Department of Veterans Affairs employees reacted with “indifference, little sense of urgency, or responsibility” on a possible cyberthreat incident when they allowed contractors to work remotely in China and India in 2013, a report from the VA’s Office of Inspector General (OIG) said.
Contractor employees accessed the VA network from China and India on personally owned equipment, but information security employees did not respond quickly to stop the process despite instructions and failed to determine if there was a compromise to any VA data, the report said.
The contractor who went to China acknowledged his request to telework from there was a matter of personal convenience, “but he said that it would have caused an inconvenience for VA if he could not telework, since he was the only one available to perform certain tasks on certain days,” the report said.
The employee said he did not “sanitize” the hard drive of the personal computer he left in China and that he “reimaged it when he installed Windows 7 on it and that he installed Windows 7 because his family member disliked Windows 8.”
Police also called his brother shortly after the employee’s interview with investigators to ask the brother how often he traveled to China “for census purposes.”
The report also found other VA contractors who improperly accessed VA networks from foreign countries, including several citizens of India and a former citizen of China.
The report recommended that the VA Chief of Staff (COS) determine any administrative actions to take against IT employees involved and review the VA’s information security policies and training are reviewed and rewritten to address any weakness.
In a response memo dated March 31, Chief of Staff Jose D. Riojas wrote that they will comply with the recommendations in a reply that Assistant Inspector General for Investigations James J. O’Neill called “responsive.”
“VA has already begun work to address OIG’s recommendations in addition to clarifying policy and implementing technical controls,” said VA spokeswoman Walinda West. “We also look forward to confirmation of LaVerne Horton Council, who President Obama nominated on March 19, to be an assistant secretary of information and technology.”
• David Sherfinski can be reached at dsherfinski@washingtontimes.com.
Please read our comment policy before commenting.