If you think the Department of Education is making a mess of the student-loan program, you should see how it manages technology. Recurring failures documented by internal and external auditors have House Oversight Chairman Jason Chaffetz warning that the agency could be Washington’s next cyber-disaster.
The education department doesn’t hold nuclear launch codes. But its vast data trove on student-loan borrowers and their parents—and the nearly $100 billion it disburses in new loans every year—are reason enough to want the bureaucrats to prevent digital intrusions. Mr. Chaffetz says the bureaucracy now holds, among other things, 139 million Social Security numbers in its digital files.
The stakes go well beyond personal privacy. Federal student loans outstanding exceed $1 trillion, and Team Obama is trying to forgive those debts. It would add injury to injury if cyber-fraudsters were able to pile on for a taxpayer plundering. A Tuesday oversight hearing will explore the department’s failure to protect its information from cyber-attack, as well as the conduct of its chief information officer.
Department of Education Inspector General Kathleen Tighe reported in November that her team has been “finding the same deficiencies over and over again” regarding information security. Since 2009 independent auditors “have found persistent IT control deficiencies in key financial systems,” she said.
The 2015 internal audit of information security revealed more problems, including an “inability to detect unauthorized devices connecting to the network.” The IG also flagged “key weaknesses” in “internal intrusion detection and prevention of system penetrations.” Specifically, her team was “able to gain full access to the Department’s network and our access went undetected” by both the contractor overseeing the system and the department’s information office.