Slashdot Mirror
U.S. Service Personnel Data Stolen
BStrunk writes "I was reading the news this morning on Reuters, when I stumbled across this article:
U.S. Service Personnel Personal Data Stolen
In the article, an official violated policy by taking the detailed personal information of thousands of active and reserve troops to his personal home, storing it on a personal computer, that was later stolen. In an age where domestic phone calls are monitored, a government employee was allowed to walk out of a government installation with the data on thousands of American citizens to store on an insecure personal computer? Doesn't that seem strange to you? This is a real failure, in my opinion, in government protection of its citizens. Layers of encryption and protected access was successfully bypassed to make the theft of this information as simple as stealing a home pc.
Now, not only do service personnel currently serving have to worry about IEDs and being fired upon, but they are now subject to possible identity theft. A real failure. After this, how could one have faith enough to serve an inept institution?"
After this, how could one have faith enough to serve an inept institution?
Why do we need all the editorializing in the blurb? And the troops don't serve an institution.
The burglary from the employee's home in Aspen Hill, Maryland, involved a laptop computer with an external disk drive, officials have said.
... and it starts by gathering all the personally identifiable information they can get on us citizens? (first the vets data was stolen, now this) ... Maybe the US terrorist threat level should be raised to red!
2 things...
1.) Wouldn't stuff this sensitive be encrypted if it's sitting on an external disk drive?
2.) Is there some sort of conspiracy going on? With the terrorist arrests in California and Canada? Perhaps somebody is planning something big
Improvised Explosive Devise.
Basically a bunch of artillery shells wired to a trigger or remote. When a US convoy drives past the IED hiding spot, a watcher triggers the explosive and the huge crater is formed right where the convoy used to be.
-Rick
"Most people in the U.S. wouldn't know they live in a tyrannical state if it walked up and grabbed their junk." - MyFirs
Improvised Explosive Device - http://en.wikipedia.org/wiki/Ied
You could at least post the update that the Vet's are now suing the VA.
There's a real fear that this includes classified disability info.
If that info gets on the web, an employer googling a potential employee's name may see that candidate has, for instance, post-traumatic stress disorder (PTSD) and decide not to hire them. It's currently illegal to discriminate like that, but there's no way anyone will ever know in this hypothetical situation.
obviously no deficiencies vs. no obvious deficiencies
This is in addition to the identifying data of millions of Veterans stolen in the same event. They originally reported only Veteran data. Now it seems it contains active duty soldier info as well.
TFA: Bryan Whitman, a Pentagon spokesman, said, "We want to encourage service members to be vigilant and carefully monitor their personal information and any statements related to recent financial transactions."
Great, as if they didn't have enough to deal with. I can just picture some soldier under mortar fire in Iraq, trying to load a rifle with one hand while juggling a cellphone on hold with American Express in the other hand..
Slashdot Burying Stories About Slashdot Media Owned
It's not a Dupe... this is a diffrent theft, the origonal data stolen was from the V.A. database.
It just happened exactly the same way...
I guess Slashdot can't help if the news is repetative.
I don't give a damn for a man that can only spell a word one way.
Mark Twain
Slashdot notices a month-old scandal.
Thieves steal personal data of 26.5M vets
Theft of Data Leads to Firings
Clear, Dark Skies
The information is not classified, it's Official Use Only, which is a form of protected information. Personell records are usually, in part, execmt from freedom of information act requests, so they may enjoy a slightly higher level of protection than ordinary OUO.
However, nearly every govenrment computer in existence includiung laptops has gobs of OUO information on it. It's not encrypted because it's not that sort of information. It's just controlled dissemination. That does not mean it might be harmless to release it but it's way below classified.
It is not alarming the people occasionally accdentally disseminate or lose control of OUO. Employees are simply expcted not to do so wilfully or wantonly or carelessly. Its even permissible to share OUO with people outside the governemnt if the employee thinks it would be useful to do so. The fact that OUO was taken home is not a big deal.
In this case the only big distinctions are the massive quantity of the information, and the fact that it's personell records which do have higher levels of protection. Apparently it was also policy not to take these home.
Some drink at the fountain of knowledge. Others just gargle.
