation's most important values is individual privacy. As with all areas of technology use, the challenges are not solely or even primarily technical ones. A policy and management infrastructure is needed.
In response to growing public concern, the Administration's Information Infrastructure Task Force (IITF) published Privacy Principles in June 1995 to guide future Administration privacy efforts.2 Developed with extensive consultation with the private sector, these principles were immediately endorsed by the private sector U.S. Advisory Council on the National Information Infrastructure.
Many of the specific actions in the September 1993 Report involved information security. Progress on these actions includes:
NEED FOR CHANGE
Although much has been accomplished, the dynamic changes in technology and its uses, the political and social climate, and potential threats to information systems only increase the urgency. The systems that support the initiatives in this report must be sufficiently reliable and trustworthy to gain the public's confidence. Without substantial progress on the security and privacy fronts, many of the initiatives will not realize their full potential of improving service to the public.
Particular attention is needed to protecting information privacy, and to making further progress in the use of cryptography to ensure the integrity and authentication of information.
1. Create a privacy champion within the Government Information Technology Services (GITS) Board.
Given the importance of information privacy to the ideas in this report, the GITS Board should immediately add a member who has responsibility for ensuring that privacy issues are considered and addressed in all government wide information technology initiatives.
2. Complete the privacy work of the IITF.
By May 1997, the Information Policy Committee of the Information Infrastructure Task Force should publish for comment a discussion of the pros and cons of creating a permanent entity within the federal government that would focus on resolving privacy issues. The Committee should also determine how the Privacy Principles can be further publicized and formalized.
3. Accelerate work on digital signatures and encryption.
The Federal Public Key Infrastructure Steering Committee, under the direction of the Interagency Working Group on Cryptography Policy (IWG), should expand its demonstrations of the practicability of a key management infrastructure that supports the use of digital signatures and, for confidentiality keys, the use of key recovery. The demonstration should include the core set of electronic self-service transactions identified by the GITS Board. (See Action A01.1.) The IWG should provide a progress report on the demonstration projects by December 1997.
1That Report stated that in order to have trustworthy, readily available information, and computer systems that are user-friendly, secure, and protective of individual privacy, those systems must: safeguard information, facilities, information systems, and networks against illegal or unauthorized access, modification, or disclosure; balance access to agency information and records with appropriate privacy controls; respect private ownership of information and comply with policies and disclosure procedures for government use of individual information; and incorporate privacy and security safeguards early in the design of the system. "Reengineering Through Information Technology," Accompanying Report of the National Performance Review, September 1993.
2PRINCIPLES FOR PROVIDING AND USING PERSONAL INFORMATION
National Information Infrastructure Task Force, June 1995
General Principles for All National Information Infrastructure Participants
Personal information should be acquired, disclosed, and used only in ways that respect an individual's privacy.
Personal information should not be improperly altered or destroyed.
Personal information should be accurate, timely, complete, and relevant for the purpose for which it is provided and used.
Principles for Users of Personal Information
Information users should:
Information users should use appropriate technical and managerial controls to protect the confidentiality and integrity of personal information.
Information users should not use personal information in ways that are incompatible with the individual's understanding of how it will be used, unless there is a compelling public interest for such use.
Information users should educate themselves and the public about how information privacy can be maintained.
Principles for Individuals Who Provide Personal Information
Individuals should obtain adequate, relevant information about:
Individuals should be able to safeguard their own privacy by having:
Individuals should, as appropriate, have a means of redress if harmed by an improper disclosure or use of personal information.
4 OMB revised Appendix III, Security of Federal Automated Information, of OMB Circular A-130, Management of Federal Information Resources, February 1996. The new Appendix: (1) requires agencies to include information security as part of each agency's strategic IT plan; (2) includes computer security issues as a material weakness in the Federal Managers Financial Integrity Act report; (3) requires employees and contractors to complete awareness training; (4) improves planning for contingencies; and (5) establishes and employs formal emergency response capabilities.
NIST published Special Publication 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems in September 1996. In the encryption area, NIST developed, and the Secretary of Commerce approved and issued, the Secure Hash (FIPS 180) and Digital Signature (FIPS 186) Standards, the Data Encryption Standard (FIPS 46) and the Key Escrow Standard (FIPS 185).
These documents and other information security reference materials can be found on the Computer Security Resource Clearinghouse World Wide Web site at http://csrc.nist.gov.