Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security United States Privacy

Intern Loses 800,000 Social Security Numbers 492

Posted by Zonk from the bad-day-bad-day dept.
destinyland writes "A 22-year-old intern said today he's the 'scapegoat' for the loss of over 800,000 social security numbers - or roughly 7.3% of the people in the entire state of Ohio. From the article: 'The extent of my instructions on what to do after I removed the tapes from the tape drive and took the tapes out of the building was, bring these back tomorrow.' Three months into his $10.50-an-hour internship, he left the tapes in his car overnight — unencrypted — and they were stolen. Interestingly, the intern reports to a $125-an-hour consultant — and was advised not to tell the police that sensitive information had been stolen, which initially resulted in his becoming the prime suspect for the theft. Ohio's Inspector General faults the lack of data encryption — and too many layers of consultants. But their investigation (pdf) revealed that Ohio's Office of Management and Budget had been using the exact same procedure for over eight years."
This discussion has been archived. No new comments can be posted.

Intern Loses 800,000 Social Security Numbers More

Intern Loses 800,000 Social Security Numbers

Comments Filter:
  • "So what did you learn interning this summer?"
    "DIAF."

    I'm forever amazed at how often people seem to be willing to snag a stack of backup media out of the back of someone's car. The criminal element seems to be quite tech savvy these days; I just wish some of that would pass to the rest of the population.

    I live in the south, and "media left in a car" is not really a problem here; leaving tapes in the back seat of a car in the summertime is what we do when the incinerator is out of order...Works even at night!

    Who the hell would send an intern out with backup tapes anyway? Makes no sense. Is that their offsite storage procedure? Send the tapes home with an intern, and hope he brings 'em back? Reading the PDF report, that turns out to be exactly what their procedure was...They even had it in their disaster plan, which makes me think it was more disaster and less plan. What the hell? Does the state of Ohio have so few buildings that they have to send the tapes home with people?

    Fricking consultants. By the "You get what you pay for" scale you'd think $125-an-hour would buy you more than a huge pain in the ass like this. Sounds like the whole organization was rotten though, so it's hard to blame them.

    • Re:Scapegoat? Maybe, but he's still a moron. (Score:5, Insightful)

      by baudilus ( 665036 ) on Friday July 27, 2007 @09:55AM (#20009929)
      It doesn't necessarily mean that the criminal element is more tech savvy, but in today's world it's quite apparent that data tapes (usually marked with the size of the tapes, i.e. 50GB, 100GB, etc.) usually mean sensitive information - which is usually salable. Heck, even a crackhead would recognize that and try to sell them for a few bucks, not knowing what he really had. The real travesty here is the fact that the tapes were unencrypted. The intern himself could've taken the tapes home, read and copied all the data, returned the tapes, and no one would have known. If you don't want to pay for off-site storage, at least encrypt your data!

      • Re: (Score:3, Insightful)

        by lawpoop ( 604919 )

        in today's world it's quite apparent that data tapes (usually marked with the size of the tapes, i.e. 50GB, 100GB, etc.) usually mean sensitive information - which is usually salable. Heck, even a crackhead would recognize that and try to sell them for a few bucks, not knowing what he really had.

        I don't see how a crackhead could line this deal up. Their only market seems to be the pawnshop and the street corner.

        I take it that you are a relatively savvy tech-head geek. Would you be able to line up a buyer for social security or other personal information?

        • Well, I could (Score:5, Funny)

          by benhocking ( 724439 ) <[moc.oohay] [ta] [gnikcohnimajneb]> on Friday July 27, 2007 @11:31AM (#20011423) Homepage Journal
          Just let me pull out my dictionary and look up "money laundering".

      • Re: (Score:3, Interesting)

        by Nikker ( 749551 )
        These tapes were not stolen by a 'common' theif like a crackhead. What makes what you have appealing to someone looking for money? The fact that you have something they know they can sell quickly, which is usually something like electronics, laptops or tape decks. The whole reason for that is they want to be able to sell it to the very next person they see, they don't want to explain what it is cause they don't know. Who would really want to buy data tapes out the back of a van or on the street anyway?

