At least one congressional committee is fed up with the Office of Personnel Management (OPM) – as are we – over the data breach that affected more than 20 million Americans. Now, the congressional committee with oversight is slapping a subpoena on the federal government’s HR office for failing to disclose information on that breach.
House Oversight Committee chair Jason Chaffetz (R-UT) issued a subpoena for the new OPM director Beth Cobert (who took over the reins of leadership from the embattled former director Katherine Archuletato) to turn over information. He is requesting documents to help piece together the timeline of when the hacks happened and to identify and what information was stolen.
To-date, OPM has received 170 letters from members of Congress about its cybersecurity efforts and has conducted more than a dozen classified and unclassified briefings with Congress and produced a ton of documents. However, what they’ve produced has not been enough, according to Chaffetz.
The Hill reports:
"We made a commitment to the American people to ensure a hack of this nature never happens again,” Chaffetz said Wednesday evening. “The documents we've repeatedly requested be provided to this committee are essential to fulfilling that promise.”
He specifically called out the agency’s acting director, Beth Cobert, who took over in June after former OPM Director Katherine Archuleta resigned amid the fallout from the digital intrusions.
"OPM, under Ms. Cobert's leadership, is not cooperating with the committee's investigation,” Chaffetz said.
The agency has consistently maintained it is trying to work with the committee on its inquiry.
The subpoena comes at a poor time for Cobert, who is scheduled to have her nomination hearing before the Senate Homeland Security and Governmental Affairs Committee on Thursday.
Chaffetz praised the selection at the time.
"In my initial meetings with Beth Cobert, she has impressed me as a talented, qualified and competent choice for OPM director,” he said. “I am pleased the president has opted for a credible selection this time rather than a political one.”
But his tune changed on Wednesday.
“Despite assurances of cooperation, I'm disappointed Ms. Cobert is not working in good faith with the committee,” Chaffetz said.
“I will use all available remedies to obtain the information needed to conduct a thorough and meaningful investigation,” he said.
OPM is not simply the agency that decides if a couple of inches is snow is worth closing federal offices in the Washington, D.C. area. They also manage the private records of every person in the federal workforce and those who have applied to be part of the federal government. It makes sense that in light of the massive data breaches we should ensure they have identified what went wrong, put measures in place to fix the breaches, help victims, and change procedures to minimize the likelihood of this reoccurring.
Government agencies like OPM and the IRS collect and hoard a tremendous amount of information on Americans. They have a duty to be responsible with that information and to be held accountable when data breaches occur. Unfortunately, OPM’s plans to date have been slow and unimpressive. It took almost 5 months for them to start alerting individuals that their information was stolen and they are at risk of fraud.
This added pressure from Chaffetz is critical. The inspector general, the public's eyes and ears at OPM is also retiring and unless he can be replaced by someone with the same commitment to holding OPM accountable on the breaches, it may begin to fade to past memory.
Patrick E. McFarland, inspector general at OPM since 1990, has produced work critical to the investigations into the data breach and its aftermath. The Washington Post chronicles the series of reports that McFarland produced tracking the vulnerabilities of security upgrades, interference by OPM’s head information officer, and how OPM contracted to provide identity monitoring and other services to victims of the data breach.
In leaving, McFarland warned that while Cobert is competent, shifting control of the background investigation away from the agency’s inspector general to the Defense Department would be a mistake:
In his letter, McFarland said that Cobert “appears to have wrapped her arms around the multitude of challenges currently facing OPM. Further, she seems to be arduously striving to institute high standards of professionalism as she works to reinvigorate this great agency.”
“However, she cannot achieve the goals she has set for herself and for OPM without a permanent and independent Inspector General who will tell her the unvarnished truth about any shortcomings the OIG may discover,” he added, recommending that Deputy IG Norbert Vint be nominated to replace him.
Cobert said in a statement that “OPM values greatly the mission of the IG, and the role Pat has played, in providing input and oversight of OPM services and programs. Pat’s leadership and contributions to this agency and its directors over the past 25 years have been a tremendous asset to OPM and the federal government.”
Alas, the OPM saga continues. We can only hope that someone – whether Chaffetz or McFarland’s replacement – does not let go of this investigation. We need to be assured that Americans don’t find themselves the victims of theft and fraud because of mismanagement and the government just doesn't care.