Federal Reports

We determined that the Federal Emergency Management Agency (FEMA) violated the Privacy Act of 1974 and Department of Homeland Security policy by unnecessarily releasing to a contractor the Personally Identifiable Information (PII) and Sensitive Personally Identifiable Information (SPII) of 2.3 million survivors of Hurricanes Harvey, Irma, and Maria and the California wildfires in 2017. FEMA should have provided the contractor with only limited information needed to verify disaster survivors’ eligibility for the program. The privacy incident occurred because FEMA did not take steps to ensure it provided only required data elements. Without corrective action, the disaster survivors involved in the privacy incident are at increased risk of identity theft and fraud. We recommend FEMA implement controls to ensure it sends only required data elements to contractors. Further, FEMA should assess the extent of this privacy incident and implement a process for ensuring that PII, including SPII, of registered disaster survivors previously released to the contractor is properly destroyed pursuant to DHS policy. FEMA concurred with our two recommendations, notified Congress of the privacy incident as required, and has begun to take actions that have identified additional security vulnerabilities. FEMA’s estimated completion date for implementing the recommendations is June 30, 2020. Given the sensitive nature of these findings, we urge FEMA to expedite this timeline.

In accordance with our Annual Performance Plan Fiscal Year 2019, dated October 2018, the Office of Inspector General (OIG) assessed Avue. Our objectives were to determine if the Department (1) appropriately monitored the Avue contract, (2) established effective controls that ensured the integrity of Avue data, and (3) complied with laws, regulations, and guidance. Our scope included controls, processes, and operations during calendar year 2018.

To address challenges noted in our report titled Top Management Challenges Facing the United States Capitol Police, dated October 2018, the Office of Inspector General (OIG) conducted an analysis of the USCP email security program. The objectives of our analysis were to determine if the Department (1) established adequate internal controls and processes for ensuring security over the Department's email system, and (2) complied with applicable policies and procedures as well as applicable laws, regulations, and best practices. Our scope included controls, processes, and operations during Fiscal Year 2018.

To watch a short video related to this report, please click the link below.

Volume 20 of the U.S. Department of Labor Office of Inspector General's Investigations Newsletter.