    • Re: (Score:2, Insightful)

      by loafula ( 1080631 )
      i'm willing to bet whoever stole the tapes from the car didn't know what the hell he or she was stealing. they went in for the radar detector, saw the tapes, and grabbed them cause they were there. their probably at the bottom of some restaurant's dumpster by now. or well burnt and buried in the woods. you can't blame the intern too much, though. any institution who's policy is to bring the tapes home probably doesn't stress data security all that much, and him being an intern means he probably doesn't have

      • Re: (Score:3, Interesting)

        by SatanicPuppy ( 611928 ) *
        He's 22! If someone handed me a stack of backup tapes to take home when I was 16 I might have done it, but not at 22! Anything you take home from work is a risk, you should know that by that point.

        That being said, yea, the organization is primarily at fault. This is their offsite storage method, according to their disaster of a recovery plan. That it hasn't bitten them in the ass before this is nothing more than luck.

        • Re:Scapegoat? Maybe, but he's still a moron. (Score:5, Insightful)

          by denebian devil ( 944045 ) on Friday July 27, 2007 @11:00AM (#20010925)

          He's 22! If someone handed me a stack of backup tapes to take home when I was 16 I might have done it, but not at 22! Anything you take home from work is a risk, you should know that by that point.
          But if you were an intern and you were told to do something, would you just say no? Perhaps they would laud you for your insight an initiative, or perhaps they'd just fire you and get a more compliant intern. Not everyone wants to take that risk, especially someone who is in their first or one of their first jobs.

          • Re:Scapegoat? Maybe, but he's still a moron. (Score:4, Interesting)

            by Dephex Twin ( 416238 ) on Friday July 27, 2007 @11:40AM (#20011575) Homepage
            I took on an internship at about that age at one of the world's largest packaged foods companies, where I thought I would be maintaining some data on spreadsheets. That turned out to be true, but more specifically, it was vital contact info, security measures, and dozens of other related bits of info in order to comply with a post-9/11 bioterrorism regulations. I was to call these hundreds of different processing plants and make sure the info was less than three months old. I would be the one and only person in charge of this information for the entire company.

            When I inherited the info, I saw that it was already quite behind and out-of-date (and I also noticed that there was an error in the 30+ part questionnaire being used where the numbers were off, so all the data on the spreadsheet was potentially wrong). I envisioned headlines such as this, only with some sort of food contamination disaster or plant explosion, and my photo with the caption "Didn't maintain bioterrorism database".

            I got the hell out of there immediately. In my opinion, the fact that this was such a small-time job with low pay, and the fact that I was only 22 with no family, made it infinitely easier for me to say "no way, sorry, this is ridiculous" and just be done with it. If the guy had a family of five and had worked at the company for years and suddenly had to risk it all by taking these tapes, then I could understand why he would be conflicted. This guy here had everything to lose and very little to gain by taking those tapes.
      • Crap. Replied to the wrong post. Sorry about that. Puppy needs more coffee.

    • Re:Scapegoat? Maybe, but he's still a moron. (Score:5, Insightful)

      by TapeCutter ( 624760 ) on Friday July 27, 2007 @10:10AM (#20010153) Journal
      "Sounds like the whole organization was rotten though, so it's hard to blame them."

      As someone who spent a decade or so as a "fricking consultant" I don't find it hard to blame him. If Mr. $125/hr was a half competent consultant he should at the very least have email evidence to show that he tried to change this retarded procedure but was vetoed by his superior. If he has such evidence then rinse & repeat up the PHB ladder.

      • Re:Scapegoat? Maybe, but he's still a moron. (Score:5, Insightful)

        by Oligonicella ( 659917 ) on Friday July 27, 2007 @10:15AM (#20010245)
        Very much in agreement with you.

        As a 30+ year consultant, I've banged my head numerous times against stupid 'security'. Many times, I simply refused to follow their procedures. Let some company goon do the stupid thing. I'm paid to be an analyst and if I spot a problem and report it, I'm certainly not going to follow procedures I myself have labeled as bad.

        The consultant is the primary blame and the intern a very far second. Just because a company has bad procedures doesn't mean you follow them.