Its a device used to keep from getting pregnant. In the late 80's, there was an IED for OIL program that the UN started with limited success. Since then, the country has had a glut of birth control so much so that inventive terrorists have discovered a way to turn them into cheap and effective weaponry. This is why the military has upped its recruiting of pre-teen girls to combat this menace.
This is my sig. There are many like it but this one is mine.
Besides, domestic calls are not monitored without a warrant. Do you have a problem with that? Perhaps you are thinking of international* calls to known members of terrorist organizations.
Is that a question?* According to my phone bill, a call made from my house to another country is an international call.
Gamingmuseum.com: Give your 3D accelerator a rest.
The only way to prevent most of that kind of leak is the infamous trusted computing. How can you prevent somebody to walk out of the building with critical files on his USB key without "secure hardware" ?
that most folks who go in the military don't do it to "serve an inept institution" or to serve an insitiution of any kind. Those who are serving for ideological reasons (even if "patriotism" only plays a small part in the decision) believe they're serving the country as a whole and the ideals it stands for. That's why we say "serving our country" not "serving the military."
Everyone who has been in the service knows that there are always a few idiots up in the higher levels of the chain of command. Also that the civilian employees of the DoD aren't always interested in looking out for the interests of the military personnel that they are supposed to be serving. Dealing with the civilian DoD folks was a constant frustration during my time at Fort Bragg. Not that those folks are all bad, but the service they gave me when I was in the 82nd was second only to the service I get from the DMV -- surly and uncooperative.
Interested in a Flash-based MAME front end? Visit mame.danzbb.com
Don't worry, this is all fixed now, and can't possibly happen again. We recommend that you not dwell on past history, and move forward into the future. Your private information is completely safe with the government, we've learned our lesson.
And that goes double for next time, too.
We know where leadership by an anti-intellectual "strongman" who scapegoats minorities and likes boisterous rallies goes
"Who shall watch the watchers?" --Decimus Iunius Iuvenalis
This follows on to the theft of several laptops worth of corporate employee data. Almost makes me want to open up a consumer credit protection business...
Ernst & Young lose data on a quarter-million Hotels.com customers
Ernst & Young (hey, there is a theme here!) lose information on Sun employees (including then-CEO Scott McNealy). Also included were employee records for IBM, Nokia and Cisco.
Wells Fargo proves it can play the game too.
And not to be left out, let's not forget Fidelity's loss of 200,000 HP employee records.
What's scary is that both Fidelity and E&Y audit other companies for security and regulatory compliance (including HIPAA and Sarbanes-Oxley)...
Just junk food for thought...
Not keeping records of servicemen's personal data secure is a good deed?
Fuck, I sure hope so. I hope he got fired twice somehow in a bizarre star-trek-ian causality loop. Anyone who would keep confidential data on a computer in a physically insecure location without encrypting it is a fucking moron. Fuck him in his working-at-home ear.
Perhaps you didn't notice, but the entire federal government got failing grades on their infosec security report card. Are you really okay with that? By making excuses for idiots who cannot see their way to actually protecting confidential data, you are part of the problem.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
(most)Army civ employees are crap ... they make all contractors feel like cinderella (or cindarellus) for doing all of the work they [can't]/[won't]/[incapable of doing] while they rot on the vine. Tons of tax $$$$ could be saved by cutting these leechy turds loose.
-- if you mod me down, I will become more powerful than you can possibly imagine
People are focusing on the transgression of the guy putting this data on his laptop and taking it out of the building. In reality, you can bet the systems he was working on were networked and he could have accessed the data from his home directly. I'm not sure if there is a simple solution to this other than constantly making sure all data is encrypted wherever it is stored.
Actually this is the best thing that could have happened. A complete failure in a system, potential for identity theft, and involving current/past service men/women. I am one of those by the way.
Why is this the best thing? Cause when troops are involved national pride actually works and things get done. People will flip out over this and they will finally fix it. Think of the children is first followed quickly by think of the troops. Now maybe they'll put the responsibility where it belongs. Squarely on the shoulders of those companies that deal with credit. Then I'll stop getting those calls for the new service that protects my credit and it only costs $14.95 a month. Make that free and actually go after these thieves instead of what they do now.
