Veterans Affairs data theft should be 'call to arms'

By Bill Brenner, Senior News Writer 30 May 2006 | SearchSecurity.com

Security Wire Daily News Digg This!     StumbleUpon     Del.icio.us

The public was already worried about data security before 26.5 million U.S. veterans were put at risk for identity theft following a recent burglary.

Security experts say this latest incident shows that public and private organizations must do more to protect the information they keep and that Congress must offer stronger guidance.

"This should be a major wake-up call that one small event can have a potentially dramatic impact on millions of lives," said Paul Kurtz, executive director of the Arlington, Va.-based Cyber Security Industry Alliance. "I would think this should raise more awareness in the public consciousnesses."

The U.S. Department of Veterans Affairs confirmed May 22 that records for every veteran discharged from the military since 1975 were stolen from the home of an agency employee. The records contained the names, Social Security numbers and dates of birth of the veterans and some spouses.

This should be a major wake-up call that one small event can have a potentially dramatic impact on millions of lives. Paul Kurtz

Thursday, VA Secretary Jim Nicholson told the House Committee on Veterans Affairs that it could cost taxpayers up to $500 million to prevent and cover potential losses. "As a veteran myself...I am mad as hell," the Reuters news agency quoted him as saying. He also said that the stolen records were not encrypted.

Mounting pressure on Congress
It remains to be seen if the Veterans Affairs data theft will push the issue of data security any further into the mainstream than earlier incidents at companies like ChoicePoint Inc. and CardSystems Solutions Inc., said Gerry Gebel, senior analyst for Midvale, Utah-based research firm Burton Group.

He said the incident shows that industry and government entities continue to struggle with data security and that pressure for congressional action will only intensify.

Several data loss notification bills similar to those that have been passed in a number of states are floating through the halls of Congress. Those interviewed said the Veterans Affairs data theft incident may be the catalyst that forces Capitol Hill to pass a law this year.

"This will certainly add fuel to the fire calling for more federal legislation," Gebel said in an email exchange. "In situations like the VA data spill, it's not a single jurisdiction issue, since veterans from all 50 states are represented in the stolen data file. So I think the argument could be made for federal legislation that covers this scenario."

There were signs on Capitol Hill Thursday that fuel had indeed been added to the fire. The House Judiciary Committee approved a bill mandating that companies notify customers when there's a security breach. Critics though are already complaining, according to media reports, that the so-called (.pdf) Data Accountability and Trust Act (DATA) isn't as tough on government agencies as it is on private businesses.

Poll shows shaken confidence
Whatever comes of the DATA bill, Kurtz said Congress will face increasing public pressure to pass something. He said his organization's latest semiannual poll of 1,150 adults measuring the country's security confidence showed that people were already preoccupied with data fraud before the VA incident. Respondents also suggested for the first time that the mounting data thefts are shaking their confidence in the Internet and that there may be political consequences, he said.

Among the survey results: