Gardner and Group of Bipartisan Senators Voice Concern over State Department Cybersecurity

Gardner, Wyden, Markey, Paul and Shaheen Call on State to Adopt Basic Security Measures

Washington, D.C. – Senators Cory Gardner (R-CO), Ron Wyden (D-OR), Ed Markey (D-MA), Rand Paul (R-KY), and Jeanne Shaheen (D-NH), called on the State Department to adopt basic cybersecurity measures to protect against phishing, hacks, and other cyberattacks in a letter released today.

 Following multiple reports from outside auditors highlighting the department’s failure to adopt measures like multifactor authentication and regular security audits which are mandated by the Federal Cybersecurity Enhancement Act, the bipartisan group of five senators, raised concerns in a joint letter to Secretary of State Mike Pompeo.

 “The Department of State’s Inspector General (IG) found last year that 33% of diplomatic missions failed to conduct even the most basic cyber threat management practices, like regular reviews and audits,” said the senators. “The IG also noted that experts who tested these systems ‘successfully exploited vulnerabilities in email accounts of Department personnel as well as Department applications and operating systems.’

 “We are sure you will agree on the need to protect American diplomacy from cyberattacks, which is why we have such a hard time understanding why the Department of State has not followed the lead of many other agencies and complied with federal law requiring agency use of [multifactor authentication].”

 The senators asked for responses to three questions by October 12.

 1.      What actions has the Department of State taken in response to the OMB’s designation of the Department of State’s cyber readiness as “high risk”?

2.      What actions has the Department of State taken to rectify the near total absence of multifactor authentication systems for accounts with elevated    privileges accessing the agency’s network, as required by federal law?

3.      Please provide us with statistics, for each of the past three years, detailing the number of cyber attacks against Department of State systems located abroad. Please include statistics about both successful and attempted attacks.

NOTE: Read the full letter here.