This is a common misstatement made by those who think joining the armed services is about service to the army, or the navy, or the president. Joining one of the U.S.A.'s armed services is about serving your country, not the individuals in control of it. It's about protecting your homeland from invaders. It's about getting a shot at the brass ring of U.S. citizenship through sacrifice. It's about putting yourself on the line for your brother, your friend, your mother, your future, etc.
When I apply for a job in the states, I do so based on my ability to trust my employer to treat me responsibly. I would refuse a job that didn't pay well, or one where my employment would be degrading or unduly dangerous. Joining any military is a distinctly different sort of employment. It's an inherently dangerous job, one in which you can expect abuse from your employer, rigorous and painful training, and eventual combat duty.
So, in short, while this article is certainly a sign that our government is abusing our troops, one should honor those who do so despite the obvious risks inherent in service. Rather than wondering who would serve, we should wonder who would treat so poorly those who give so much. We ought (as in a moral ought) to respect and honor those who risk their lives to defend our way of life. We ought (again, moral ought) to hold in deepest revulsion those who abuse them, or send out the troops over petty personal desires and greed.
-GiH
"In an age where domestic phone calls are monitored, a government employee was allowed to walk out of a government installation with the data on thousands of American citizens to store on an insecure personal computer? Doesn't that seem strange to you."
No contradiction here, both are consistent with each other. Either way, it is because you have no privacy in the eyes of the state.
${YEAR+1} is going to be the year of Linux on the desktop!
I've done work like this, writing software that works with various sensitive data, millions of records, maybe even one of you, and I've done it from home.
However, my set of data was real data that was obfuscated, random names, SSNs, etc., generated, replacing the ones in the database. No real data was ever allowed to be exported off the database server, period. Only an SA could steal it.
That this wasn't done is just gross negligence on the part of the organization.
"how could one have faith enough to serve an inept institution?"
./ editors have enough of the spin and editorializing - especially when its egregiously wrong as it is in this case. How about getting an editor with some military background instad of the usual suspects? A little bit if diversity might help ./ avoid posters like the originator who completely misses the point of the article and instead tries to spin it politically (point is veterans records were taken via a moron breaking security at the VA, not some anti-military screed that the OP tries to spin it into).
I didnt serve the Army - I served *IN* the Army.
What I served was the American People, through their elected Commander in Chief, and the primary focus of the Oath I and others swear is:
to Uphold and Defend the Constitution of the United States
Second error bythe OP is the "institution" that lost the data was not the military per-se but the Veterans Administration, a cabinet level office that is seperate fromthe Army, Navy, Airforce, marines and Coast Guard,m etc.
When will
There Plenty of libertarian geek veterns out there who post here regularly - Rob, grab one and add some diversity to the editorial clique.
Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo! http://goo.gl/J9bkO
I know that in this case more than social security numbers were taken. But this is a good spot to say that I would like the US government to publish, for free download, a list of all issued SSNs and their associated names. Then the banks, insurance companies, universities and so on will have to stop pretending the damn things are secret.
Of course! Privatizing government functions lets the government get around that annoying thing called the "Constitution" (aka "just a goddamn piece of paper").
Similar to the upcoming US election results
I doubt "The Man" specifically engineered this failure. "...was allowed to walk out?" What kind of crap statement is that? He had a laptop and an external hard drive. I didn't see any mention of "His supervisor instructed him to copy sensitive data onto a personal computer..." Should everyone leave an hour early so the door guards can perform an extensive scan on their laptop? If they run across encrypted files, shoudl they require the keys, to ensure no secure data is being taken? If they have to check those files, then don't the door guards need very high-level security clearances?
Unless you want the government to perform a full cavity search on every employee capable of interacting with anyone who has access to secure files every time they leave the building, this sort of thing can happen.
All the procedure in the world won't make up for an unthinking -- or worse, uncaring -- employee worried about meeting a deadline.
That what was all this school was for... to teach us how to solve our own problems. -- janeowit
Here's how it happens:
The big problem is management, the people who make the big money to take responsibility, react more than proact. Security means vigilance, but it also means giving people the proper time to do their work within the procedures of security. In my life I've only met a few people who took day to day security seriously and made a point of not giving in when someone asked for a short cut, "just this one time."
