Somewhere around security alert No. 200, you might think somebody at the Federal Reserve would've become curious. A retiring Fed employee generated 279 data-loss-prevention alerts during the final 90 days on the job, and the Federal Reserve's inspector general says the employee potentially removed classified Federal Open Market Committee information and other sensitive material.

The Fed couldn't conclusively determine what information may have left with the employee. This wasn't an ordinary workplace file-cleaning problem because FOMC information can concern monetary policy decisions capable of affecting interest rates and financial markets.

From the Office of the Inspector General:

During our audit of the Board’s offboarding controls, we found gaps in the Board’s ability to identify and respond effectively to the removal of information by a departing employee. Because of our concerns about the Board’s diligence in resolving this potential incident, we are issuing a management alert before completing our planned audit. 

Specifically, this alert focuses on a departing Board employee who potentially removed Federal Open Market Committee classified and other sensitive information. The employee had a prior information security incident involving Federal Open Market Committee classified information, heightening our concerns. This potential incident highlights information security risks and control breakdowns and deficiencies that we believe require the Board’s immediate attention.

The employee worked in the Fed's Division of International Finance and retired in July 2024. The inspector general found a history that should've made the final months especially interesting to security officials.

There had already been an information-security incident involving classified FOMC information. Other incidents involved copying files to unencrypted USB drives and sending information to personal email accounts. The employee also had plans to travel to a country subject to heightened security restrictions.

Then came those 279 alerts. The Fed uses data-loss-prevention technology to detect possible attempts to move sensitive information somewhere it shouldn't go, but the watchdog had already identified difficulties with the system.

A 2024 inspector general audit found the tool wasn't effective at ensuring sensitive agency data was protected against accidental or malicious removal. Two years later, we get a rather spectacular demonstration of why that finding deserves attention.

During the employee's last 90 days, the 279 alerts included 139 for potentially sensitive FOMC information, the inspector general found. Some alerts can be false positives, and the watchdog hasn't included that every alert represented improper activity. Nobody needs all 279 to be genuine for the story to become troubling.

The OIG also found that the board didn't sufficiently document how it reviewed and resolved the alerts. In other words, the security system was producing warnings, but investigators later couldn't establish with confidence exactly what information the employee might have taken.

The watchdog was concerned enough that it didn't wait to finish its broader audit of the Fed's employee offboarding process. It issued a management alert on Sept. 24 with nine recommendations calling for stronger controls over departing employees and potential information-security incidents.

The Fed agreed with the recommendations. Those include ensuring security personnel are notified promptly about departing employees, resolving data-loss alerts before employees leave, strengthening controls over removable media, and documenting the disposition of potentially sensitive information.

There's another detail underneath all of this. The inspector general had already concluded in its 2024 security audit that the Fed's data-loss-prevention system had weaknesses in monitoring and reporting, reducing assurance that sensitive information was protected against unauthorized transfer.

Then an employee headed for retirement generated 279 alerts.

The inspector general isn't accusing this person of espionage. It hasn't established that classified information was handed to a foreign government, sold, or deliberately stolen. Those are conclusions the evidence doesn't support, with no reason to invent them.

The established facts are uncomfortable enough. The Federal Reserve possesses some of the most market-sensitive government information in America. Its security system repeatedly noticed potentially troubling activity involving an employee who already had an information-security history, and the employee retired before the Fed had conclusively determined what may have been removed.

Security software did what security software is supposed to do. It raised its hand 279 times.

The question isn't why the computer noticed. It's why the humans couldn't provide a better answer about what walked out the door.

Government watchdog reports aren't exactly beach reading, but occasionally one number makes the digging worthwhile. 279 security alerts is one of those numbers. Join PJ Media VIP today and save 60% with promo code FIGHT. Your support helps us keep digging through the documents that deserve far more attention than they usually get.