    • Re:Scapegoat? Maybe, but he's still a moron. (Score:5, Interesting)

      by Alizarin Erythrosin ( 457981 ) on Friday July 27, 2007 @10:11AM (#20010195)

      Who the hell would send an intern out with backup tapes anyway? Makes no sense. Is that their offsite storage procedure? Send the tapes home with an intern, and hope he brings 'em back? Reading the PDF report, that turns out to be exactly what their procedure was...They even had it in their disaster plan, which makes me think it was more disaster and less plan. What the hell? Does the state of Ohio have so few buildings that they have to send the tapes home with people?

      Part of me always thinks some of these stories are really fishy...

      I mean, he tells the intern to take the tapes home, but bring them back tomorrow. Which is pretty stupid in its own right, but let's throw a little conspiracy angle in. The consultant sells the data on the tapes, but he just can't hand it over, so he tells an intern to take these tapes home and bring them back tomorrow. Tapes get stolen, consultant's deal goes off, the buyer gets his data, and it becomes an everyday incident of "My car got broken into and everything was taken!"

      People take laptops home for one night and it gets stolen, and it just so happens to have a million people's information on it. Over and over. I realize that things need to be encrypted, but still... the conspiracy angle dictates that not encrypting the data in these cases is the goal.
      • Yea, that's kinda what I was thinking wrt the "Tech savviness of the modern criminal."

        You have to accept that the same kind of criminal who is going to bust your window to steal crap out of your car is going to snag a few tapes, contents unknown, on the principle that he can sell it to someone? Even if the stuff turns out to be valuable, he won't make any real money off of it because (assuming he actually knows of someone who would buy SSNs) the buyer would be free to misrepresent the value.

        I'd say this is a targeted theft by someone who knew damn well that those tapes would be going home with someone...Easy information to have because you know that, as many consultants as they've cycled through that place, tons of people knew their policy.

      • Re: (Score:2)

        by Kelbear ( 870538 )
        Yeah, that was what popped into my mind as well. Conspiracies are unlikely because they tend to be overly complicated and reliant on every participant in a massive web to remain silent. However in thise case, it can be as simple as 3 people.

      • Re: (Score:3, Funny)

        by lawpoop ( 604919 )

        ... let's throw a little conspiracy angle in.

        OK! Wayne Madsen [waynemadsenreport.com] has a conspiracy theory that all of the data thefts are a black op to populate the Total Information Awareness [wikipedia.org] database, which is itself now a black op.

        He maintains a chart of data thefts that shows millions of records from both public and private sources, but the chart is now on the subscription portion of the site.

      • Re: (Score:3, Interesting)

        by denebian devil ( 944045 )

        Part of me always thinks some of these stories are really fishy...

        I currently work for a small business where this "take the backup tapes home with you for the night" is exactly their "disaster plan." I'm not saying it's a good plan. But it may be more common than you think.

        People take laptops home for one night and it gets stolen, and it just so happens to have a million people's information on it.

        The article did say he'd been doing the same thing for 3 months before the theft occurred. It's not like that was the one and only night he took the tapes home in that manner.

    • I can see it now, spam email going out saying "due to the recent theft of Social Security numbers, please check here to see if your number was stolen. Just input your number here, and we'll tell you if yours was part of the theft...have a nice day..."
    • IMO there's nothing wrong with sending tapes home with people. You could set up a round robin, with tapes from building A being stored in building B, but that's not inherently more secure than someone having the tapes at home. You're going to have to set up some sort of secure storage anyway.
      Leaving the tapes in a car overnight is stupid, though.

      The biggest problem with moving tapes around is that you have to make sure they're not moved in a car with a great big stereo. Subwoofers can play havoc on magnetic

      • Re: (Score:3, Informative)

        by dougmc ( 70836 )

        IMO there's nothing wrong with sending tapes home with people.

        Agreed -- it's the poor man version of offsite backups, though if they have sensitive information they should be encrypted at the very least. Still, while it probably makes sense for a five man office, it's probably not the best way of doing things for a big operation.

        The biggest problem with moving tapes around is that you have to make sure they're not moved in a car with a great big stereo. Subwoofers can play havoc on magnetic media.

        Actually, the strongest magnet you have in your house probably isn't strong enough to do anything to modern data tapes. It takes a strong honking magnet to affect modern data tape media in the slightest. You could wrap your DLT/LTO/whatev

      • Re: (Score:3, Informative)

        by Nevyn ( 5505 ) *

        IMO there's nothing wrong with sending tapes home with people.

