0.cached.png
By Steven Levy
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
The nation was shocked last month to learn that a data analyst from the Department of Veterans Affairs had downloaded a database containing more than 26 million personal records, taken it home with him and then had his laptop stolen--exposing all the information necessary to swipe the identity of virtually every person released from military service since 1975. But to anyone paying attention, it was no surprise at all. A congressional committee that issues an annual report card on how each federal department protects information has assigned the VA an F for three of the last four years. The VA's own inspector general has repeatedly criticized the agency for failing to address "significant information security vulnerabilities." And the House committee overseeing the VA has been struggling for years to reform what it considers an information-technology "meltdown." Considering all this, it seemed almost inevitable that the VA would join the ranks of an expanding roster of companies and institutions that do a lousy job of protecting the files they keep on us.
The good news, sort of, is that considering the circumstances of the theft--there had been a number of similar petty burglaries in the analyst's neighborhood, none of which seemed to be the handiwork of black-hat hacker types--the purloined information may never reach the thriving Internet black market. (If it does, watch out, because the records contained the identity-theft trifecta--name, birth date, Social Security number--sufficient to get credit cards, buy cars and houses, and generally mess up someone's finances for years.) Nonetheless, this may wind up to be one of the costliest heists in history. The $25 million that Congress has budgeted to address the problem is only a start--some estimates of the ultimate cost of informing veterans and helping them monitor credit records approach $100 million. And that's only if no one's identity is actually stolen.
Read More on News
The frustrating thing is that the VA data theft, like just about every other huge information breach in the past few years, was utterly preventable. There are well-established "best practices" to protect information. These include installing the right technology to protect the information, training employees to use it properly and enforcing a culture that puts protection of secrets first. The practices decidedly do not include allowing employees to take home unencrypted personal information on a population base bigger than Texas. "Why was this information exportable?" asks Rep. Steve Buyer (Republican of Indiana), who chairs the House Committee on Veterans' Affairs. "Where were the internal controls?"
According to Buyer, who has been holding hearings on the VA's information security for years, a big part of the problem has been that subdivisions of the department each runs its own computer system, with no single all-powerful security czar. The House unanimously passed a bill to centralize the system, he says, but the Senate took no action (the VA embarked on a less ambitious approach to "federate" but not totally centralize its system). And now the laptops have come home to roost. (In testimony after the theft, VA Secretary Jim Nicholson professed outrage at the situation. He has promised a revamp of security practices.)
To paraphrase Tolstoy, every secure computer system is alike, while every insecure one is dysfunctional in its own way. Plugging the holes in all our agencies is complex and costly, but a job that must assume higher priority, especially in an age when the government seems obsessed with squirreling away ever more information on its citizens. The F given to the VA for its practices was only one of several failing grades; other 2005 flunkers included Defense and Homeland Security. Maybe 26 million records lost will be a wake-up call.
Submit Correction
View Editorial & AI Guidelines