VA data loss, 2006

Case-file story

Timeline

1. 2006-05-03Employee's home burglarized; laptop and external drive stolen¹
2. 2006-05-05OPP&P Information Security Officer interviews the employee, two days after management was notified¹
3. 2006-05-16VA Secretary informed, almost 2 weeks later¹
4. 2006-05-22Congress and veterans notified¹
5. 2006-06-28Laptop and hard drive recovered intact¹
6. 2006-07-11OIG report issued¹

Verified facts

• The drive was reported to contain personal information on about 26 million veterans and U.S. military personnel.¹
• OIG finding: the "Employee Not Authorized to Take VA Data Home." Much of the data was for a self-initiated "fascination project" he worked on at home.¹
• The employee, a VA Information Technology Specialist, had authorized access to large VA databases for his duties. Supervisors were unaware of the project and said they would not have authorized taking that much data home.¹
• The data was stored without encryption or password protection. OIG called it "extremely poor judgment" and said the employee "took security of the data for granted."¹
• The stolen drive likely held a BIRLS extract (about 26 million living veterans: SSNs, names, birth dates, service numbers, disability ratings) and an August 2005 C&P extract (over 2.8 million veterans).¹
• The project, begun in 2003, aimed to compare about 7,000 respondents to the 2001 National Survey of Veterans against VA records.¹
• The FBI and OIG were "highly confident" that the files were not compromised after the burglary.¹
• OIG found that processing of the notification "Was Not Appropriate or Timely."¹

Editorial notes

• Don't name the employee. The site's naming policy covers uncharged individuals.

Sources

1. https://www.vaoig.gov/sites/default/files/reports/2006-07/VAOIG-06-02238-163.pdf · Wayback
2. https://vaoig.gov/reports/administrative-investigation/review-issues-related-loss-va-information-involving-identity · Wayback