Security News > 2006 > June > Stolen VA Laptop and Hard Drive Recovered

http://www.washingtonpost.com/wp-dyn/content/article/2006/06/29/AR2006062900352.html By Christopher Lee and Zachary A. Goldfarb Washington Post Staff Writers June 30, 2006 Federal officials yesterday announced the recovery of computer equipment stolen from an employee of the Department of Veterans Affairs. They said that sensitive personal information of 26.5 million veterans and military personnel apparently had not been accessed. The laptop and external hard drive, stolen May 3 from a VA data analyst's home in Aspen Hill, contained the names, birth dates and Social Security numbers of millions of current and former service members. The theft was the largest information security breach in government history and raised fears of potential mass identity theft. VA Secretary Jim Nicholson announced the recovery yesterday during a hearing of the House Committee on Veterans Affairs. "Law enforcement has in their possession the laptop and hard drive," Nicholson said. "The serial numbers match. They are diligently conducting forensic analysis on it to see if they can tell whether it's been duplicated or utilized or entered in any way, and that work is not complete. However, they did say to me that there is reason to be optimistic." FBI officials and local authorities said at a news conference that a person who had the laptop contacted U.S. Park Police on Wednesday after seeing news accounts and notices of a $50,000 reward offered by Montgomery County police. The devices were recovered in the "general vicinity" of Aspen Hill, said Chief Dwight E. Pettiford of the Park Police. FBI Special Agent in Charge William D. Chase, of the agency's Baltimore office, said it is "way too early" to say whether the person will get the reward or whether criminal charges will be filed soon. FBI spokeswoman Michelle Crnkovich said the tipster is not a suspect. "A preliminary review of the equipment by computer forensic teams has determined that the data base remains intact and has not been accessed since it was stolen," the FBI said in a statement. "A thorough forensic examination is underway, and the results will be shared as soon as possible." Lawmakers hailed the investigative work but said VA still has much to do to improve data security. "[T]he basic deficiencies leading to this data loss must be corrected," Rep. Steve Buyer (R-Ind.), chairman of the Veterans Affairs Committee, said in a statement. "The history of lenient policies and lack of accountability within VA management must be rectified." Rep. Lane Evans (Ill.), the committee's ranking Democrat, said in a statement: "Today's announcement does not relieve the Department of Veterans Affairs from fixing its broken data security system and failed leadership." The theft has proved to be an embarrassing and expensive management failure for VA. In a series of hearings, lawmakers have criticized Nicholson for the department's lax security practices and sluggish response, noting that the secretary was not told of the burglary for 13 days. The incident also has cast light on the department's consistent ranking near the bottom among federal agencies in an annual congressional scorecard of computer security. Pedro Cadenas Jr., the VA official in charge of information security, resigned yesterday for personal reasons, VA officials said. Earlier, a high-ranking political appointee was dismissed and a longtime career manager was forced to retire. The Bush administration this week asked Congress for $160.5 million to pay for free credit monitoring for veterans and military personnel. VA already has budgeted $25 million to create a call center to handle veterans' questions and to send letters alerting veterans about the theft. Several veterans groups have filed class-action lawsuits locally and in Kentucky against the government, seeking $1,000 in damages per affected veteran. Initially, VA thought that all of the 26.5 million people affected were veterans. But a database comparison revealed that the stolen equipment also contained Social Security numbers and other personal information for as many as 2.2 million U.S. military personnel, including 1.1 million active-duty military personnel, 430,000 National Guard members and 645,000 reserve members. Nicholson said it is too early to tell whether free-credit monitoring for veterans is now unnecessary. VA still plans to hire a data analysis company to monitor whether veterans' identities are being stolen, he said. Rep. Bob Filner (D-Calif.) said yesterday that three VA documents obtained by the Veterans Affairs Committee indicate that the data analyst was authorized to take a laptop home and use a software package to access the data. That contradicted Nicholson's previous testimony that the employee was not authorized to have the information at home. "He got all the approvals that he was supposed to have," Filner said. "I don't know of a policy that he violated, if you'll tell me one. And that's the real negligence -- that there were no policies." Nicholson said he had not seen the documents, and declined to comment because the career analyst is challenging Nicholson's decision to fire him. Tim S. McClain, VA's general counsel, told the panel that one of the documents did not apply to the laptop that was stolen. He acknowledged that the other documents granted the analyst access to Social Security numbers and permitted him to have software at home. Jim Mueller, commander-in-chief of the national Veterans of Foreign Wars, applauded the equipment's recovery, but said in a statement that Nicholson still has much to do to repair the agency's reputation. "The longer Secretary Nicholson waits to hold people accountable, the more confidence he will lose in the eyes of America's veterans, their families, and those who wear the uniform today," he said. © 2006 The Washington Post Company _________________________________ Attend the Black Hat Briefings and Training, Las Vegas July 29 - August 3 2,500+ international security experts from 40 nations, 10 tracks, no vendor pitches. www.blackhat.com

News URL

http://www.washingtonpost.com/wp-dyn/content/article/2006/06/29/AR2006062900352.html