Audit: No one in charge of Indian trust data

FROM THE ARCHIVE

Facebook Twitter Email
WEDNESDAY, MAY 22, 2002

The Department of Interior's information technology systems could be plunged into chaos again based on the findings of a team of federal computer security experts.

More than five months after numerous security problems were first exposed, the audit has highlighted significant obstacles to an effort flagged as "high risk" by the White House. Lack of accountability, limited funds and little direction are among the major challenges cited, according to a 294-page draft report completed last month.

"Management commitment to computer security exists on paper, but not on practical implementation," the computer security expert assist team (CSEAT) of the National Institute of Standards and Technology wrote on April 1.

The most damaging finding, however, affects the status of computer systems that process $3.1 billion in annual payments to tribes and individual Indians. Shut down by a federal judge's order in December, a court investigator has allowed the gradual reconnection of dozens of Indian trust systems based on sworn declarations by department officials and employees under an effort overseen by Associate Deputy Secretary Jim Cason.

But according to the audit, no one is in charge of Indian trust data despite appearances otherwise. Senior officials, including Special Trustee Tom Slonaker and other top leaders, have failed to take the initiative to define this very basic concept, the experts reported, a problem that permeated the department to its lowest levels.

"Individuals that have responsibilities for processing trust information state that their job does not involve such information," the report stated. "Other individuals that know they process Indian trust information are unsure of which pieces of information are Indian trust information and which are not."

The lack of a clear meaning of Indian trust data was at the center of intense and slow-moving negotiations between Cason and special master Alan Balaran, whose investigation uncovered risks to hackers. After months of talks, the last major system which processes payments to tribes and Indians was restarted in March.

In all the cases, Balaran gave his nod based on assurances to the protection of trust data. Based on the NIST review, the certifications offered by the Interior would be in doubt because of failures of top officials to define a key term.

The department acknowledged the review's shortcomings in its most recent status update. "Indian trust information is not safeguarded due to inconsistent and ineffective leadership," Cason wrote in a section of the report that discussed a briefing received by NIST.

Cason also reported the results of a January 2002 audit by SRA International, a computer security firm that has been retained by the department and whose reports have documented long-standing problems went largely ignored until recently. The company identified nearly 600 vulnerabilities, 96 percent of which were classified as "high" risks.

SRA and NIST, which is part of the Department of Commerce, made similar findings about the lack of program planning, according to the Interior's 9th quarterly report. Cason said the department would provide comments to NIST this month in preparation for a final analysis.

Relevant Links:
Indian Trust, Department of Interior - http://www.doi.gov/indiantrust
Indian Trust: Cobell v. Norton - http://www.indiantrust.com
Trust Reform, NCAI - http://130.94.214.68/main/pages/
issues/other_issues/trust_reform.asp