Intern Loses 800,000 Social Security Numbers

destinyland writes "A 22-year-old intern said today he's the 'scapegoat' for the loss of over 800,000 social security numbers - or roughly 7.3% of the people in the entire state of Ohio. From the article: 'The extent of my instructions on what to do after I removed the tapes from the tape drive and took the tapes out of the building was, bring these back tomorrow.' Three months into his $10.50-an-hour internship, he left the tapes in his car overnight — unencrypted — and they were stolen. Interestingly, the intern reports to a $125-an-hour consultant — and was advised not to tell the police that sensitive information had been stolen, which initially resulted in his becoming the prime suspect for the theft. Ohio's Inspector General faults the lack of data encryption — and too many layers of consultants. But their investigation (pdf) revealed that Ohio's Office of Management and Budget had been using the exact same procedure for over eight years."

Comments

Scapegoat? Maybe, but he's still a moron.

[SatanicPuppy]

"So what did you learn interning this summer?"
"DIAF."

I'm forever amazed at how often people seem to be willing to snag a stack of backup media out of the back of someone's car. The criminal element seems to be quite tech savvy these days; I just wish some of that would pass to the rest of the population.

I live in the south, and "media left in a car" is not really a problem here; leaving tapes in the back seat of a car in the summertime is what we do when the incinerator is out of order...Works even at night!

Who the hell would send an intern out with backup tapes anyway? Makes no sense. Is that their offsite storage procedure? Send the tapes home with an intern, and hope he brings 'em back? Reading the PDF report, that turns out to be exactly what their procedure was...They even had it in their disaster plan, which makes me think it was more disaster and less plan. What the hell? Does the state of Ohio have so few buildings that they have to send the tapes home with people?

Fricking consultants. By the "You get what you pay for" scale you'd think $125-an-hour would buy you more than a huge pain in the ass like this. Sounds like the whole organization was rotten though, so it's hard to blame them.

Re:Scapegoat? Maybe, but he's still a moron.

[baudilus]

It doesn't necessarily mean that the criminal element is more tech savvy, but in today's world it's quite apparent that data tapes (usually marked with the size of the tapes, i.e. 50GB, 100GB, etc.) usually mean sensitive information - which is usually salable. Heck, even a crackhead would recognize that and try to sell them for a few bucks, not knowing what he really had. The real travesty here is the fact that the tapes were unencrypted. The intern himself could've taken the tapes home, read and copied all the data, returned the tapes, and no one would have known. If you don't want to pay for off-site storage, at least encrypt your data!

Re:Scapegoat? Maybe, but he's still a moron.

[loafula]

i'm willing to bet whoever stole the tapes from the car didn't know what the hell he or she was stealing. they went in for the radar detector, saw the tapes, and grabbed them cause they were there. their probably at the bottom of some restaurant's dumpster by now. or well burnt and buried in the woods. you can't blame the intern too much, though. any institution who's policy is to bring the tapes home probably doesn't stress data security all that much, and him being an intern means he probably doesn't have all that much experience to know just how important it is.

Re:Scapegoat? Maybe, but he's still a moron.

[Anonymous Coward]

but in today's world it's quite apparent that data tapes (usually marked with the size of the tapes, i.e. 50GB, 100GB, etc.) usually mean sensitive information - which is usually salable.P. I kind of question whether the typical car thief has any idea how to sell data from DLT tapes. Most likely, they would sell them to some company willing to buy used DLT's for $5 each instead of $25-$50, though the fact they were stolen from a government parking lot implies the criminal MAY have been looking for such a lapse.

Re:Scapegoat? Maybe, but he's still a moron.

[TapeCutter]

"Sounds like the whole organization was rotten though, so it's hard to blame them."

As someone who spent a decade or so as a "fricking consultant" I don't find it hard to blame him. If Mr. $125/hr was a half competent consultant he should at the very least have email evidence to show that he tried to change this retarded procedure but was vetoed by his superior. If he has such evidence then rinse & repeat up the PHB ladder.

Re:Scapegoat? Maybe, but he's still a moron.

[Oligonicella]

Very much in agreement with you.

As a 30+ year consultant, I've banged my head numerous times against stupid 'security'. Many times, I simply refused to follow their procedures. Let some company goon do the stupid thing. I'm paid to be an analyst and if I spot a problem and report it, I'm certainly not going to follow procedures I myself have labeled as bad.

The consultant is the primary blame and the intern a very far second. Just because a company has bad procedures doesn't mean you follow them.