Management as much as ever seems to attract people to the wages and not the actual responsibilities. Peter principal of some strip I suppose.
A feeling of having made the same mistake before: Deja Foobar
Someone stole a laptop. It would be wiped and sold on the street. 99% chance no one would be the wiser, the thief didn't know what he had. Now news comes out that there could be a laptop with tons of valuable info...thiefs all now look to see if they have the golden laptop! Another case where the news of the incident makes the problem worse. Lets make a big deal of this when someone actually knows they have this data and uses it for ill intent.
This was different data, on the same damn laptop. I think the guy was in on it. Nothing else was stolen, just his laptop, which, oopsie! had not one but two sets of valuable data which were not supposed to be on it. Here's what I think went down:
Dude had some bad debts to some bad men. Said bad men approached him with a way he could pay them off. Just get data for ID theft on his laptop then leave it in his house and they would make it look like a burglary. Dude does so, and reports laptop stolen, but not the data on it. Later, after other Bad Dudes are off his back, dude has a change of heart and admits the data was on the laptop.
I know, never ascribe to malice or greed what can adequately be ascribed to incompetence, but I think the facts in this case are pretty damn fishy.
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
I generally agree but have to add that when I worked on a Naval base, we had a very good set of govies, mostly software engineers (some with PhDs) who operated at a very sophisticated level of computing and were not just sitting around and rotting in their chairs. Even the management was good. In this case it was often the contractors that were mediocre -- we had the full range of really good contractors and some who were only good for dragging tax dollars out of the millitary. I think the difference here was that the job was interesting (meteorological and oceanic weather modelling products). Most people will sit around and rot when they are restricted by small minded bureaucracies. Everything was fine at this place until you had to request office supplies.
First, how would someone know that this computer contained all this information?
If you're following the story, every indication is that it was a routine suburban residential burglary. I live in the same county as the home that was robbed, and this is exactly like every other B&E we always see: laptops, game consoles, digital cameras, jewelry, cash. Rinse, repeat.
If you live in the DC area as an info-worker, the odds of you handling sensitive payroll or similar data, especially related to government/military employees, is certainly higher than anywhere else in the country. But the odds of such a theft happening at all pretty much demand that crap like this is going to happen. The idiot probably would have lost his laptop in the same burglary regardless, but his inappropriate use of that data on his local drive, away from the office, turned something you otherwise would never have heard about into a real pain in the ass. Of course, the person who stole the hardware probably has no idea what's on it, or what to do with it.
Am I being paranoid?
If so, only about the wrong things. This is a workplace culture issue, not some nefarious plot. Too many people have casual access to all sorts of stuff (I know I do) without all of the interested parties really communicating about the risks and trust involved.
Don't disappoint your bird dog. Go to the range.
Now, not only do service personnel currently serving have to worry about IEDs and being fired upon, but they are now subject to possible identity theft. A real failure. After this, how could one have faith enough to serve an inept institution?"
I'm in Iraq right now. Yes, we have to deal with IED's and being fired upon. And yes, having to worry about this isn't all that great either. But that has absolutely nothing to do with "serving an inept institution" as you call it. We don't serve an institution. We serve in the Armed Forces of the United States. I serve in the Army, and I don't think that the Army is inept. This isn't a failure of the US Army as a whole, but it was due to the indiscretionary act of one person. He violated OPSEC (Operational Security) and he had no business taking sensitive information into his personal computer. This is HIS fault, and I hope he gets prosecuted to the fullest possible extent under the UCMJ. So please, like the parent said, no editioralization is necessary. We serve because we took an oath. We serve because we are professionals. We serve because words like Loyalty, Honor, Duty and Courage mean something to us. It doesn't mean that it means nothing to a civilian. But I hate it when people assume we are nothing but mindless drones. I, personally, try to keep politics away from the military. Which is why I don't endorse any side of political debate, when speaking as a soldier. I'm here to do a job, and I'm here as a professional.
Sorry for going so far off-topic.
Vivin Suresh Paliath
http://vivin.net
I like