Executive Summary on Veteran’s Affairs (VA) and Loss of Private Information

On 3 May 2006, a Department of Veterans Affairs (VA) laptop was stolen from a VA data analyst’s home in Montgomery County, Maryland. In addition to the laptop, a personal external hard drive was stolen. The external hard drive contained the personal data (names, social security numbers, dates of birth, disability ratings) for 26.5 million veterans and their spouses. It should be noted that the massive data theft was only one of many that had been discovered over the course of 1.5 years. Upon discovery of the theft, the VA employee immediately notified the local police and his supervisors. His supervisors did not notify the Veterans Affairs Secretary until 16 May 2006. On 17 May 2006, the Veterans Affairs Secretary notified the FBI, who began to work with the Montgomery County police to investigate the theft.

There were two main issues in this incident that I identified. Issue 1 was the VA employees had authorization to access and use the VA databases for performance of his duties. He was not authorized to take it home as he had no official need to have the data at home. The private data was not properly safeguarded. He failed to password protect (at the very minimum) and encrypt it. Issue 2 was the response of managers and senior executives regarding the notification of stolen data were inappropriate and not timely. They failed to determine the magnitude of the data loss. There was a failure to notify appropriate law enforcement entities of the potential impact on VA programs and operations.

I would recommend that the company should implement a centralized Agency-Wide Information Technology (IT) security program. Implement a patch management program to ensure programs and applications are up-to-date with security patches. Implement effective monitoring of networks through the use of electronic scanning in order to proactively identify and correct security vulnerabilities. and deploy and install Intrusion Detection Systems (IDS) in case something happens.