|
Are You
Concerned About Loss of Personal Data? By Carlisle Barnes,
Newsletter Editor, Bowling Green Area
Microcomputer User Group, KY
Newcarlislebarnes(at)insightbb.com
http://www.bgamug.org/
The advanced state of Information Technology
is one of the
great blessings of modern times. Today it is built into our economy,
and it
would be hard for both individuals and corporate America to do without
it.
However, along with the blessings to us have come curses. These curses
are
going to get considerably worse unless some dramatic changes are made
in the
way stored information is handled by the majority of organizations.
Computer spam,
pfisheng/phishing schemes and other e-mail
con games, as well as a multitude of ever changing computer viruses are
obvious
curses to everyone using a computer on-line. Great effort is being
expended to
get these curses under control. Very good and still improving
anti-virus
programs are available. Bill Gates said recently that spam will be
completely
under control within two years. (It will be interesting to see if Bill
is right
about that.) The point is that something positive is being done to
correct
those Internet curses.
However, one of the worst
of current IT curses is identity
theft, and very few positive things are being done to stop it. Identity
theft
is not associated with the Internet as are many other IT curses, but it
has
become very much associated with computers because of the casual way in
which
CD’s, laptop computers, and portable hard drives are often handled.
People who
would never ever consider leaving a collection of gold coins laying in
the back
seat of a car, or leaving a thousand dollar bill on a table while going
to get
another cup of coffee, seem to have developed very little concern about
leaving
a portable computer, a container of CD’s, or even a portable hard drive
in all
sorts of places where they can be easily stolen. (Home?)
Unlike sensitive data
handled by military or military
contractor organizations, the personal data stored in files of civilian
Government organizations, major universities, insurance companies,
credit card
companies, and etc. are often treated as casually as advertising
material. A
recent extreme example is shocking and deserves examination.
Not long ago, a Veteran’s Administration
senior analyst took
home electronic data from the office to do after-hours work on his
personal
computer. He had done this numerous times before. The data included
names,
Social Security numbers, and dates of birth on 26.5 million veterans.
These
data list essentially all military personal who have served following
the
Second World War. The analyst’s laptop and a Government owned external
hard
drive (along with all the data under discussion on it of course,) were
stolen
in a May 3 burglary of his home. He reported the theft within an hour
of
discovering it. VA Secretary of Veterans Affairs Jim Nicholson made a
public
announcement of the theft on May 22.
Jim Nicholson appeared
before the House Committee on
Veterans Affairs to explain the situation. While accepting a certain
amount of
personal responsibility for the data breach, Nicholson expressed anger
toward
the analyst who took the data home “without permission.” Further, he
said
"As a veteran myself, I have to tell you I'm outraged. Frankly, I'm mad
as
hell." Afterward, he fired the analyst involved. For what appear to be
justifiable reasons, the analyst is now suing to be reinstated.
What Nicholson did not
report, and later insisted that he
did not know, was that the analyst had been taking data home as part of
his
regular work routine since 2003. (Is the VA a good place to work?)
Furthermore,
existing documents dated September 5, 2002 show that the analyst --
lead
programmer within the Policy Analysis Service -- was officially
permitted to
take the external hard drive home for "work-related projects."
Specifically, he had a property pass allowing the laptop and
accessories to be
removed from the building and also a permit allowing him to access any
Social
Security numbers on the hard drive. It later turned out that there was
yet a
third document allowing him to remove various materials from the VA
building.
A certain amount of security could have been
provided for
these “take home” documents, by encrypting them. However, a reasonable
up-front
cost for the systems, services, processes, and procedures to encrypt
100,000 or
more customer records is estimated to be about $500,000. VA working
personnel
probably couldn’t justify that sort of expense to their budget group.
Once files have been
stolen, it is difficult to determine if
the data have been used illegally. The computer and VA hard disk have
now been
returned, apparently without data loss, but if it is eventually
considered
necessary to contact all affected veterans and to provide them with
credit-checking services, then there will be an estimated taxpayer cost
of at
least $100 million.