        Sure, I've worked at places that do that ... but sending them home with the intern? Whenever I've seen it done it's been with trusted full time employees, with a paper trail of exact what went to their home.

      • Re: (Score:3, Informative)

        by mlts ( 1038732 )
        If there is a solid encryption system [1] in place, there isn't anything wrong with this at all, (although a service like Iron Mountain would be the best.)

        Encrypted backups are not hard to do, although its not in that many backup programs on the Windows side (unless you go to Networker or Tivoli Storage Manager) support solid encryption. The main one that does support encryption is EMC/Insignia's Retrospect on the Windows side, and Arkeia on the UNIX side.

        [1]: A solid encryption system is not just clickin

    • Re: (Score:3, Insightful)

      by Lumpy ( 12016 )
      All it takes to be a consultant is to print it on your business-card and be able to bullshit your way into a paying gig.

      Just because someone is a "consultant" does not mean they even know what they are doing.

  • Comment removed (Score:4, Interesting)

    by account_deleted ( 4530225 ) on Friday July 27, 2007 @09:46AM (#20009801)
    Comment removed based on user account deletion
    • to prevent loss in the case of a fire, I cant see one legitimate reason for the tapes even leaving the site.

      Which is precisely why offsite copies are made. All legitimate backup schemes involve the offsite storage of tapes. Most companies contract with a company that specializes in this sort of thing, like Iron Mountain. All data centers are at risk of physical catastrophe in addition to fires. Earthquakes, tornados, floods, hurricanes, etc depending on locale. Shipping the tapes offsite is not the probl
    • Our tape rotation is as follows: All tapes in a tape safe, all Monday tapes go off site for 2 months, all quarterly tapes are stored for 2 years off site, and all yearly tapes are stored offsite for 5 years. The tapes are transported by an employee whose job is to move various papers, tapes, etc, back and forth on a daily basis.

      It's easy, sensible, reasonably secure. The offsite location is a satellite office, they have a locking tape safe in which they store the tapes. If the tapes were stolen, most of the

  • I think the bigger problem (Score:4, Insightful)

    by afidel ( 530433 ) on Friday July 27, 2007 @09:47AM (#20009805)
    Is that 7.3% of the population is working directly for the state government! I wonder what total percentage of the population works directly and indirectly (such as the contractor) for the government at all levels?

  • prime suspect (Score:5, Funny)

    by j00r0m4nc3r ( 959816 ) on Friday July 27, 2007 @09:47AM (#20009815)
    "Three months into his $10.50-an-hour internship, he left the tapes in his car overnight -- unencrypted -- and they were stolen, and his 1990 Yugo mysteriously replaced with a new Ferrari."

    • The parent said:

      "Three months into his $10.50-an-hour internship, he left the tapes in his car overnight -- unencrypted -- and they were stolen, and his 1990 Yugo mysteriously replaced with a new Ferrari."

      Who the hell would buy a Ferrari with gas prices the way they are?

  • Uh-oh. (Score:5, Funny)

    by RobTFirefly ( 844560 ) on Friday July 27, 2007 @09:48AM (#20009817) Homepage Journal
    After all these years, they've finally found a security hole in the Sneakernet. [wikipedia.org]
  • "Maybe my social security number is on these tapes?"
    Would they have handled it any differently if it was?
  • What kind of job asks you to take backup tapes w/ sensitive information home with you? Don't they have a cabinet or a drawer inside the building (which is itself presumably safer)?

    Cheers!

    • Re: (Score:2, Informative)

      by coren2000 ( 788204 )
      I assume they remove backups from the site nightly, in case of fire.
      • Why not just have two data centres and pipe the new records via a SSL or VPN tunnel?

        Wouldn't that make a lot more sense and be a hell of a lot safer?

    • Re: (Score:3, Informative)

      by LurkerXXX ( 667952 )
      It's called offsite storage. If you aren't doing it, look into it or you will regret not doing so if your building ever burns down, floods, etc.

      They just did it in a horribly horribly bad way. There are lots of other state buildings around they could transfer things to regularly. Having anyone, let alone an intern, take them to their home instead is simply stupid. As is leaving company property unattended in your car. Having them do that with unencrypted data was just batshit insane.

  • Small mistake in title... (Score:5, Funny)

    by cbrichar ( 819941 ) on Friday July 27, 2007 @09:49AM (#20009835)
    Intern Loses 800,000 Social Security Numbers, 1 Internship

    Fixed it for you.

  • 7.3%- Sounds about right (Score:3, Insightful)

    by DrLudicrous ( 607375 ) on Friday July 27, 2007 @09:50AM (#20009845) Homepage
    7.3% sounds right. I know of several people affected by this- but rest assured, the great state of Ohio is promising one full year of ID theft protection. Bet that makes those folks sleep better at night. One friend that got a letter informing him of his SSN being stolen was told why- he was one of many Ohio taxpayers who has not yet cashed their state tax refund, and as a result, was kept in a database on the stolen tapes. As the Prentenders said, "Way to go Ohio!"

  • everyone BUT the intern should be fired (Score:5, Insightful)

    by uncleFester ( 29998 ) on Friday July 27, 2007 @09:50AM (#20009849) Homepage Journal
    heh.. getting fired for doing what your boss told you to do.. it's the new trend in corporate america!

    i get told now and then to do something not quite above board.. so i send the requester an email asking them to state in explicit detail what they want so i can be clear (and also have a record/trail). most times, the request is not repeated. doesn't make me terribly popular, but i sure as hell am not going to get tossed for another person's bad (or illegal?) request.

    i kinda feel bad for the intern.. kinda like a falsely-accused criminal. this will probably follow him around a while and it was little or no fault of his own..

    -r (has NO problem believing the intern's story 100%)
    • Yeah for an intern working for the government (effectively) CYA should have been job one (why do you think bureaucracies are so inefficient). That intern must have skipped the day the lesson was taught.

      • Re: (Score:3, Funny)

        by Minwee ( 522556 )
        No, I think that he very definitely was there the day that lesson was taught. It was the morning after he took a set of backup tapes home.
    • He was told to take the tapes HOME, not take the tapes and leave them in his car overnight. He certainly deserves to be fired, as does everyone else.
      • Actually who knows what he was told. He was told to take them home, but someone could have just as easily told him afterwards that he can just leave them in the car because he just needs to get them off-site. I've seen plenty of engineers leave computers, servers, laptops, etc in cars because you always figure it's not going to happen to you, and most of the time they're right. It's that one time you're wrong and lose 800,000 SSNs that comes back to bite you in the ass.

        I want to know why someone felt t

      • Re: (Score:2)

        by gigne ( 990887 )
        So how would this have played out if the intern had done as he was told, his house had been broken into, and the tapes stolen? My guess is his neck would still be in that noose. He looked to be in a lose/lose situation.
  • I found them!
  • My girlfriend was one of the number's stolen, the state has graciously offered to buy her a year of ID protection. Cause yeah, after a year, this problem goes away. She is going to have to pay for the service for years after this, just for peace of mind. Thanks you so much, we didn't need this stress. You know how much beer I can buy with a year's worth of ID theft prevention? Enough to get me drunk _several_ times buddy, yeah, you are killing my buzz already!

    You know what they say, "if an intern triples yo

  • Makes sense not to report for a bit (Score:5, Insightful)

    by Dan East ( 318230 ) on Friday July 27, 2007 @09:54AM (#20009905) Journal
    It makes sense not to report the loss for a while. 5 cars were broken into that night, and the thieves certainly grabbed anything that looked half valuable. They most likely had no idea that the tapes contained potentially valuable information, and almost without any doubt had no means to actually read the data.

    If a news report came out the next day "20,000 SSNs stolen" then they would know what they had, and try to find a buyer. Otherwise the tapes would likely have been trashed so the criminals wouldn't have incriminating evidence sitting around their house.

    Dan East

    • Re: (Score:3, Insightful)

      by hellfire ( 86129 )
      That makes no sense. You report the loss to the police, and then you ask/suggest them to keep it under wraps because of the sensitive nature of the data in the hopes the criminals don't know what they have. You are also doing a disservice to the people's information that was stolen, because what if the criminals DID know what they had and DID have a way to read the data?

