TSA Loses Hard Drive With Personnel Info

WrongSizeGlass writes "A portable hard drive containing personnel data for former and current employees, went missing from a controlled area at the TSA. From the article: 'The Transportation Security Administration has lost a computer hard drive containing Social Security numbers, bank data and payroll information for about 100,000 employees.'"

Comments

Captain Obvious says :

[witte]

Maybe using Social Security numbers for just about everything isn't such a good idea.

And in the UK today too

[AmIAnAi]

A BBC article disclosed that a laptop had been stolen that contained Marks & Spencer employee details

From the BBC article:

Salary details, addresses, dates of birth, national insurance and phone numbers were on the machine which was stolen from a printing firm.
It is now too easy for huge quantities of private data to be carried around on laptops and memory sticks, often by people who do not understand the consequnces of failing to protect that data. Companies need to be held to account when data is lost.

Portable HDD?

[bulliver]

There's your problem. I can see the allure of using a portable drive, in that you can easily move the data around from computer to computer, but really, we have a better way to move the data: The bloody network! That HDD should have been screwed into a locked case mounted in a rack bolted to the floor of a securely locked room.

some people never learn

[Isaac-Lew]

Why would this information even on a portable drive? And why would it not be encrypted?

This is why I try not to use my Social Security number for identification purposes anymore. I really should try to figure out who has it & what I can do to reduce the use of it.

Re:Encrypted ?

[Tuoqui]

Encryption is not undefeatable.

The entire idea behind encryption is to make it difficult/impossible to the casual hacker. If someone were dedicated to get into the information contained within however it would only be a matter of two variables... Time and Processing power.

Encryption is not a silver bullet to any and all security problems, it just mitigates some of the risk. If they cant crack the encryption within 20 years then most of the info would be useless by then. If they can do it in 3 months then its a problem...

Why was this on a portable HD in the first place?

[wwphx]

I've been in gov't IT for 15 years, this should never have left the server farm. If it had to be on a portable device, it should have been a laptop and heavily encrypted, not that I can see a good reason to give anyone that info. The retirement planning people can make do with very little info.