What the watchdog found
A staff member at the Federal Reserve Board pulled potentially sensitive files connected to the Federal Open Market Committee shortly before a planned retirement in 2024, according to a report by the Fed's Office of Inspector General. The employee worked in the central bank's division of international finance. The inspector general's findings pointed to broad shortcomings in the Fed's offboarding controls for managing records, and the central bank pledged in a formal response to fix them.[S1]
Before leaving in July 2024, the employee set off 279 data loss prevention alerts, the OIG said. Those alerts covered printing, copying data into a notepad application, sending potentially sensitive information by email to several personal addresses, and moving potentially sensitive files onto a Board-issued unencrypted USB device. Of the total, 111 were flagged as potentially involving classified FOMC information. A further 227 alerts occurred in June 2024, and 192 of them came three days before the employee took a personal trip to a country the Fed designates as restricted.[S1]
Earlier warnings and missed follow-up
The watchdog also found that the same employee had tried in 2023 to send classified FOMC information to a personal email account, an action the employee described as inadvertent. Later that year, the employee potentially copied sensitive FOMC information onto an unencrypted USB device. The FOMC secretariat did not report that matter as an incident, according to the report, relying on the international finance division's explanation that the alerts were false positives and that the files were publicly available.[S1]
The international finance division's integrated technology solutions team spoke with the employee and reviewed document titles supplied by the information security operations team, but did not examine the files to confirm the false-positive explanations, the report said. The OIG described a collective lack of action across multiple divisions and said the limited follow-up that did happen was not proportionate to the risks that had accumulated.[S1]
The Fed's response and next steps
The Office of Inspector General put forward nine suggestions aimed at safeguarding confidential material when staff leave the Fed, and Board leadership signed off on every one. In their written reply, senior Fed officials said they back the proposals for tightening oversight of the Board's information security program and its control enforcement, noting the Board views these issues as important and intends to move quickly to carry out each recommendation, with some efforts already in progress. The Fed did not provide an immediate response to a follow-up request for comment.[S1]
The FOMC is the 19-person body responsible for setting U.S. monetary policy. Earlier this month, all 12 of its sitting voting members agreed unanimously to lift interest rates, marking the first such increase since 2023.[S1]