      That's like not reporting your car stolen and just hoping it will turn up somewhere unscathed because it was a 1989 honda. Sure, it's no
      • I think the parent comment makes sense and calling this a 'troll' us unfair. The consultant was not trying to stop the thieves from knowing what they had, he was covering his ass and hoping that this could just go away. If the correct tactic is to keep the information out of the press, then the police are the ones that should make the call.
        Yesterday, I was the first on the scene to an accident. A kid (temporarily, I believe) lost vision in one eye when the air bag smacked him in the face. I think it w

  • It gets better...er, funnier at least (Score:5, Informative)

    by gskouby ( 61416 ) on Friday July 27, 2007 @09:56AM (#20009949)
    The State of Ohio is offering one year of identity theft protection to those affected. To lookup your access code for this one free year of ID theft prevention please visit this page:

    http://ohio.gov/idprotect/lookup/lookup.aspx/ [ohio.gov]

    On this page you enter your last name and the last four of your SSN. Anybody see anything fishy about this page? HOW ABOUT THAT IT ISN'T USING SSL. Apparently they don't believe in using encryption anywhere, ever. Not on backup tapes and definately not when transmitting sensitive information over the Internet.

    • Re:It gets better...er, funnier at least (Score:5, Interesting)

      by TheLink ( 130905 ) on Friday July 27, 2007 @10:24AM (#20010369) Journal
      Heh, I tried smith, 1234 and got:
      Your assigned activation PIN (personal identity number) is 7655616

      smith, 1235 = nada
      smith, 1236 = 8966764

      Then, I tried:
      %, 1236 = 3738028

      smit%, 1234 = 7655616
      smit, 1234 = 7655616
      smoth, 1234 = nada
      sm_th, 1234 = 7655616 :)

      Lastly, if your organization's procedure is to pass 22 year old interns the company's "family jewels" to keep overnight and one day they get stolen, it's not the intern's fault at all.

      The management is to be blamed for this. That's pretty much a stupid procedure.

      The intern isn't being paid enough for such a responsibility, nor should the intern be given such a responsibility in the first place.
  • I'm sure if Big Evil Government was in charge of these tapes, it would have hired a $250/hr consultant to give them to a $21/hr intern to lose. Think of the savings!
  • In all of these articles that pop up the same thing pops in mind. Why are people allowed to take anything of value home with them? Information like this needs to have some kind of cvs/subversion system with it. If you need to check it out, there is a trail showing who has what, and people shouldn't be allowed to take things home, and all sensitive information needs to be encrypted whether internally or not.

  • Simple Solution To All This (Score:4, Insightful)

    by deadline ( 14171 ) on Friday July 27, 2007 @10:04AM (#20010065) Homepage

    There is a simple solution to this kind of thing. You take the SSN, bank account and CC numbers of the person in charge (the General, Congressman, CEO etc.) and you put them in every container, laptop, tape, HDD, USB stick, etc. that has private information on it.

    Problem solved.

  • Negligence (Score:2, Interesting)

    by HamsterRabies ( 1124759 )
    The 22 yr olds' response is unacceptable given the amount of press and exposure identity theft is given.

    The value of labor per hour is not relevant and should be considered distraction of truth in this situation. The reality is that an adult of mature age was directed to secure the property and was asked to take it home and keep it safe.

    Whether this was wrong or not is non point the moment he accepted the assignment.
    The fact that he left it in his vehicle is a first point of negligence.
    The second fact woul
  • This is old news for Ohioans. I submitted this story to /. 2 weeks ago...
  • For a good portion of my database backups that may or may not contain confidential information, I tar, compress and encrypt with gpg my backup data files before they get put into a directory archived by by our automated tape library. I don't have to trust who has the tapes, and who is going to carry them off-site during our next hurricane threat. I clocked gpg on a fairly modest Dell 2950 server at about 10 megabytes / second. If you need more, there are hardware-based accelerator cards available.
    • Dear Congress,

      Please enact a law requiring that each and every use of our SSN be verified by the assignee (by phone, in-person, etc) of the SSN. Force the credit-granting agencies to verify before granting credit in such a way that the verification could only be used one time, for a limited time frame, for a set amount of credit to extend. Write the law in such a way that the credit issuer and credit agency are responsible for any un-verified credit and not the holder of the SSN.

