Each year, the 988 Suicide and Crisis Lifeline, a national suicide prevention helpline, gets millions of calls, texts, and chats from people in crisis.Â
When people face hard times, the crisis line can provide lifesaving support. But a cyberattack could threaten this important resource. Â
Todayâs WatchBlog post looks at our report on these risks and what could be done to better secure this important crisis resource.
Image
Whatâs at risk if the 988 Lifeline is attacked?
In short, the stakes are high. Â
A few years ago, the 988 Lifeline experienced a ransomware attack that resulted in a nationwide service disruption lasting several hours. The outage raised concern about its 24/7 availability and security of its IT systems. The incident also exposed a significant vulnerability in the crisis lineâs operations. Â
Lives could be at risk. In January alone, the 988 Lifeline handled 428,000 calls from people in suicidal crisis or emotional distress. Â
Should it fall victim to another cyberattack, a disruption of services could mean calls for help go unanswered. It could also prevent people in crisis from accessing critical support when they need it. Â
Personal information may be exposed. When people call the crisis line for help, they may share some personal information and data. A cyberattack could expose such sensitive mental health information and other personally identifiable information. For example, while a contactâs name is not expressly recorded by crisis contact centers, it may be documented in a voice, chat, or text log if volunteered during a counseling session. Â
Having strong cybersecurity practices in place is critical. But we found that important safeguards are not always followed. For example, we found that the 988 Lifelineâs network administrator used outdated password practices that weakened account security and could increase the risk of unauthorized access to sensitive information. Â
So, whatâs being done to protect this lifesaving resource?Â
One of the challenges in securing the 988 Lifeline is its scale. The crisis line operates nearly 220 crisis contact centers, which are staffed by trained counselors who provide free and confidential 24/7 support. Â
The Department of Health and Human Services (HHS) and the network administrator oversee the 988 Lifeline. And they work with other federal, state, local, and private-sector partners to fund and operate it.Â
But our report found some gaps in HHSâs oversight. For example, HHS didnât include certain cybersecurity protections in its agreements governing the 988 Lifeline. These protections included having stronger email security and requiring staff to use separate accounts when accessing sensitive parts of a system. This helps limit the damage if an account is compromised. Â
And while the department has defined roles and responsibilities for itself and network administrators on monitoring cybersecurity, we found it didnât always follow its established processes. As a result, cybersecurity measures may vary across the network.Â
In addition, having more safeguards in place could better prevent unauthorized access in the future. This includes safeguards such as updated password guidance and incident response plans.Â
Without fully implementing cybersecurity controls or safeguards, the 988 Lifeline faces increased risk of attacks. This could result in prolonged service disruptions and unauthorized access to private mental health information. And it could potentially prevent people in crisis from accessing mental health support when itâs needed.Â
Learn more about this issue and our recommendations for addressing it by reading our full report. Â
- GAOâs fact-based, nonpartisan information helps Congress and federal agencies improve government. The WatchBlog lets us contextualize GAOâs work a little more for the public. Check out more of our posts atâ¯GAO.gov/blog.â¯Â
- Got a comment, question? Email us atâ¯blog@gao.gov.â¯â¯Â
GAO Contacts
Image
Related Products
GAO’s mission is to provide Congress with fact-based, nonpartisan information that can help improve federal government performance and ensure accountability for the benefit of the American people. GAO launched its WatchBlog in January, 2014, as part of its continuing effort to reach its audiencesâCongress and the American peopleâwhere they are currently looking for information.
The blog format allows GAO to provide a little more context about its work than it can offer on its other social media platforms. Posts will tie GAO work to current events and the news; show how GAOâs work is affecting agencies or legislation; highlight reports, testimonies, and issue areas where GAO does work; and provide information about GAO itself, among other things.
Please send any feedback on GAO’s WatchBlog to blog@gao.gov.
Source: WatchBlog: Official Blog of the U.S. Government Accountability Office
