Slashdot Mirror
Census Bureau Loses Hundreds of Laptops
Billosaur writes "According to CNN, The U.S. Commerce Department has lost 1,137 laptop computers since 2001, most of them assigned to the Census Bureau. According to Commerce Secretary Carlos M. Gutierrez, 'All of the equipment that was lost or stolen contained protections to prevent a breach of personal information.' This comes after the fiasco involving the Veteran's Affairs Department's loss and eventual recovery of a laptop containing 26.5 million veteran and active-duty records." Given the scope of the operation, are these losses to be expected or is this an example of poor government security standards?
I was going to stay
1) Use a MacBookPro
2) Turn on FileVault
3) Problem solved.
But it appears as if there's an equally effective solution in Windows:
kb 307877 simply Click Start, point to All Programs, point to Accessories, and then click Windows Explorer, locate the file that you want, right-click the file, and then click Properties, on the General tab, click Advanced, Under Compress or Encrypt attributes, select the Encrypt contents to secure data check box, and then click OK If the file is located in an unencrypted folder, you receive an Encryption Warning dialog box. Use one of the following steps: If you want to encrypt only the file, click Encrypt the file only, and then click OK. If you want to encrypt the file and the folder in which it is located, click Encrypt the file and the parent folder, and then click OK.
(yesyesyes, if you detailed the procedure for enabling FileVault it would be nearly as long).
But, I'm 100% serious about this, why don't both Microsoft and Windows enable file encryption by default?
(Full disclosure. Do I use FileVault? No. Why not? Well, to tell the truth, I'm worried about bugs and glitches. There is safety in numbers. If Macs had FileVault enabled by default, then any bugs in it would cause problems for millions of users, and Apple would find out and fix them quickly. As it is, I suspect about 0.01% of all Mac users use it, and I've felt for a long time that one of the keys to avoiding OS trouble is to stay in the mainstream and avoid using anything that lots of people aren't using--unless I have a good reason).
"How to Do Nothing," kids activities, back in print!
I know this sounds bad, potentially losing census data and all, but as a recipient of several of the computers used in the 2000 census (essentially hand-me-downs when they were done with the census to other Department of Commerce offices), there wasn't any personally identifiable information on the machines when we got. No laptops were in our transfer, but the desktops and servers were clean. We were asked to make sure that the hard drives had been wiped. All of the ones that came to us were.
I'm willing to bet that the number of "lost" machines is really much lower than the report stated. I just looked at our inventory and changes we submitted over the last couple of years (dead machines especially that need to be removed from inventory) haven't been made in the master lists yet. I'd chalk this up to carelessness with the inventory database more than carelessness about actual machine loss. After all, we're talking about 5-7 year old laptops. Who's really using those old boxes anyway?
For a while governement employees were making all kinds of dubious charge to their work credit cards. Expecially in the Katrina cleanup when limits were loosened.
My company directly reimburses the credit company, but only for "approved" expenses. Sometimes things are not approved and the employee must pay it then.
Considered a good job by whom? I work for an agency under Department of Defense, supporting about 3,000 users. We've lost three laptops in the last five years, two of them by the same contract employee. That employee no longer works here.
I can't speak for Commerce but DoD requires FIPS 140-2 encryption of data at rest on mobile devices. We redirect mobile user's My Documents folder to a network share, turn on data synchronization and encrypt both the local and remote directories. All users are briefed on the requirement to store data in that encrypted location.
There are real issues with encrypting an entire drive and how the hell you recover the data if the user dies/quits/forgets his password. At least the way we do it selected domain admins can decrypt the data on the network share if required.
But - IM frequently less than HO losing almost 4% of an agency's mobile computing resources is completely unacceptable. Somebody needs to get spanked over this one.
we see things not as as they are, but as we are.
-- anais nin
I used to work at the Census Bureau. I didn't see anything like this in the IT groups -- they were pretty sharp. More likely this is a recordkeeping problem at Commerce where obsolete laptops were returned, properly disposed of and recorded correctly at the Census bureau but the knowledge didn't make it in to DOC records. It wouldn't be the first time.
Of course, this is a mildly uninformed opinion. I haven't worked at Census for a while and I had nothing to do with laptops when I did. I'm just saying there's something fishy with the notion that Census lost a thousand laptops. I don't buy it.
Besides, excluding the decennial survey-takers (temporary employees during the decennial census) there aren't than many people at the census bureau with government-issued laptops. Everyone would have had to disappear one laptop and some folks would have had to disappear two.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
Census Employee here:
They use Entrust encryption with a Novell network login. I've gotten locked out several times, and I think they're pretty secure.
Also they use Windows 2000, not 95 or 98 as someone suggested.
This is probably not as big a deal as certain other laptop leaks. These laptops are probably the ones that "field enumerators" carry with them as they make house calls gathering data for whatever litle project the Census is doing at the moment. I speculate that the data each one carries is only the few households the enumerator visited before the last time they turned their data in.
I worked in the 2000 Census and for that operation the collected records (not on laptops at the time) were turned in daily, checked to make sure there were no obvious errors (like the front page saying there are 4 in the household but say, 2 or 7 individuals were detailed further in), and shipped to the data scanning centers that same day or the next.
I would expect that similar procedures are used now with the electronic data being "turned in" daily, or at worst weekly. If I am correct about that, it would mean that the number of individuals exposed to their details is quite a bit smaller than other recent problems, even if every laptop taken had as much info in it as it normally had at maximum.
Which is still not good. My point is only that I think it's less.