Re:Scapegoat? Maybe, but he's still a moron.

[lawpoop]

in today's world it's quite apparent that data tapes (usually marked with the size of the tapes, i.e. 50GB, 100GB, etc.) usually mean sensitive information - which is usually salable. Heck, even a crackhead would recognize that and try to sell them for a few bucks, not knowing what he really had. I don't see how a crackhead could line this deal up. Their only market seems to be the pawnshop and the street corner.

I take it that you are a relatively savvy tech-head geek. Would you be able to line up a buyer for social security or other personal information?

Re:Scapegoat? Maybe, but he's still a moron.

[MrNaz]

My initial tinfoil hat response is this:
Someone on the outside was paying the $125 consultant for the data, so the consultant set up that little scenario so his buddies on the outside could get their hands on the data, making what was an espionage job look like a little bit of regular garden variety bureaucratic incompetence.

Re:Scapegoat? Maybe, but he's still a moron.

[TapeCutter]

"The problem is, whether you are a $125 per hour consultant or $25 per hour consultant, the company that hired you isn't going to listen to you."

I don't doubt that happens but in my own experience I have rarely found it to be the case. Sure they don't always agree with me, but they do listen.

"Consulting is no fun, except the paychecks tend to be pretty good."

If your not "having fun" then get the fuck out of the kitchen.

Re:Scapegoat? Maybe, but he's still a moron.

[Ravenscall]

Hi, Ohioan here. While We have a Democrat Governor now, and this happened on his watch, these are policies that were implemented during the Taft Administration, which is widely viewed as one of the most corrupt and incompetent administrations in Ohio history.

This has absolutely nothing to do with the Bush administration however, the blame lies squarely on the state and nobody else.

Re:Scapegoat? Maybe, but he's still a moron.

[dthable]

Crime is a strange thing.

Often a criminal will set his target - "I'm going to get that stereo" or "This idiot leaves computer like stuff in the car. Maybe I'll find a laptop". Once the window is broken, you grab anything that isn't bolted to the car frame and run like hell. It could have been some backup tapes this time or it could have been a case of blank CD-Rs. Don't matter once the window is broken.

After you get away, then you sort out the goods. Again, most guys don't know what they have but there are plenty of people on the streets, a whole network in fact, that can appraise the loot. One of those guys might have an IT background and know what those tapes are.

Being a criminal isn't all that hard. It just comes with a big risk and limited payoff.

Re:Scapegoat? Maybe, but he's still a moron.

[djasbestos]

You know, that actually does stand up to my "Law": Any conspiracy theory that does not allow for the government to be completely incompetent cannot be true.

Re:Scapegoat? Maybe, but he's still a moron.

[TapeCutter]

I've been in the trade for ~20yrs total and (for now) being on the payroll suits me. I find a similar attitude works just as well for full-timers as it does for consultants. A PHB once offered me a veiled threat in a meeting by saying "principles are expensive", I replied with a simle "That's why your paying me the big bucks!", he cracked up laughing and dropped the issue.

Re:Scapegoat? Maybe, but he's still a moron.

[Ngarrang]

Really....wouldn't an intern who is 22 years old and possibly an CS major know well enough to not leave data tapes in his car overnight? No. Because people in their natural state are stupid. These are the same people who open e-mails from people they don't know and open attachments because it is promised to be a 'kewl screensaver' or something else inane.

Re:Scapegoat? Maybe, but he's still a moron.

[denebian devil]

He's 22! If someone handed me a stack of backup tapes to take home when I was 16 I might have done it, but not at 22! Anything you take home from work is a risk, you should know that by that point. But if you were an intern and you were told to do something, would you just say no? Perhaps they would laud you for your insight an initiative, or perhaps they'd just fire you and get a more compliant intern. Not everyone wants to take that risk, especially someone who is in their first or one of their first jobs.

Re:Scapegoat? Maybe, but he's still a moron.

[Lumpy]

All it takes to be a consultant is to print it on your business-card and be able to bullshit your way into a paying gig.

Just because someone is a "consultant" does not mean they even know what they are doing.

Re:Scapegoat? Maybe, but he's still a moron.

