Laptop stolen from VA recovered

|Originally posted at June 29 at 10:48 a.m. and updated June 30 at 10:03 a.m.|

(Updated) The Veterans Affairs Department said today that law enforcement officials had recovered the stolen laptop containing the personal data of more than 26 million veterans, and that initially it looks as though the data has not been accessed.

Prior to a hearing of the House Veterans Committee on the current status of the data theft, VA secretary James Nicholson said the deputy U.S. attorney general had told him that the stolen laptop and hard drive had been found, and officials were performing a forensic examination to determine whether the information had been used.

"This is a positive note in this tragic, epic event," Nicholson said. "They said there is reason to be optimistic that data has not been compromised."

The good news that the laptop and hard drive were recovered was tempered by Nicholson reporting two other instances of data theft, this time in the Midwest.

Nicholson reported VA sensitive data losses in Minneapolis and Indianapolis. A backup tape containing 16,538 legal case records went missing May 5 from the regional VA office in Indianapolis, but VA's department general counsel was not notified until May 23.

The tape contains a daily chronology of the week's cases that are managed on VA's case and attorney tracking system called GC Laws, said VA general counsel Tim McClain.

"The tape most likely contained privileged attorney-client information," he said. A security officer at the regional office reported that the backup tape was missing from the locked office.

In the Minneapolis data breach, a VA employee took a laptop computer home and locked it in the trunk of the car, which then was stolen in 2005. There have been two incidents of data loss from that incident, Nicholson said.

The data on the laptop affected 66 individuals who had sought services in a VA health facility. The financial auditor was performing income reviews of certain patients for means testing to determine payments. A postal inspector brought the identity fraud to the attention of VA, which is providing credit monitoring for the veterans. VA is notifying them and will provide credit monitoring for them.

In announcing the laptop recovery, the FBI said in a statement that a preliminary review of the equipment by the computer forensics team has determined that the database remains intact and has not been accessed since the laptop was stolen.

A more thorough forensics examination is under way, and the results will be shared as soon as possible, FBI officials said.

"We are trying to finish the forensics investigation as soon as possible," added FBI spokeswoman Michelle Crnkovich.

"The forensic analysis will be completed soon, in a matter of days not weeks," Nicholson said. No one was in custody as far as he knew.

"It's a question that depends on the degree of confidence in the forensic analysis," he said.

Crnkovich added that the U.S. Park Police received a tip about the stolen laptop based on flyers distributed by Montgomery County, Md., police. The person who had the laptop then turned it in to the FBI, she said.

Nicholson said he was uncertain about going forward with the request for $160.5 million in 2006 funds to pay for credit monitoring for those affected in the data theft.

Veterans Affairs Committee chairman Steve Buyer (R-Ind.), who was about to begin his fifth hearing on the data theft when Nicholson announced the laptop recovery, said it does not diminish the need for his committee's oversight over VA's IT management.

"This discovery provides reason to be optimistic; however, the basic deficiencies leading to this data loss must be corrected," Buyer said. The experience shows that data needs to be "treated like currency," he added. "The history of lenient policies and lack of accountability with VA management must be rectified."

Rep. Bob Filner (D-Calif.), a senior Democrat on the committee, said documents show that the VA employee who took home the sensitive data had permission from his supervisor to download the data and take it home over three years.

"He did what he was supposed to do?he informed the police 52 minutes after the fact. VA didn't inform the public for two weeks," Filner said. VA has said the employee was "grossly negligent" in handling sensitive information, but Filner said it was those above him who were grossly negligent.

Senate Homeland Security Committee chairman Susan Collins (R-Maine) said that it was clear from this incident and others subsequent to it that Congress needs to take a closer look at the Privacy Act and how the government handles the personal information of individuals

"The Privacy Act has become obsolete and does not reflect modern times where information is easily stored and transmitted electronically," she said in a statement.

Her committee will hold hearings to examine how the Privacy Act should be modernized to strengthen the data protection, she said.

VA reported in May that a thief had stolen a laptop and hard drive from a career department employee's home. The hardware included names, Social Security numbers and dates of birth of 26.5 million veterans who had served in the military and been discharged since 1975.

Since VA reported the theft, the FBI and the Montgomery County police have been trying to track down the laptop, hard drive and culprits.

Additionally, VA has been trying to upgrade its security practices and procedures. Nicholson has announced a number of changes it is implementing.

"[Finding the laptop] will not change the urgency of strengthening data security," Nicholson said today at the hearing.

VA's data breach began a string of breaches across agencies, including the Agriculture Department, the Navy, the IRS and, most recently, the National Institutes of Health's credit union.

GCN writers Jason Miller and Rob Thormeyer contributed to this report.