Slashdot Mirror
TSA Loses Hard Drive With Personnel Info
WrongSizeGlass writes "A portable hard drive containing personnel data for former and current employees, went missing from a controlled area at the TSA.
From the article: 'The Transportation Security Administration has lost a computer hard drive containing Social Security numbers, bank data and payroll information for about 100,000 employees.'"
There is no problems if the disc was encrypted ...
... have a digital identification, and most everyone does, you have to be alert to possible wrongful use of it by others.
Considering all the past digital leaks, I got wonder who hasn't had information on them digitally leaked?
Maybe using Social Security numbers for just about everything isn't such a good idea.
From the BBC article:
Salary details, addresses, dates of birth, national insurance and phone numbers were on the machine which was stolen from a printing firm.
It is now too easy for huge quantities of private data to be carried around on laptops and memory sticks, often by people who do not understand the consequnces of failing to protect that data. Companies need to be held to account when data is lost.
Any sufficiently advanced bug is indistinguishable from a feature.
Are you stoned? Theyve lost control of important data that was supposed to be secure. Thats a security breach.
Even if you have decent physical security, some items will attract thieves. Anything shiny and portable is likely to walk out the door. A portable disk drive is a good example of a thief magnet.
Mea navis aericumbens anguillis abundat
Using Social Security Numbers for everything isn't such a bad idea. It is a convenient way to identify someone, since it is guaranteed to be unique. The problem comes when the SSN is the only piece of information you need to take control over someone's life. There should be some more basic checks put in place to ensure the person is who they claim to be. An example could be mailing the person at their last known address and asking them to send a letter back with an authorised signature on a document that explains what is about to happen. When these basic checks are missing, it is no wonder it is so easy to steal another person's identity.
I'll probably be modded down for this...
Now they'll experience how it feels to be on the receiving end of violation of privacy!
There's your problem. I can see the allure of using a portable drive, in that you can easily move the data around from computer to computer, but really, we have a better way to move the data: The bloody network! That HDD should have been screwed into a locked case mounted in a rack bolted to the floor of a securely locked room.
Support the mob or mysteriously disappear.
Why does it take a data breach happening to some organization to get them to decide to protect information?
Maybe a law should be made that any organization that is trusted with public data be forced to imbed all of their CEO's, CFO's, other officers, management, and shareholder's data in the same databases.
I know that the reason all this data keeps getting exposed is because management would rather save money instead of training their IT staff (if they need it) or just giving them the time to implement good, safe, data handling practices. Put their data on the line too and let's see how they decide about safe data handling practices.
I'm still waiting for the day when full drive encryption becomes standard. You power the machine on, input a password (or insert a USB key and input a password) and the machine then continues normally. While this might not stop completely determined information thieves, it should put an end to drives full of personal info showing up on ebay. What would be even better is if it became required practice for anyone working with sensitive data like that.
NewslilySocial News. No lolcats allowed.
This is why I try not to use my Social Security number for identification purposes anymore. I really should try to figure out who has it & what I can do to reduce the use of it.
Wayne Madsen is maintaining a chart of data thefts of personal information. He lists 3 or 4 dozens thefts. He believes these thefts are an attempt to populate the Total Information Awareness databases.
Never ascribe to incompetence what can be explained by malice, I guess.
Computers are useless. They can only give you answers.
-- Pablo Picasso
I don't think you need unbreakable encryption for financial data, but for state secrets, a removable-drive one-time pad that is chained to the operator will do the trick.
For anything less than a state secret, you want something that only the most well-funded adversary can break in a reasonable length of time. You get to define "reasonable."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
SS#s are supposed to be unique. They aren't recycled.
Every now and then you find out about a SS# that is not unique. The SS office issues new number to one or both individuals and mea culpas all around. See this news story for one example.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I've been in gov't IT for 15 years, this should never have left the server farm. If it had to be on a portable device, it should have been a laptop and heavily encrypted, not that I can see a good reason to give anyone that info. The retirement planning people can make do with very little info.
When you sympathize with stupidity, you start thinking like an idiot.
or not wander around with an HD with sensitive data on it? That's just mental. That data should be housed only in a secure facility with only remote secure access to it.
It's plain stupidity and lazyness that compels people to defy the simplest rules of security.
Tom
Someday, I'll have a real sig.
I'm waiting for the news story that says the Department of Homeland Security just lost a hard drive with the personal information of every Federal agent in the government and all the White House security information on it.
These people are morons. Their sole purpose in life is to screw up while pushing other people around with self-righteous notions that THEY are the ones "protecting" everybody else.
It's the "cop mentality" writ large - which is the same basic mentality as a Mafia protection racket.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
Any system that could leave hundreds of thousands of private records anywhere but in a centralised and secured database seems pretty bad to me. Luckily anything else is against the law where I'm from.
Apparently the screeners were distracted when someone tried to enter the area with a photo of a shampoo bottle and so they didn't notice the theft. According to the DHS, the photo was probably inserted into the shampoo ad by an al-Queda operative.
I'm sure people at the Fed level have been reading /. for as long as it's been up. I've been on since we first got the web in the early 90's. I've only been at the state and city level, never the fed level.
/. (or at least he didn't at that time) and he went and yanked the outside connection to our firewall. It did hit us, but very lightly compared to the rest of the city and for some reason the payload did effectively no damage.
As a network and database admin, I've found it to be pretty darn important. I first read about I Love You at 7am at work when it sprang, told our security admin who doesn't read
Slashdot is important, regardless of for whom you work.
When you sympathize with stupidity, you start thinking like an idiot.