[Mister Whirly]

In ALL cases, someone has something to gain. It's not ALWAYS a conspiracy. This was just an example of terrible policy, not a malicious plot. The "gain" in this case could have been achieved through much simpler means. Why go through an elaborate ruse involving multiple people that could blow the whole thing by talking about it? Especially when there is many other different ways the same thing could be accomplished. Let me ask you this - if you were a consultant making $125 an hour, would you risk your job, and freedom, for a few thousand dollars?? Your scenario just doesn't make much sense if you analyze it. If you reject Hanlon's Razor, how about Occam's Razor - "Entities should not be multiplied beyond necessity" or paraphrased - "All things being equal, the simplest solution tends to be the best one."

I think the bigger problem

[afidel]

Is that 7.3% of the population is working directly for the state government! I wonder what total percentage of the population works directly and indirectly (such as the contractor) for the government at all levels?

Re:I think the bigger problem

[CheeseTroll]

If you pay the gov't, isn't gov't working for you?

Re:I think the bigger problem

[CaffeineAddict2001]

It depends if you believe the government is working towards your interests or not. Since paying taxes is not optional, I'm sure most people would agree that they do not.

Re:I think the bigger problem

[mollymoo]

I find it amazing that the prevalent attitude in the USA seems to be, simultaneously, that theirs is the greatest democracy in the world and that their government(s) work(s) in opposition to the people.

7.3%- Sounds about right

[DrLudicrous]

7.3% sounds right. I know of several people affected by this- but rest assured, the great state of Ohio is promising one full year of ID theft protection. Bet that makes those folks sleep better at night. One friend that got a letter informing him of his SSN being stolen was told why- he was one of many Ohio taxpayers who has not yet cashed their state tax refund, and as a result, was kept in a database on the stolen tapes. As the Prentenders said, "Way to go Ohio!"

everyone BUT the intern should be fired

[uncleFester]

heh.. getting fired for doing what your boss told you to do.. it's the new trend in corporate america!

i get told now and then to do something not quite above board.. so i send the requester an email asking them to state in explicit detail what they want so i can be clear (and also have a record/trail). most times, the request is not repeated. doesn't make me terribly popular, but i sure as hell am not going to get tossed for another person's bad (or illegal?) request.

i kinda feel bad for the intern.. kinda like a falsely-accused criminal. this will probably follow him around a while and it was little or no fault of his own..

-r (has NO problem believing the intern's story 100%)

Makes sense not to report for a bit

[Dan East]

It makes sense not to report the loss for a while. 5 cars were broken into that night, and the thieves certainly grabbed anything that looked half valuable. They most likely had no idea that the tapes contained potentially valuable information, and almost without any doubt had no means to actually read the data.

If a news report came out the next day "20,000 SSNs stolen" then they would know what they had, and try to find a buyer. Otherwise the tapes would likely have been trashed so the criminals wouldn't have incriminating evidence sitting around their house.

Dan East

Re:Makes sense not to report for a bit

[hellfire]

That makes no sense. You report the loss to the police, and then you ask/suggest them to keep it under wraps because of the sensitive nature of the data in the hopes the criminals don't know what they have. You are also doing a disservice to the people's information that was stolen, because what if the criminals DID know what they had and DID have a way to read the data?

That's like not reporting your car stolen and just hoping it will turn up somewhere unscathed because it was a 1989 honda. Sure, it's not worth much to anyone but you, but not letting the police do their job is plain stupid.

Re:It Figures...

[AutopsyReport]

Yeah, it's easier for any entity to blame its peons for misjudgment rather than highlight the lack of process that would have prevented this type of situation in the first place. The higher-ups had the noose on this kid before anyone else bothered to realize the intern is not to blame. And now we've got an article on Slashdot about how the "intern" lost the SSN's. But did he really lose them?

To all the comments that are calling the intern an idiot for leaving the tapes in his car, I ask you this: where should he have stored them? In his apartment which can be just as easily broken into? Was he supposed to rent out a protected storage unit at his own expense? The correct answer is that he should have never been responsible for storing them. Now ask yourself what is worse: a superior handing over 800,000 SSN's to an intern, or an intern leaving those SSN's in his car?

Simple Solution To All This

[deadline]

There is a simple solution to this kind of thing. You take the SSN, bank account and CC numbers of the person in charge (the General, Congressman, CEO etc.) and you put them in every container, laptop, tape, HDD, USB stick, etc. that has private information on it.

Problem solved.

A few points on his statement

[galego]

From his statement: As an intern, I do not create policy, I do not interpret policy, and I do not question policy. I do what I am instructed to do.

