Noteboom The Law Firm

2 New VA Security Breaches Involving Veterans’ Personal Information

November 26, 2010 - It doesn't matter how many policies, rules, or protocols are put into place if they are not going to be followed. Ask the Department of Veterans Affairs (VA), they have a seemingly continuous line of people violating their security protocols and putting veterans and employees at risk of having their identity stolen and their private information made public.

No matter how many new rules the VA implements, these serious security breaches continue to occur. The most recent violations included an unsecured thumb drive and printed out sheets, both full of private, personal information concerning veterans.

The VA's Assistant Secretary for Information and Technology, Roger Baker, described these latest 2 incidents as being security breaches of the VA network. He said both violators received training on VA security protocols and blatantly disregarded them.

One VA employee used his personal, unencrypted thumb drive on his work computers. He then stored information on that drive that included, among other bits of personal information, the social security numbers of approximately 240 veterans. The employee then lost the thumb drive, but it was luckily found and returned by a security guard.

The other event involved a VA employee who decided to print out the social security numbers, along with other personal data, of 180 veterans, and then took all the documents home. He then proceeded to create a Word document at his home computer with all the personal information and email it back to his work email account. The VA's email system caught the document because it contained social security numbers and blocked it from delivery.  

The VA considers both events serious security breaches. The VA employs 300,000 people, which means they need to impress the seriousness of these protocols with a lot of people and mistakes will happen along the way. What is important is how the VA catches the people once they have committed the security breach, and how they can prevent the same breaches from happening again.