PDA

View Full Version : Agency Delayed Reporting Theft of Veterans' Data



Firetxmi
05-24-2006, 04:42 PM
By DAVID STOUT and TOM ZELLER Jr.
Published: May 24, 2006

WASHINGTON, May 23 — The Veterans Affairs Department learned about the theft of electronic data on 26.5 million veterans shortly after it occurred, on May 3, but waited two weeks before telling law enforcement agencies, officials said Tuesday.

The officials said investigators in the Justice Department and the Federal Bureau of Investigation were furious with the leaders of the veterans agency for initially trying to handle the loss of the data as an internal problem through the agency's inspector general before coming forward.

Officials said the investigators in the Justice Department and F.B.I. had complained that the delay might have cost them clues to the whereabouts of the data, stored on computer disks that were stolen in a burglary on May 3 at the home of an agency employee in Maryland.

A spokesman for the agency, Matt Burns, declined to comment on the timing of the announcement.

The disks carried names and accompanying Social Security numbers and dates of birth, practically keys to identity in the computer age.

It was not clear, in the absence of an explanation from the agency, why its officials waited for days to disclose the theft to law enforcement people and still more days to announce it to the public or what internal discussions might have prompted them to change their minds.

As the department sought to reassure veterans not privy to the bureaucratic machinations here and to deal with a security lapse that was becoming a public relations disaster, some veterans were uneasy and suspicious.

"Why did the V.A. wait 19 days to notify veterans?" John Rowan, president of the Vietnam Veterans of America, asked.

Perhaps, Mr. Rowan suggested, the department learned that the news was about to be leaked.

The wife of a disabled veteran of the gulf war, Penny Larrisey of Doylestown, Pa., expressed what countless crime victims have said.

"Just right about now, the only way you can feel is you've been violated," Mrs. Larrisey said in a telephone interview.

The department has emphasized that there was as yet no indication that the data, taken home without authorization by the employee, had been put to ill use.

But Mrs. Larrisey, whose husband, Bob, was an Air Force sergeant, was not soothed.

"This puts us in a position of one paycheck away from disaster," she said, worrying that a computer-savvy thief with access to specifics about her husband's disability payments could tap into their bank account.

The authorities continued to investigate the activities of the employee, who is on administrative leave.

Officials familiar with the case said that while investigators had no reason to dispute the employee's account, they were nonetheless puzzled why little else of value besides the data-laden disks were stolen. In an added twist, the officials said investigators were having trouble finding the employee but did not think that he was necessarily trying to be evasive.

Several aspects remained murky, including how much communication, if any, there was between the Montgomery County police in Maryland and federal investigators about the disks.

Mr. Rowan of the Vietnam veterans' group said the Veterans Affairs Department should do more than just post information on its Web site advising veterans to scrutinize their financial records and telling them what to do if they find something wrong.


Full Article: http://www.nytimes.com/2006/05/24/washington/24identity.html

Laconian
05-24-2006, 07:57 PM
From what I have heard, the only thing taken in the burglary was the disk with the info. Crazy coincidence I guess.

Hollis
05-24-2006, 08:55 PM
I wonder what is the extent of the damage. I have not received anything from the VA. I am either not on the information disk, OR?.......

Firetxmi
05-24-2006, 09:07 PM
Have you tried going on their website and seeing what they have said? If so do let us know. :D

remo williams
05-24-2006, 09:40 PM
I read today that they reported this approx two weeks after it actually happened. Not good for the vets in the end.

CG51
05-24-2006, 10:44 PM
Click me (http://www.firstgov.gov/veteransinfo.shtml)

Mastermind
05-24-2006, 11:29 PM
I am waiting to see if the idiot who is responsible is fired or otherwise has to be made accountable for this. The damage is potentially devastating to the men and women who have sacrificed so much....I won't be holding my breath, though...

ElHombre
05-25-2006, 12:08 AM
heckuva job.

XShipRider
05-25-2006, 12:07 PM
I am waiting to see if the idiot who is responsible is fired or otherwise has to be made accountable for this. The damage is potentially devastating to the men and women who have sacrificed so much....I won't be holding my breath, though...

As a cynic I agree with you. I wouldn't put it past someone to either;
a) promote the individual, or b) reward/award the individual.
Tenure holds too much weight for this issue of such vast potential
damage.

I've mentioned this in another thread but here goes... This guy had data on 26.5 million
veterans. As of the 2000 Census data there were only 26,549,704 veterans in the
US and Puerto Rico (Philippines not listed in the census for obvious reasons). The
over-18 population for that same census is 210,845,117. This means the guy took
home data on 12.6% of the US over-18 population!!!!!!!!! Active duty personnel
not yet on the veterans rolls are not included. Reserves may be if they registered
with the VA for a disability or potential disability.

http://www.va.gov/

EsoognomEhT
05-25-2006, 02:10 PM
More :]

ID Theft the Potential Reward for 26.5 million US Veterans

Posted 25-May-2006 17:48
Related stories: Americas - USA (http://www.defenseindustrydaily.com/americas_usa/), IT - Cyber-Security (http://www.defenseindustrydaily.com/it_cybersecurity/), Issues - Political (http://www.defenseindustrydaily.com/issues_political/), Policy - Personnel (http://www.defenseindustrydaily.com/policy_personnel/), Project Failures (http://www.defenseindustrydaily.com/project_failures/), Scandals & Investigations (http://www.defenseindustrydaily.com/scandals_investigations/), Warfare - Lessons (http://www.defenseindustrydaily.com/warfare_lessons/)
Also on this day: 25-May-2006 » (http://www.defenseindustrydaily.com/2006/05/25/)
http://www.defenseindustrydaily.com/images/ELEC_Spyware.jpg
In a shocking illustration of the truism that more integrated databases make for larger and more lucrative honeypots/ disaster magnets, the data of approximately 26.5 million US veterans was stolen (http://www.military.com/NewsContent/0,13319,98337,00.html) recently. A Veterans' Affairs employee disregarded security protocols and took a laptop with sensitive data home, then the laptop was taken during a burglary at the employee's residence. Information stolen included the veterans' Social Security numbers, birthdates and in some cases a disability rating.
Using this information, sophisticated criminals could obtain credit reports, bank and credit card accounts and place of residence information to complete many or all of the requirements for identity theft. That in turn enables all kinds of fraud schemes that can do irreparable damage to individuals' credit ratings and finances. Identity theft has become a serious problem in the USA, where there are far fewer limits concerning the collection, trade and custody of individuals' personal data, and little apparent liability for its misuse.
This particular incident has been compounded by questionable official actions...



The systems in question have been the subject of critical Inspector General security reports since 2001. Worse, Veterans' Affairs was notified of the potential problem immediately, but reportedly waited almost 2 weeks to contact law enforcement.
The US Senate and House Veterans' Affairs Committees will both be holding hearings on the data theft over the next little while. Expect a lot of shouting. Which, in this case, seems justified.
Meanwhile, a Veterans' Affairs agent told Federal Computer Weekly (http://www.fcw.com/article94636-05-24-06-Web) that veterans need to monitor credit card activity and check with credit reporting agencies in order to spot identity theft. If it does occur, veterans should file a police report as well as a report to the Federal Trade Commission's identity theft Web site (http://www.consumer.gov/idtheft/). Rep. John Salazar [D-CO] has even introduced legislation on May 23, 2006 to provide free credit monitoring and credit reports for veterans and others affected, plus appropriate notification procedures if a theft occurs.

gaijinsamurai
05-25-2006, 10:15 PM
I would like to hope that some heads will roll for this, but I doubt it. Being the Bush Administration, they'll probably just hope the public forgets about it......