FYI to all AO Members Who Are US Vets: Veterans Sue VA over Data Loss

Printable View

June 7th, 2006, 10:07 PM
genXer

FYI to all AO Members Who Are US Vets: Veterans Sue VA over Data Loss

I'm surprised it took this long:

Quote:

WASHINGTON—Claiming that the U.S. Department of Veterans Affairs, "flagrantly disregarded the privacy rights of essentially every man or woman to have worn a United States military uniform," veterans groups today filed a massive class-action lawsuit in the U.S. District Court for the District of Columbia.

The suit asks that the courts prohibit the VA from handling any personal, privacy protected data except under court supervision, and that the court create a set of "consensus minimal security standards" under which the VA can operate.

The suit also asks for damages of $1,000 for every person listed in the missing database files.

Quote:

According to the suit, the information was unencrypted and easily available.

Wheee! :eek:
http://www.eweek.com/article2/0,1895,1972946,00.asp

For me, as a vet, I don't want any money, just reimbursement if I have to pay for any credit reports and fixing my credit because of this, but just that they need controls in place to protect that data! Put the money towards that. But I want an outside audit firm to confirm controls are in place and are working.

Oh... wait... an update - oh boy - it just gets better:

Quote:

VA: Data Theft Bigger than Reported

Secretary of Veterans Affairs R. James Nicholson has revealed that the data stolen from an employee's home in Maryland in May included personal information on over 1 million active duty, reserve and National Guard personnel.

Nicholson said the new information came to light when the Department of Defense compared electronic files.

http://www.eweek.com/article2/0,1895,1973260,00.asp

Now they are "saying" that it was a smash and grab, however you may wish to keep track of your transactions and check with at least one of the Credit Bureaus (you can get a free credit report if there is fraud involved, or you can buy a 3-in-1 report) at your earliest convenience:

Equifax: http://www.equifax.com/

Experian: http://www.experian.com/

Transunion: http://www.transunion.com/index.jsp
June 7th, 2006, 10:42 PM
dalek

As troubling as it is for the Vets, just think how demoralizing it is going to be for those on "active" service to hear this bit of news, not like having to worry about suicide bombers, now they have to worry about ID Theft, after they get to come home... because of people who they place their trust in, screwed up...shameful... :mad:
June 7th, 2006, 10:53 PM
RoadClosed

Great another bone to toss the lawyers who feed on fear. I think its BS and the dudes involved should be fired along with their bosses. But the real crime here is not the va however. It is the criminals. sue them. Caution coffee is hot and your data is everywhere.
June 8th, 2006, 01:42 AM
Galdron

.....................

They might as well put my $1000.00 towards my funeral expenses as that is about the time frame I expect anything from the V.A.

:rolleyes:
June 8th, 2006, 01:46 AM
debwalin

Quote:

Originally posted here by RoadClosed
Caution coffee is hot and your data is everywhere.

But don't you think that service members have some right to expect their information to be safe with the VA? I mean to follow your thought a little further - your data is everywhere, it's your responsibility to keep it safe and keep people from having it, so maybe since the VA can't keep it safe, not joining the military because your data might be lost is the best plan?
June 8th, 2006, 06:17 AM
fourdc

Working for the government, I discovered a long time ago that a lot of the rules and laws that the private sector follow are totally ignored by the government itself.

If this had been a contracted firm or an outside hospital, they'd have to file bankruptcy for all the government fines they'd be paying.

On another note any of those people who's state uses SSN as driving license #s you've already been co-opted. Privacy is an illusion you haven't had it for a long time. We will probably never get it back.

I think a greater emphasis should be placed on validation of new credit accounts. When I opened a custodial bank account for my son, we both had to provide IDs to prove who we were ( for a $200 passbook account). Under the Patriot Act, we had to prove we weren't laundering money.

Why is it I can open a credit account for $5000 with my SSN and a phone call?
June 8th, 2006, 03:09 PM
genXer

I wore an onion on my belt... cuz that was the style at the time...