The fiasco was not quite
finished when Nicholson appeared at
the congressional hearing. It was revealed at that hearing that Pedeo
Cadenas,
the VA's chief information security officer, had resigned by e-mail 30
minutes
before the proceedings began. Nicholson said he was completely unaware
of
Cadenas’ intentions. Evidently, Nicholson has learned many things
rather late.
On June 28th, not quite two
months after they were stolen,
the computer and external hard drive were turned in to the FBI Office
in
Baltimore, Maryland. A tipster, in response to the $50,000 reward being
offered, had let a US Park official know that the equipment might be
recovered.
Quickly then, the stolen items were turned in to the FBI. The tipster
was not
identified, nor was it clear if either he or anyone else would receive
the
$50,000 reward. Furthermore, no one has been arrested for stealing the
equipment, unless that particular information is being held secret for
some
reason.
Inspection of the hard
drive by the FBI does not indicate
access to the data during the time that the drive was in the possession
of the
thief. Superficially then, no data were compromised and there is
perhaps
nothing to worry about.
Unfortunately, if the thief
was a computer expert, knew what
he had, and wanted to make illicit use of the data, then he could have
transferred everything on the external hard drive to another hard drive
without
leaving a record. While that is possible, it seems improbable and it
seems
unlikely that there is reason for continued concern. However, can we be
absolutely sure?
Those of us who served in
the military, or worked for
military contractors are quite well aware of the way in which sensitive
intellectual material is handled by these organizations. While current
practices are unknown to the author, not very many years ago, there
were at
least five security levels. Restricted meant that the information was
not to be
given to unauthorized people, was certainly not to be made available to
newspapers or to other media, and was not to be left anywhere where it
might be
stolen. The only people allowed to see the material were those with a
need to
know about it. Confidential material classification, one step up from
Restricted meant that the material was not to be made available to
anyone not
having appropriate clearance i.e., clearance by appropriate
investigators.
Except when being used in a cleared area by cleared personal, the
material was
to be locked in a desk or file cabinet with a safety bar and a
combination
lock. All desks and cabinets were to be regularly checked by guards.
Secret
material was to be handled in somewhat the same way, but clearance was
more
difficult to obtain, storage was in a secure safe, not in cabinets or
desks,
and material was to be guarded twenty four hours a day, and seven days
a week.
Top secret material was of course even more closely guarded, and
investigations
for personal clearance were carried out by FBI personnel; in general
all
security was substantially tightened. . Then there was “Special
Clearance”
which need not be discussed here, but which was very tight indeed.
It is absolutely shocking
to note that as serious as
identity theft can be, hardly anyone handling social security numbers,
driver’s
license numbers, medical history facts, educational information, and
etc., etc.
is required to treat personal information in their possession with a
level as
high as military Restricted. As this article was being written, yet
another
security breach occurred at Ohio University, Athens, Ohio. There were
several
resignations from the school staff as a result, but it is one more case
of
“locking the barn door after the horse is gone.”
If current sloppy handling
of private data continues, then
it is only a matter of time until identity theft becomes a disaster.
This article by your
newsletter editor is as close as you
will get to a BGA-Bytes editorial. However, your editor considers the
matter to
be a lot more serious than it is being treated by many people and
particularly
by most public officials.
If you would like to
encourage your congressmen or other
public officials to put some teeth into privacy laws and into laws
concerning
the handling of private information, then may I encourage you to write
and let
them know how you feel.
To help you get started in
sending letters, here are three
addresses of interest. There are numerous others on the Internet.
U. S. Senator Mitch
McConnell, 361A Russell Senate Office
Building, Washington D. C . 20510
U. S. Senator Jim Bunning, 316 Hart Senate
Office Building,
Washington D. C. 20510 U. S. Representative Ron Lewis, 2418 Rayburn
House
Office Building, Washington D. C. 20515
There is no restriction
against any non-profit group using
this article as long as it is kept in context with proper credit given
the
author. The Editorial Committee of the
Association of Personal Computer User Groups (APCUG), an international
organization of which this group is a member, brings this article to
you.
|
Harold Buechly My list of
learning sites. Tutorials Basic Computer Skills | HP Learning Ctr
| LearnThat | Florida Gulf Coast University
| MyTutorials | web Page Tutor | 
Quality
Freeware