Thanks for the ping.
Congressional IT staffers do undergo background checks, but if another member wants to hire the same employee—as was the case with Awan and his relatives—they can just sign a form accepting the first member’s screening.
“Somebody has got to do a background check and not have everybody sign a form saying they already had one when no one got them,” Gohmert said
Two House Democrats who did not employ Awan or his relatives acknowledged Thursday that no hiring system is infallible, but each member is responsible for screening their own staff in their own way.
“It’s like 535 separate princely courts, so everyone has their own system,” said Rep. Gerry Connolly, D-Va. “There’s no central system for vetting staff and over the years it’s by and large mostly worked well.”
According to Mark Strand, president of the Congressional Institute and a former longtime Capitol Hill staffer, there are no examinations, qualifications, or certifications required to ensure that technology aides are properly trained.
“A member of Congress can hire someone because they like them or they have a good feeling about them,” he said.
By design, each member is independent and operates their own staff. They also decide for themselves how strictly they secure data.
“The security of information starts with the member themselves and how seriously they take protection of information,” Strand said.
James Scott, a senior fellow at the Institute for Critical Infrastructure Technology, said the ?potential for damage to national security and access to compromising information is high with poorly-vetted IT staff.
“Any contractor, staffer, IT technician, remote administrator, or anyone else with prolonged and/or unrestricted access to Congressional systems can: install malicious programs (custom malware, RATs, keyloggers, etc.); alter sensitive security settings such as remote access or firewall rules; connect unapproved devices or drives; laterally access confidential systems or networks; or exfiltrate valuable data such as emails, schedules, notes, etc.,” he explained in an email. Any unapproved offsite storage or removal of sensitive information poses a security threat, according to Scott.
“The confidentiality, integrity, and availability of data must be secured according to its value, wherever that information is stored, whenever it is transmitted, and however it is processed,” he said. “Any lesser precaution is dangerously irresponsible and could be criminally negligent.”