Slashdot Mirror
Stolen VA Laptop Recovered
lancejjj writes "Remember how the VA was pinning the theft of 26.5 million veterans' personal records on a hard working-but-renegade employee whose laptop was stolen? Surprise! It turns out that the employee had written permission to bring the sensitive data home. Fortunately, the laptop has been recovered. It is still unclear how the laptop was recovered, or if any of the veterans' personal data was leaked."
Or a copy of it for publicity sake.
- Kal`Goblez
I believe it said on the FBI's report that it looked like the data had not been looked at.
Why, yes, I AM a Pagan Libertarian.
According to the FBI as reported by Reuters. The FBI said that the DB hadn't been accessed since the date it was stolen. Keep in mind, too that laptop thefts are no different than any other and the vast bulk are crimes of opportunity. So it most likely that the laptop was just at the worng place at the wrong time and the tweaker responsible had no idea as to its value.
If brevity is the soul of wit, then how does one explain Twitter?
There is no way the thief who had it thought to himself "Hmm all these VA logos, some huge files with a bunch of names and 9 digit numbers. I obviously have nothing important here, I should just return this to the rightful owner." I mean it's not like this was all over the news or anything. Where would he get an idea like 'steal the identities of 26 million veterans'??? I know I can sleep a little easier (mostly because I was never in the armed services). On a more serious note, why aren't the headlines reading "VA wrongly accused employee of negligence, prepared to take full blame"? That seems to be the gist of this event.
Seriously. Attention any/all US federal legislators reading this: just mimic the EU on this one. It's a no-brainer and will win you the all-important geek vote.
there is no need to sign your posts. this isn't usenet. your username is right there above your post. stop it.
They probably just put up a blog.
After discovering truecrypt, I realized how easy it is to have your sensitive data secured. Provided that the laptop doesn't contain spyware, only the person with password to the truecrypt volume can read it. After it's turned off, nobody else can.
And the hidden volumes feature in truecrypt makes it much harder to steal the data (not only you'd need the normal volume password, you'd also need the hidden volume password - IF there is a hidden volume, which you don't know).
One of the articles quoted the permission granting documents, saying that the analyst needed real SSNs for his work. I don't understand why that would be the case. Couldn't they have generated a fake list, verified that no two numbers were alike, and assigned a bunch of random names? It seems like the whole issue could have been eliminated from the start by doing this. Also, it's just shameful the way a bunch of middle-management types are trying to shaft the analyst when he's had written permission for ~4 years.
Meh, a real sig would take too long, and I have an MMORPG to play with....
Because one method involves Chuck Norris and immediate death for the thief. The other involves Charlie Sheen and about two hours of pouty looks and deadpan humor. We owe it to history to properly document this event!
Why? He had at least three written memos given express permission for him to do what he did. The problem here wasn't with the worker, it's with the policies and directors that signed the memos.
Meh, a real sig would take too long, and I have an MMORPG to play with....
Nothing appeared to be copied? Bah. What's keeping a would be data thief to boot up with a Linux distro, copy at will and shutdown the computer
.I use a utility called TrueCrypt on my computer. I don't use a Mac (I would if I had the money), but I think the Mac has a utility (built in to the OS to boot) that let's you encrypt the contents of your home folder. This utility (TrueCrypt) enables me to reserve a chunk of space on my HD and encrypt it. I'm pretty confident that if my laptop gets stolen, the data will be *reasonably* safe.
This is just a mix of bad infosec policies and worse OS.
the future is but past forgotten
Oh no, the best thing they could do is let him keep the job. He's the least likely person in the US to do this again. It would be different if he stole it himself.
You are checking your backups, aren't you?
The employee had permission to access social security numbers. The employee had permission to take a laptop home. The employee had permission to use database software at home.
The VA still contends that the employee did not have permission to put the social security numbers on the computer and take it home.
Look at the timeline. He gets permission to access SSNs in February. He gets permission to take a laptop home in September. Sometime during the year he got permission to use a database program at home. It still sounds to me like he took a little personal initiative to take the SSN database home.
Still, the whole affair was handled pretty damn poorly, particularly the delay in reporting it, among other things.
-h-
Data privacy laws aren't there to keep the gov't from snooping into your stuff, it's to keep companies from trading your private data, or even keeping it on file in many instances.
there is no need to sign your posts. this isn't usenet. your username is right there above your post. stop it.
Never, EVER steal a piece of hardware for info without returning it(after taking the info).
It will be interesting to see the public's reaction when 26.5 million SSN are posted tommorow on a blog.
Actually you don't have to have your tinfoil hat on too tight to believe that.
The situation you describe is not at all unlike how the mafia cargo-theft operations run (or used to run...the people I know are all ex-OCTF types). Basically they'd find some truck driver who had a gambling problem, and make him a deal: he parks his truck at a certain rest area on a certain night, and goes into the restaurant to have dinner. When he gets out, his truck is missing. Sometimes they'd even arrange it so that the cargo in question that night would be particularly high-value (load of VCRs, whatever), or easy to fence merchandise.
The key question in the data-theft is whether or not U.S. organized crime is really involved in large-scale identity theft, to the point where they would have wanted to get their hands on a laptop full of data that badly. If you think that they are, then the whole scenario doesn't seem totally implausible.
I'm fairly confident, however, that the FBI is probably looking down this angle -- it's not really that hard a thing to imagine, so I expect that they're going through the employee's finances and everything else, seeing if there's some way he could have been compromised.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
My data just happened to be on that hard drive, so I am a little upset about it to say the least. We in the armed forces have been told that the individual was definitely NOT supposed to take that data home. It even says so on the VA website reguarding this incident. http://www.firstgov.gov/veteransinfo.shtml If he had written authorization to do so, then that is a completely different story, and all of us that were affected should be even more angry. There are procedures in place for bringing ANY government property home; whether it be DATA or PHYSICAL media. Especially privacy act information.
So which is it? He was or he wasn't allowed to? It is a bit too convenient for my taste that the laptop was recovered so magically and with the data intact.
This kind of back-and-forth "truth" on these kinds of issues gets very old very fast.
Smells fishy...
It sounds like a coverup to me. They never found that laptop, and if they did, it wasn't the one that was missing
Does your specially-formed tinfoil apparel help you to know these facts? The scoop is that someone turned it into the Baltimore FBI office, and they're keeping it quiet because the $50k reward was part of the picture. Their forensics people were the first ones to look at the machine, and that's what they do all day.
More likely whatever ever idiot looted the house and took the portable fencables really didn't know what to do with it, and probably saw the government markings on the machine later. Not something you can put on eBay or take to a pawn shop. And people like that are in the habit of asking their equally ass-hattish what friends to do with something like that. Obviously one of the more enterprising ones is looking to turn it into $50k.
Don't disappoint your bird dog. Go to the range.