Federal tech team accused of 'data breach' for connecting Slack, Google Drive

Dive Brief:

An inspector general report released Thursday said the federal digital services team, 18F, was found linking workplace applications, which could have potentially exposed sensitive data and constitutes a "data breach."
The 18F team connected workplace messaging application Slack with Google Drive, which allowed users to preview hosted Drive files through chat.
18F, however, said that though integrating the apps was a "mistake," the result was neither a data breach or a hack.

Dive Insight:

18F is a prominent Obama administration tech team, and part of the General Services Administration, tasked with providing high-level tech services to federal agencies.

"Due to authorizations enabled by GSA 18F staff, over 100 GSA Google Drives were reportedly accessible by users both inside and outside of GSA during a five month period, potentially exposing sensitive content such as personally identifiable information and contractor proprietary information," the inspector general’s office said in its alert.

Primarily of concern was how the two apps connected. 18F said by automatically allowing Slack to create previews for the files, they were also giving it permission to automatically upload it to its servers. 18F admitted connecting the two applications was a mistake, but denies the issue should be characterized as a data breach.

"Our review indicated no personal health information (PHI), personally identifiable information (PII), trade secrets or intellectual property was shared," the 18F team wrote.

Linking the two apps is an example of shadow IT, where the apps were used in an manner unauthorized by federal tech department. Shadow IT has become a growing problem, and it comes with potential risks to both company and customer data. A report released by Cisco in January found that shadow IT in enterprises was up almost 70% from just six months prior.

While CIOs estimate their organizations use an average of 91 cloud computing services, Cisco said, the true number averages around 1,120. Many analysts agree that shadow IT is an issue for companies, and that few CIOs or corporate technology departments have a good idea of shadow IT's scope.

Often without the knowledge or permission of the IT department, the average employee uses 17 cloud apps at work, according to research by Adallom.