A 3-Year Exposure of Privacy Act-Protected Data Revealed USPTO Mismanagement in Safeguarding the Sensitive PII of Trademark Filers

Submitting OIG:

Department of Commerce OIG

Report Description:

The objective of our evaluation was to assess USPTO’s actions in response to the exposure of domicile addresses to determine whether USPTO complied with federal and U.S. Department of Commerce (the Department) information technology (IT) security standards. We found that USPTO mishandled the required reporting and notification to the affected trademark filers after domicile addresses had been exposed for 3 years. We also found that USPTO leadership allowed domicile addresses to remain publicly accessible after they were aware of the exposure, risking unauthorized disclosures in violation of the Privacy Act. Additionally, USPTO did not report that additional sensitive PII was exposed during the incident or notify the affected filers that additional data had been exposed. Lastly, the Department’s Chief Privacy Officer (CPO) did not assist USPTO in responding to this incident because of a lapse in the Department reporting process. See appendix B for a timeline of the events discussed in our findings. USPTO’s exposure of trademark filer data may not only reduce public confidence, but also may have equipped bad actors with additional data that could be used to defraud trademark holders. Bad actors could aggregate the pieces of exposed data to convincingly create official-looking USPTO correspondence or impersonate a filer’s attorney. Despite these risks, USPTO leadership did not comply with federal, departmental, and USPTO incident response reporting requirements and knowingly allowed domicile addresses to remain publicly accessible during incident mitigation. USPTO must improve its efforts in safeguarding trademark filers’ personal data to rebuild public trust and honor trademark holders’ privacy.

Date Issued:

Monday, June 24, 2024

Agency Reviewed / Investigated:

Department of Commerce

Submitting OIG-Specific Report Number:

OIG-24-029-I

Component, if applicable:

U.S. Patent and Trademark Office

Location(s):

Agency-Wide

Type of Report:

Inspection / Evaluation

Questioned Costs:

Funds for Better Use:

Number of Recommendations:

Report updated under NDAA 5274:

View Document:

Attachment	Size
OIG-24-029-ISECURED.pdf	5.58 MB

Additional Details Link:

https://www.oig.doc.gov/Pages/A-3-Year-Exposure-of-Privacy-Act-Protected-Data-Re…

Recommendation Number	Recommendation Status	Significant Recommendation
1	Open	Yes
1. We recommend that the Under Secretary of Commerce for Intellectual Property and Director of the United States Patent and Trademark Office align USPTO policy with departmental requirements to have all USPTO employees report all IT security incidents, including PII exposure, immediately (within 1 hour) once an incident is suspected or confirmed.
2	Open	Yes
2. We recommend that the Under Secretary of Commerce for Intellectual Property and Director of the United States Patent and Trademark Office align USPTO policy with departmental requirements to have all USPTO employees report all IT security incidents, including PII exposure, immediately (within 1 hour) once an incident is suspected or confirmed.
3	Open	Yes
3. We recommend that the Under Secretary of Commerce for Intellectual Property and Director of the United States Patent and Trademark Office establish an internal control process and provide training to ensure all USPTO employees report IT security incidents immediately (within 1 hour) once an incident is suspected or confirmed.
4	Open	Yes
4. We recommend that the Under Secretary of Commerce for Intellectual Property and Director of the United States Patent and Trademark Office hold USPTO leadership accountable for reporting and notification of IT security incidents n accordance with federal and departmental requirements.
5	Open	Yes
5. We recommend that the Under Secretary of Commerce for Intellectual Property and Director of the United States Patent and Trademark Office hold USPTO leadership accountable to comply with USPTO risk acceptance policies and procedures.
6	Open	Yes
6. We recommend that the Under Secretary of Commerce for Intellectual Property and Director of the United States Patent and Trademark Office establish a requirement within USPTO risk acceptance policies and procedures to consider violations of the Privacy Act during IT security incidents.
7	Open	Yes
7. We recommend that the Under Secretary of Commerce for Intellectual Property and Director of the United States Patent and Trademark Office reassess the non-mission-critical designation of TSDR and other systems supporting the trademark process.
8	Open	Yes
8. We recommend that the Under Secretary of Commerce for Intellectual Property and Director of the United States Patent and Trademark Office update USPTO policy to meet the federal minimum standard of 2 years and 6 months of log retention.
9	Open	Yes
9. We recommend that the Under Secretary of Commerce for Intellectual Property and Director of the United States Patent and Trademark Office fully implement log retention controls for USPTO systems according to departmental requirements.
10	Open	Yes
10. We recommend that the Deputy Assistant Secretary for Administration direct the Office of Privacy and Open Government Director to implement compensating controls and redundant procedures for receiving incidents reported to the Department Chief Privacy Officer.

Recommendation Number

Recommendation Status

Significant Recommendation

Additional Details

Open

Yes

1. We recommend that the Under Secretary of Commerce for Intellectual Property and Director of the United States Patent and Trademark Office align USPTO policy with departmental requirements to have all USPTO employees report all IT security incidents, including PII exposure, immediately (within 1 hour) once an incident is suspected or confirmed.

Open

Yes

2. We recommend that the Under Secretary of Commerce for Intellectual Property and Director of the United States Patent and Trademark Office align USPTO policy with departmental requirements to have all USPTO employees report all IT security incidents, including PII exposure, immediately (within 1 hour) once an incident is suspected or confirmed.

Open

Yes