July 2011

In a letter to two US Senators, the Obama Administration has refused to publicly disclose the extent of government tracking of American citizens -- or even to describe the legal basis on which it is conducting such tracking.

"We will get back to you," the letter says. Sens Ron Wyden (D-OR) and Mark Udall (D-CO) have emerged in recent months as the Senate's leading critics of unfettered government surveillance. In mid-July, they sent a letter to Director of National Intelligence James Clapper seeking information about whether the federal government had "the authority to collect the geolocation information of American citizens for intelligence purposes." They also asked about the number of Americans whose communications have been intercepted (FISA warrants are only supposed to target non-Americans) and details on rumored incidents of intelligence officials failing to comply with the law. In a July 26 letter, Clapper aide Kathleen Turner politely brushed aside all of these questions. She refused to publicly divulge any details about the nature, extent, or legal basis of the government's domestic spying activities. Instead, she directed Wyden and Udall to classified materials the administration had already made available to members of Congress, and offered to discuss the Senators' concerns in greater detail in a classified briefing.

A coalition of consumer electronics companies and public interest groups say the cable industry has not demonstrated any progress towards a robust retail market for set-tops and is instead trying to forestall Federal Communications Commission action to create that market. "In fact, they confirm that after a decade and a half of product demonstrations and announcements, the mandate established by Congress in Section 629 remains unfulfilled," said the groups, led by the Consumer Electronics Association.

Federal agencies are increasingly making use of social media technologies, including Facebook, Twitter, and YouTube, to provide information about agency activities and interact with the public. While the purposes for which agencies use these tools vary, they have the potential to improve the government’s ability to disseminate information, interact with the public, and improve services to citizens.

However, the widespread use of social media technologies also introduces risks, and agencies have made mixed progress in establishing appropriate policies and procedures for managing records, protecting the privacy of personal information, and ensuring the security of federal systems and information. Specifically, just over half of the major agencies using social media have established policies and procedures for identifying what content generated by social media is necessary to preserve in order to ensure compliance with the Federal Records Act, and they continue to face challenges in effectively capturing social media content as records. Without clear policies and procedures for properly identifying and managing social media records, potentially important records of government activity may not be appropriately preserved. In addition, most agencies have not updated their privacy policies or assessed the impact their use of social media may have on the protection of personal information from improper collection, disclosure, or use, as called for in recent OMB guidance. Performing PIAs and updating privacy policies can provide individuals with better assurance that all potential privacy risks associated with their personal information have been evaluated and that protections have been identified to mitigate them. Finally, most agencies did not have documented assessments of the security risks that social media can pose to federal information or systems in alignment with FISMA requirements, which could result in the loss of sensitive information or unauthorized access to critical systems supporting the operations of the federal government. Without conducting and documenting a risk assessment, agency officials cannot ensure that appropriate controls and mitigation measures are in place to address potentially heightened threats associated with social media, such as spear phishing and social engineering.

To ensure that federal agencies have adequate guidance to determine the appropriate method for preserving federal records generated by content presented on agency social media sites, we recommend that the Archivist of the United States develop guidance on effectively capturing records from social media sites and that this guidance incorporate best practices.

[GAO-11-605]

Sens. Tom Carper (D-Delaware) and Roy Blunt (R-MO) introduced data security legislation meant to combat identity theft. The Data Security Act would require financial establishments, retailers and federal agencies to protect sensitive information and to notify consumers after a data breach. The measure is similar to one introduced in the House by Rep. Mary Bono Mack (R-CA). The Commerce, Manufacturing and Trade Subcommittee approved her bill last week, and it is currently awaiting a vote from the full Energy and Commerce Committee.