Vets can sue VA over stolen laptop

[Firetxmi]

Vets can sue VA over stolen laptop
By MATT APUZZO, Associated Press Writer
Fri Nov 16, 5:55 PM ET

A federal judge questioned the Veterans Affairs Department's computer security and ruled Friday that lawsuits can go forward over the theft of computer equipment containing data on 26.5 million veterans.

U.S. District Judge James Robertson dismissed several aspects of the case but said the three lawsuits sufficiently made the claim that the agency failed to safeguard personal information, as required by the Privacy Act.

"The government's own evidence raises serious questions about the VA's computer safeguards," Robertson wrote, citing government reports that faulted the agency's computer security years before the theft.

A laptop and hard drive were stolen last year during a burglary at the home of a Veterans Affairs employee. The equipment contained the names, Social Security numbers and birth dates of veterans discharged since 1975. It was the worst-ever breach of government data.

The equipment was later recovered and the FBI said the sensitive files were neither compromised nor accessed.

In the lawsuits, veterans said they suffered embarrassment, mental distress, emotional trauma and the threat of future identity theft. Some said they also had to pay for credit-monitoring services.

The Justice Department, which represents federal agencies in lawsuits, had asked the case be dismissed. Robertson agreed on some counts: He threw out claims of constitutional violations, said the theft did not qualify as an "unauthorized disclosure" under the Privacy Act and said only individual veterans — not organizations — can sue.

The lawsuits have been filed as potential class-action cases representing every veteran whose data was released.


Link:http://news.yahoo.com/s/ap/20071116/ap_on_go_ca_st_pe/vets_data_theft;_ylt=AjjiHF2GFs458sEEBu_eqgQD5gcF

[gaijinsamurai]

So, the laptop was recovered, and no sensitive info was compromised. Of course, I know many veterans, including myself, were very worried about the possible consequences of the theft, but in the end, no real harm was done.

Am I the only one who thinks a lawsuit over this would be frivalous?

[Hollis]

So, the laptop was recovered, and no sensitive info was compromised. Of course, I know many veterans, including myself, were very worried about the possible consequences of the theft, but in the end, no real harm was done.

Am I the only one who thinks a lawsuit over this would be frivalous?


I would think, if there was no damage no reason for a lawsuit.

Seem like a real non issue.

[Invisigoth]

I would humbly beg to differ. While there might have been no harm done in this case, doesn't the theft of a laptop containing 26 million files show a hefty degree of negligence when it comes to dealing with the confidential files of veterans?

The best way to ensure that that's not gonna happen again is to drag it out in the open and scrutinize it. I believe that course of action will be much more effective in forcing those responsible to address the obvious security issues, whether it be someone having 26.5 million files on a portable computer or having it lay around to be stolen....

In my opinion, the second those things are not scrutinized but left to 'internal oversight', they're simply gonna be swept under the rug.

my 0.02

[Hollis]

Invis, it is not whether you disagree or agree, maybe find out what it takes to file a law suit, where is the damage, what do you want the court to make whole?

BTW, maybe the person who screwed up MAY HAVE gotten fired, there is you measure of blood for the mistake.

[gaijinsamurai]

I have a couple of acquaintances who work at VA hospitals, and they've informed me that strenuous regulations were put in place to try to better safeguard sensitive data, in the aftermath of this incident.

[Invisigoth]

Invis, it is not whether you disagree or agree, maybe find out what it takes to file a law suit, where is the damage, what do you want the court to make whole?

BTW, maybe the person who screwed up MAY HAVE gotten fired, there is you measure of blood for the mistake.

Did I call for "blood" at any stage? Not at all. When an incident like that occurs it makes more sense to find the fault in the system, which let such an error occur, rather than the individual who committed the error (obviously unless he was acting grossly negligent against the safeguards of the system itself.)

How can this not have merit? You are saying that because an erroneous policy MAY HAVE been fixed, that makes an attempt to scrutinize this policy redundant, or even frivolous as some may call it? I would beg to differ.

As to what it takes to file a lawsuit in the U.S., I have no idea (you're the lawyer...), but didn't the judge who gave his ruling saw some merit in the claims and thus allowed the suit? That's at least what I took from the article.


U.S. District Judge James Robertson dismissed several aspects of the case but said the three lawsuits sufficiently made the claim that the agency failed to safeguard personal information, as required by the Privacy Act. (...) The Justice Department, which represents federal agencies in lawsuits, had asked the case be dismissed. Robertson agreed on some counts: He threw out claims of constitutional violations, said the theft did not qualify as an "unauthorized disclosure" under the Privacy Act and said only individual veterans — not organizations — can sue.

[Hollis]

The judge allow for a suit, it did not say that any law suits would have merit that this ruling would allow. Different issue here.

Parts of the Federal government, from my understanding is under some legal protections for litigation.

To seek a cure, one must have damages. Damages my be demonstrated, Lost of income, lost of money, etc.

I am not disagreeing with the notion of gross negligence, but what are the damages?

[Invisigoth]

The judge allow for a suit, it did not say that any law suits would have merit that this ruling would allow. Different issue here.


Maybe I didn't phrase it accurately. Obviously the decision of whether the case ultimately warrants a punishment of some form is up to a judge during an actual trial. What I was trying to say is that, if the lawsuit was 'frivolous' he most likely wouldn't have allowed it. Seeing that he did, he must have had some reason to believe that there was some possible legal claim coming from the request; why else would he allow for suits to be filed?



To seek a cure, one must have damages. Damages my be demonstrated, Lost of income, lost of money, etc.
I am not disagreeing with the notion of gross negligence, but what are the damages?

Good question. What has been damaged? I would say the veterans' right to privacy, possibly the safety of their property and identity. I assume the files contain things such as social security information and the likes, the prime-rib of identity theft today. I am sure you could find a lawyer that could argue some sort of emotional distress that veterans suffered during and after the period of loss and recovery of the laptop , knowing their personal medical records and other things had been compromised and were possibly accessible to anyone. Honestly, I don't know the U.S. legal code in enough detail to make a legally valid argument for this, but there's gotta be a smart lawyer out there who can. :)

I think what would be more important is the fact that if you could bring this issue to court you could actually force some public scrutiny of the past as well as current security measures dealing with veterans' files, scrutiny that comes from 'outside' not from inside the system.

Even if the lawsuit would be dismissed, it would at least allow for some verification and pressure to avoid such blunders in the future.

That's the perspective I have on the whole issue.

Inv

[gaijinsamurai]

Like I wrote earlier, my friends who work for the VA (at a hospital) tell me that the new security measures, put into effect after this incident, are very strict, and are designed to stop what happened from reoccuring.

[Invisigoth]

Like I wrote earlier, my friends who work for the VA (at a hospital) tell me that the new security measures, put into effect after this incident, are very strict, and are designed to stop what happened from reoccuring.

I don't doubt that, just saying that if I was in that position I would still want them to undergo scrutiny rather than having to accept someone else's word for it. Then again I am a fanatical believer in the individuals right to privacy. Its one of those liberties that is really easy to give up and incredibly hard to reclaim. Anyway, lets hope it doesn't happen again in the future.

[gaijinsamurai]

I agree with you, Invisigoth. And, the crime of Identity Theft is one type of activity I find particularly harmful. I was living in Japan when this incident with the laptop occurred, and because i was living abroad, felt particularly vulnerable. It did create a fair amount of stress for me.

I just don't think a financial lawsuit is the correct way to go with this.