Letter to the Honorable John Koskinen, Commissioner of Internal Revenue Service and Betsy DeVos, Secretary of US Department of Education - Protection of Personally Identifiable Information

Letter

Dear Commisioner Koskinen / Madam Secretary:

Since November 2015, the Committees have conducted oversight of information systems and related security concerns at the Department of Education (herein after the Department). The federal government has a responsibility to protect the personally identifiable information (PII) Americans entrust it with each day. The stakes are particularly high at the Department, an agency responsible for securing 139 million unique Social Security numbers and other sensitive information of students, parents, and custodians across the country. The Department of Education's ability to protect the information it collects, stores, and transmits is a cybersecurity matter that transcends the agency itself and has the potential to impact the security of our nation.

The Committees have questions about the Department's announcement on March 9, 2017, that the Internal Revenue Service (IRS) Data Retrieval Tool (DRT) on F AFSA.gov and StudentLoans.gov is currently unavailable due to information security concerns. 1 Millions of students applying for federal financial aid each year use the DRT, and a loss of functionality, even if confined to days or weeks, has the potential to cause significant disruptions. This is especially true for first-generation and low-income students who rely on the DRT tool, and for students in states that had not yet reached state priority deadlines for applying for financial aid when the DRT was taken offline.

The Federal Information Security Management Act (FISMA) requires the relevant Committees be notified of all "major incident[s]" within 7 days after the incident has occurred.2 Further, the Office of Management and Budget (0MB) guidance on what qualifies as a "major incident" includes an analysis of the functional effect of the incident, as well as the incident's potential impact on public confidence.

To help the Committees better understand the incident announced by the Department and the IRS on March 9, 2017, the Committees request a briefing as soon as practicable. Please also provide the following documents and information as soon as possible, but no later than 5:00 p.m. on March 30, 2017:

1. The date the Department first became aware of the possible vulnerability and/or suspicious activity, a description of the specific vulnerability and/or suspicious activity was detected, and a description of how the Department first became aware.

2. The scope of data and PII that may have been compromised by the vulnerability and/or suspicious activity, any indication that such a compromise occurred, and the date on which the Department concluded that such a compromise may have occurred.

3. Any recommendations the Department gave the IRS concerning the operations or related security of the DRT in the year leading up to the DRT being taken out of service.

4. The date on which the Department approved taking the DRT out of service, and the date it was taken out of service.

[5. The date on which the Department first notified schools and stakeholders the DRT would be taken temporarily out of service, and a copy of such notification.

6. All guidance provided to schools, students, and stakeholders on how students can best navigate the completion ofFAFSA's while the DRT is unavailable. (DeVos letter only)]

7. The total population of individuals that used the DRT in the 2016-2017 financial aid cycle (January 1, 2016, to June 20, 2017), including a breakdown of the total number of individuals using the tool specifically in the months of March and April.

8. The total population known to be affected by this incident (as known on the date the suspicious activity was first identified, and also as of March 9, 2017), including the total number of individuals whose personally-identifiable information may have been compromised (as known on the date the suspicious activity was first identified, and also as of March 9, 2017).

9. The date on which the Department notified the US-Computer Emergency Readiness Team of an information security incident.

10. The date on which the Department notified the Federal Bureau of Investigation of an information security incident related to the DRT.

11. The date on which the Department notified its Inspector General of an information security incident related to the DRT.

12. The date on which the Department determined there was a reasonable basis to conclude this incident was a "major" incident per 0MB guidance.

13. All documents and communications referring or relating to the determination whether to classify this incident as a "major incident."

14. All documents and communications concerning the incident announced by the Department on March 9, 2017, including any plans to provide post-incident recovery services such as credit-monitoring to affected individuals.

When producing documents to the Committees, please deliver production sets to the Majority Staff in Room 2157 of the Rayburn House Office Building and the Minority Staff in Room 2471 of the Rayburn House Office Building. The Committees prefer, if possible, to receive all documents in electronic format.

If you have questions about this request, please contact Katie Bailey and Mike Flynn of the Committee on Oversight and Government Reform Majority staff at (202) 225-5074, Katie Teleky and Joel Usher of the Minority staff at (202) 225-5051, or Clint Raine of the Committee on Education and the Workforce staff at (202) 225-4527. Thank you for your prompt attention to this matter.

Sincerely,

Source