Back in my day (oh Lord - I'm already that old - heh) everything, and I mean everything was done by your SSN and your last name. From your orders to clothing inventory had your SSN on it. I went through and shredded as much of the old paperwork I could, saving some for the memories, just because of that. However, back then (yeesh!) securing data like that was not at the forefront; getting those great wool socks wuz! :p

I am interested to see what happens with this. I'm not favoring a lawsuit, other than to fix the areas that need addressing; and I say the lawsuit, because maybe certain people would actually move and get the work done.

It also makes me wonder, how many other agencies are facing something like this soon? Or already have and just don't know it yet? Or they do know it and the public just doesn't know yet?
June 8th, 2006, 03:28 PM
nihil

Hi genXer I think that you have a point there, and that this sort of thing is far more prevalent than people imagine.

You may recall that scandal in the Japanese Defence Department a few months ago where staff were taking classified information home to work on :eek:

Staff are being virtually blackmailed into working the extra hours, and naturally, they want to be with their families.

OK, I have done design and development stuff and prepared presentations at home, but never anything that involved more than the lowest level of corporate confidentiality, and certainly not statutorily protected information.

I honestly believe that some of these people could seriously benefit from a teamwork, delegation and time management course?

;)
June 8th, 2006, 07:02 PM
RoadClosed

Quote:

Working for the government, I discovered a long time ago that a lot of the rules and laws that the private sector follow are totally ignored by the government itself.

That it totally true and in one sense I am glad. Forcing compliance on the government does one thing. Make them BIGGER.

On the flip side sometime they are more stringent, but not often

Quote:

But don't you think that service members have some right to expect their information to be safe with the VA? I mean to follow your thought a little further - your data is everywhere, it's your responsibility to keep it safe and keep people from having it, so maybe since the VA can't keep it safe, not joining the military because your data might be lost is the best plan?

Yes I do, I stated those involved and their bosses should be fired. That is corrective action. Not some slime ball lawyers forcing the government to pass even more legistaltion and making millions of mine and YOUR tax money using the backs of vets. This guy may have made the mistake of taking stuff home on his laptop but many programmers DO take stuff home. It was in his house and like a VA office or Bank office someone can break in a steal it. That does not mean the bank or business should go bankrupt because some ass wipe thinks everyone but him has to pay.

We give our data out everywhere. And there individial cases of ID theft, IF they were to happen should be taken care of in local courts.
June 8th, 2006, 07:26 PM
morganlefay

Quote:

According to the VA, an employee took home electronic data containing the names, Social Security numbers and dates of birth for millions of veterans and some spouses, as well as some disability ratings. The data didn't include any of the VA's electronic health records and financial records. The data was stolen when an employee's home was burglarized.

From

http://www.eweek.com/article2/0,1895...06dtx1k0000599

Doesnt this have to do with the agencies AUP......why was that data allowed to be removed and brought home by the user...and if it was allowed ..........why wasnt it encrypted????

If the user needed to access the information... arent there more secure ways for the employee to have access...then to copy and take home.

Why would any luser need to have 26 million personal records on a laptop in the first place....

From my experience............................I would wager the user was upper management.... :rolleyes:

Most of them beleive they are somehow "above" the rules\laws

MLF
June 8th, 2006, 11:10 PM
debwalin

Re: I wore an onion on my belt... cuz that was the style at the time...

Quote:

Originally posted here by genXer
Back in my day (oh Lord - I'm already that old - heh) everything, and I mean everything was done by your SSN and your last name.

My favorite was the mail that used to come to us, addressed with our names and social security numbers on the envelope!! :eek: LOL- Back in the day, right? It was well before anyone was really concerned about identity theft - but it still made me nervous.

I don't neccesarily favor a lawsuit (in almost no case do I really favor a lawsuit), but to dismiss the people affected by this as the usual idiot who let someone get hold of their pertinent details is unfair, and they do deserve some sort of consideration.