Audit of some storage practices at the FBI

[1PW]

Quote

The purpose of this memorandum is to advise you of concerns that we identified during an ongoing audit of
a Federal Bureau of Investigation (FBI) contract. During this contract audit, we identified significant
weaknesses related to the FBI’s inventory management and disposition procedures for its electronic storage
media containing sensitive but unclassified (SBU) information, such as law enforcement sensitive
information, as well as classified national security information (NSI).1 We also identified concerns regarding
the physical security over these items at an FBI-controlled facility where the media destruction takes place
(Facility).2 While these concerns are outside the objectives of our ongoing contract audit, we believe they
are significant enough to warrant the FBI’s immediate attention and action to better safeguard electronic
storage media containing SBU or classified NSI.

More...

 

[AdvancedSetup]

The response acts as though this is new information. These procedures have been in place for more than a decade and appear to simply be ignored?

 

[NewTricks]

FBI recruitment needs an upgrade to include those who understand and use computer security measures. So simple.

Edited August 27 by NewTricks
update to avoid misunderstanding

[David H. Lipman]

You will have to "trust me" when I state - It is not that easy and not that simple.

Spillage happens even by the most experienced using the best of practices.  It isn't a matter of recruitment.  It has to be a Top-Down philosophy in both mandate and practice. 

Managing a security container and the items stored within and logging access must be maintained and prioritized.

This is not limited to DoJ Sensitive and DoJ Classified data.  There are many US Gov't entities who have similar necessities and thus spillage events.

Edited August 27 by David H. Lipman
Edited for content, clarity, spelling and/or grammar

[AdvancedSetup]

Agreed, very difficult to maintain the proper flow of procedures. Once it starts to slip with enforcement the issue grows until it starts to seem overwhelming and takes a lot of work to get back on track

Then keeping that level of control with all the complexities of the real world is quite difficult

 

 

 

[NewTricks]

On 8/27/2024 at 8:31 AM, David H. Lipman said:

It is not that easy and not that simple.

I take it back.