Now Available:

line

Featured Resources:

line

Newsletter

Email Address:


line

Ask the Expert

Have a question for our resident expert? Email your questions to Rebecca.

« U.S. Dept of Homeland Security Creates National Computer Forensic Institute | Main | U.S. ONDI and DOD Standardizing Security Policies »

Government Compliance: FBI Director Says USA PATRIOT Act Doesn't Need Changes; That FBI Is To Blame for Associated Problems

Today U.S. FBI Director Robert Mueller appeared before the Senate Judiciary Committee and testified that there are no problems with the USA PATRIOT Act, but that the FBI did not implement the Act appropriately.

This comes after the recent audit revelations that the FBI has some significant problems with keeping track of how they use the Act. I blogged about the audit recently here.

"He [Mueller] said he instituted procedures to police the use of these letters. "What I did not do and should have done is put in a compliance program to be sure those procedures were followed," the FBI chief added."

This is a big problem with many, if not most, organizations; rolling out policies and procedures and then not having a compliance program in place to ensure they are being followed appropriately. Policies and procedures, like laws and regulations, are ineffective, and often damaging by creating a false sense of security by not holding those responsible accountable for compliance. When organizations and personnel know they will not be checked on to see if they are following the rules, it is very easy for them to not follow the rules...they are not motivated by any potential penalties, and it appears as though such requirements were just done as placation for the people who pushed for the laws in the first place.

During the testimony Senators Leahy and Specter remained sceptical.

""I still have very serious qualms," Leahy replied.

Citing the inspector general report on national security letters and his previous reports criticizing FBI reporting of terrorist cases, of weapons and laptops losses, Sen. Arlen Specter, R-Pennsylvania, said, "Every time we turn around there is another enormous failure by the bureau."

"There's another headline virtually on a daily basis," Specter added, citing a Washington Post report Tuesday that agents had submitted inaccurate data to a court that issues warrants for foreign intelligence surveillance.

"The question arises as to whether any director can handle this job and whether the bureau itself can handle the job," Specter said, proposing that the panel give serious consideration to establishing a separate domestic intelligence agency like Britain's MI-5."

Mueller retorted that he is making improvements, but doing so is very hard because "the warrant applications are very long and contain thousands of facts."

Gee...businesses deal with forms that contain thousands, and tens of thousands, of facts, but they must still ensure the facts are accurate and accounted for under multiple laws and regulations, not only in the U.S. but throughout the world under dozens of data protection laws.

Specter did not have a sympathetic ear.

""I'm not impressed with your assertion that there are thousands of facts," Specter said. "That's your job. You asked for these powers; we gave you them. If these applications are wrong, you're subjecting people to an invasion of privacy that ought not to be issued.""

Good reply! Indeed, government officials must be held accountable for their responsibilities just like any other organization.

""Last year the administration sought new powers in the Patriot Act to appoint U.S. Attorneys without Senate confirmation and to more freely use National Security Letters," Leahy said in opening remarks. "The administration got these powers, and they have badly bungled both."

In a review of headquarters files and a sampling of four of the FBI's 56 field offices, Inspector General Glenn A. Fine found 48 violations of law or presidential directives during 2003-2005. He estimates there may be as many as 3,000 violations throughout the FBI that have not been identified or reported.

When Fine testified before the Senate panel last week, Leahy said, "In light of this report, we need to consider whether Congress went too far" in the Patriot Act in removing restrictions on FBI use of national security letters.

In a House Judiciary Committee hearing with Fine, Republicans and Democrats warned the FBI could lose that broad power.

If the FBI doesn't move swiftly to correct the mistakes and problems, "you probably won't have NSL authority," said Rep. Dan Lungren, R-California, a supporter of the power."

The USA PATRIOT Act allows, among many other things and changes to at least 35 other laws, the FBI to obtain anyone's records if they consider them relevant to an investigation.

TrackBack

TrackBack URL for this entry:
http://www.realtime-itcompliance.com/type/mt-tb.cgi/361

Comments

I'm sitting here reading all these opinions on the patriot act changes, but I haven't heard anyone say what type of affect it will have on the local officials and other public authorities. Plus what two rules are being changed. Can you please enlightin me with this imformation please. I need it for a class on friday. thank you

Patricia, you didn't say what type of research you were doing this for; a paper, test, something else?

Hopefully you were able to make use of your favorite search engine to find the information you needed last week.

Each organization is responsible for creating their own policies (rules) and procedures for being in compliance with laws such as the USA PATRIOT Act. This also applies to local and federal agencies. Unfortunately, many don't, or they create policies and rules and then don't enforce them consistently, or the procedures and policies they create are not suffient for compliance, as Robert Mueller claimed.

Post a comment

(All comments are approved by site leader before appearing here. Thanks for commenting!)

line

Rebecca Herold's Bio:

Rebecca Herold,CISSP, CIPP, CISM, CISA, FLMI, has been providing information security, privacy and regulatory assistance and services to organizations from a wide range of industries for over 18 years. Rebecca was instrumental in building the information security and privacy program while at Principal Financial Group, which was awarded the CSI Information Security Program of the Year Award in 1998. IT Security ranked Rebecca as one of the top 59 IT security influencers, and Computerworld put Rebecca their list of the 25 top privacy experts and on their list of the 9 best privacy consulting firms. Rebecca has been CPO for two consulting organizations, and has had her own information privacy, security and compliance business since 2004. Rebecca has written chapters for several books, dozens of articles, and has been writing a monthly privacy column for the CSI Alert newsletter since the beginning of 2001, and is working on her 11th book. Some of her other books include The Privacy Papers, Managing an Information Security and Privacy Awareness and Training Program, The Definitive Guide to Security Inside the Perimeter (Realtime Publishers), The Shortcut Guide to Improving IT Service Support through ITIL (Realtime Publishers), and The Practical Guide to HIPAA Privacy and Security Compliance. In addition, Rebecca is the leader of The Realtime IT Compliance Community where she posts to her IT Compliance weblog. You can contact Rebecca at: rebecca_herold@realtimepublishers.net.