A Federal Reserve Board staff member removed potentially sensitive files related to the Federal Open Market Committee (FOMC) shortly before their planned retirement in 2024, a report from the Fed’s Office of Inspector General found.

The OIG findings highlighted numerous oversight shortcomings with the Fed’s offboarding process controls for records management, which the central bank vowed to address in a formal response to the internal watchdog group.

Before retiring in July 2024, the Fed employee, who worked in the bank’s division of international finance (IF), triggered 279 data loss prevention (DLP) alerts, according to the OIG. Those activities included “printing, copying data to a notepad application, sending potentially sensitive information in emails to multiple personal email addresses, and transferring potentially sensitive files to a Board-issued unencrypted USB device.”

Advertisement

Of those DLP alerts, 111 were flagged as potentially involving sensitive FOMC classified information. Additionally, 227 of the alerts occurred in June of 2024, with 192 taking place three days prior to the employee’s personal trip to a country designated as “restricted” by the Fed.

The FOMC is the 19-member group that sets U.S. monetary policy. Earlier this month, the 12 current voting members of the committee unanimously decided to raise interest rates for the first time since 2023.

The Fed watchdog also found that the employee had previously attempted to send classified FOMC information to their personal email account in 2023, which the employee had claimed was inadvertent.

Later that year, the same employee potentially copied sensitive FOMC information to an unencrypted USB device, though the matter was not reported as an incident by the FOMC secretariat “based on IF’s explanation that the DLP alerts were false positives and the files were publicly available.”

The international finance division’s integrated technology solutions team “held a conversation with the employee and reviewed document titles provided by the [information security operations] team but did not review the files to verify the false positive explanations,” according to the report.

The OIG noted a “collective lack of action across multiple divisions, and the limited follow-up activities that did occur were not commensurate with the accumulation of risks in this situation.”

The report added: “The employee’s ongoing pattern of potential and confirmed security violations; the employee’s imminent departure; and the presence of multiple insider threat risk indicators, including multiple international trips, signaled the possibility that a credible insider threat incident and potential material information security breach had occurred. The lack of clarity in each division’s role in responding to this incident highlights the need for a consolidated program to manage insider risks at the Board.”

The inspector general’s office provided nine recommendations to safeguard sensitive information during the employee offboarding process — all of which were agreed to by Federal Reserve Board management.

“We concur with the OIG’s recommendations to strengthen the Board’s governance of its information security program and enforcement of its controls,” the senior Fed leaders wrote in their response letter. “The Board takes these matters seriously and we plan to promptly take all required steps to implement all recommendations, and several are already underway.”

The Fed did not immediately respond to a request for further comment.