1) He also obviously did not take time to investigate or read the policy. Granted .. this can be also blamed on supervisor's. But there is no 'patch' for ignorance, correct? Sometimes you only get one shot. 2) If he had any idea what was on the tape, he should not have left it in his car. I don't know if it was in the open or not, but 'intern' or not, he should be aware of the sensitivities of that sort of data. He commented on the policy (which he was not aware of until after the fact ... we've covered that) and said it was "unreasonable to assume that the person would not stop somewhere on their way home". (He is questioning the policy, but we'll cover that next.) Again ... if I knew what was on that tape (granted, I am not an innocent, young 'intern'), I wouldn't take it. If forced to, I wouldn't let it out of my sight til in my home. 3) He *should* question policy if he wants to be valued .. hopefully he learns from that. That's something I look for in a valuable employee. Questioning does not necessarily mean 'defy' (which I think is what he is trying to say). If not questioning the policy, he should be asking "This stuff is encrypted, right?" They are kind of going after the young intern as someone to pin this on, I'm sure. However, I don't think he can/should hide behind his 'intern' label and fire his pop-gun back saying none of it is his fault. He should admit his part in the mistakes and what he would not repeat ... then point to the broken policy / security model. Also hope they have fraud alerts set up on those 770,000 people and are ensuring they have state-provided equifax accounts! ;)

Also, scam sites are going to be all over this

[sgant]

I can see it now, spam email going out saying "due to the recent theft of Social Security numbers, please check here to see if your number was stolen. Just input your number here, and we'll tell you if yours was part of the theft...have a nice day..."

And this is why

[Anarke_Incarnate]

SSNs should NEVER be used as primary identification numbers. They are legally only allowed to be used for distribution of benefits and collection of "tax" towards paying out those benefits.

They are essentially a pyramid scheme to keep old people happy. You have to put them on everything, because they have become a national ID number. People are to complacent with that.

Re:Are you really trying to blame Bush?

[Billosaur]

Which leads to the obligatory:

You don't know the power of the Dark Side

Seriously, every President of the United States goes through this at one point or another. You're the most visible representation of authority in the United States, so when something bad happens, people blame you. Doesn't matter that you had no way of doing it, no control over the process that caused it, or didn't care about it. I don't think W is going to rank up there with the best President's when it's all said and done, and he's certainly not on my Christmas card list, but the rampant need to blame everything on him is ludicrous. Besides, we Americans only have ourselves to blame -- we elected him! Well... I didn't... I voted for Optimus Prime...

Re:Negligence

[Anonymous Coward]

The second fact would be his willingness to do something he felt was a risk, such as taking these tapes home.
The third being his lack of documented objection to the process and procedure which is obviously faulted.

It's good to see that "just following orders" isn't acceptable in this case, but the thing to remember is that the Germans who were just following their orders didn't absolve them of their crimes, neither did that fact absolve Hitler of his for giving the orders in the first place.

Re:Negligence

[TechnicolourSquirrel]

This guy is an intern. Know what that is? Hint: for an intern, there is no 'not accepting the assignment'. Might as well say nothing and just stay home, instead, because that's about to be your 'new assignment', anyway...

Intern: "I know that I have no experience and no battle-tested skills, but I'm afraid I must disagree with the way you're running this company. My recommendation is to--"
Boss: "Excuse me, but do you work here?"
Intern: "Uh, yeah. Summer program."
Boss: "Well, this year, Fall's comin' early!"

It is to laugh. But seriously, in the service of battling this apparently massive epidemic of worldwide intern negligence, I have done a bit of research into all of the "documented objections to process and procedure" which have ever been initiated by interns, throughout all of time and space. Here's the complete list...






Didja miss it? Sad state of affairs, wouldn't you say? Which begs the question: WHY are America's interns so incompetent? We need to train our interns! In fact, somebody should start some sort of training program with this very thing as its goal. Why even stop there? Why not a training program at every company? America needs to get its act together, because education is everything.

Why is this marked as 'Troll'

[shis-ka-bob]

I think the parent comment makes sense and calling this a 'troll' us unfair. The consultant was not trying to stop the thieves from knowing what they had, he was covering his ass and hoping that this could just go away. If the correct tactic is to keep the information out of the press, then the police are the ones that should make the call.
Yesterday, I was the first on the scene to an accident. A kid (temporarily, I believe) lost vision in one eye when the air bag smacked him in the face. I think it was my duty to report everything that I did (check for injuries, make sure he was coherent, move some debris out of the road) to the police officers & ambulance crew. The police can decide was matters, they do this every day. I am a novice & my opinions as to what matters is inferior to their experience.