      This will undoubtedly

  • A few points on his statement (Score:3, Insightful)

    by galego ( 110613 ) <jsnsotheracct@@@gmail...com> on Friday July 27, 2007 @10:09AM (#20010149)
    From his statement: As an intern, I do not create policy, I do not interpret policy, and I do not question policy. I do what I am instructed to do.

    1) He also obviously did not take time to investigate or read the policy. Granted .. this can be also blamed on supervisor's. But there is no 'patch' for ignorance, correct? Sometimes you only get one shot. 2) If he had any idea what was on the tape, he should not have left it in his car. I don't know if it was in the open or not, but 'intern' or not, he should be aware of the sensitivities of that sort of data. He commented on the policy (which he was not aware of until after the fact ... we've covered that) and said it was "unreasonable to assume that the person would not stop somewhere on their way home". (He is questioning the policy, but we'll cover that next.) Again ... if I knew what was on that tape (granted, I am not an innocent, young 'intern'), I wouldn't take it. If forced to, I wouldn't let it out of my sight til in my home. 3) He *should* question policy if he wants to be valued .. hopefully he learns from that. That's something I look for in a valuable employee. Questioning does not necessarily mean 'defy' (which I think is what he is trying to say). If not questioning the policy, he should be asking "This stuff is encrypted, right?" They are kind of going after the young intern as someone to pin this on, I'm sure. However, I don't think he can/should hide behind his 'intern' label and fire his pop-gun back saying none of it is his fault. He should admit his part in the mistakes and what he would not repeat ... then point to the broken policy / security model. Also hope they have fraud alerts set up on those 770,000 people and are ensuring they have state-provided equifax accounts! ;)

  • What is this ID protection that keeps coming up in here? I haven't heard anything about it.

  • Gmail (Score:2, Funny)

    by Alzheimers ( 467217 )
    800,000 SSN numbers
    9 digits in an SSN number
    1 comma delimiter per number
    -----------
    8,000,000 digits

    This is still under Gmail's 10mb per email rule. He could have just emailed himself the list as backup.

    (yes, I know there's more data than the number. That's why you get 2.8gb+ of space!)
  • are any and all organizations that collect a fixed 9-digit number (that is assigned at birth and revealed to hundreds of parties over a lifetime), and then use it in such a way that just knowing that number would ever be a security risk. The fact that this absurd practice is almost universal is just sheer stupidity on a national scale.

    Maybe there should be a law that automobile license plate numbers should be the same as the owner's SSN. That would put a damper on the temptation to use SSNs as some kind o

  • Comment removed based on user account deletion

  • And this is why (Score:4, Insightful)

    by Anarke_Incarnate ( 733529 ) on Friday July 27, 2007 @10:20AM (#20010311)
    SSNs should NEVER be used as primary identification numbers. They are legally only allowed to be used for distribution of benefits and collection of "tax" towards paying out those benefits.

    They are essentially a pyramid scheme to keep old people happy. You have to put them on everything, because they have become a national ID number. People are to complacent with that.
    • And most banks & telephone companies insist on having a copy of it. All the automated systems are built around it ("please enter the last 4 digits of your SSN, followed by the # sigh").... If you refuse to give it, you're stuck in operator queue hell.

  • $125 an hour? (Score:4, Funny)

    by n1ckml007 ( 683046 ) on Friday July 27, 2007 @10:23AM (#20010355)
    I'm obviously in the wrong career path; I could be losing SSN's for $125 an hour! Maybe next year I can move on to some $200 an hour medical record losing gig.
  • The state can like pay the consultants a FULL time wage with benefits are it is like that consultants making $125/H and $200/H don't get them.
  • Think about it for a minute...Un-encrypted tapes are given to an in-experienced intern with instructions to take them out of the building. Soon after that, they are stolen.

    There's careless, there's stupid....and then there's pre-meditated.

    I suspect he might be right about the "scapegoat" claim. There is just too many mistakes here by too many people who should have known better for me to accept as a pure "accident"
  • Quality backup tapes can have a fair amount of value - $80 or more per tape is fairly common so if the pawn shop recignizes a tape for what it is the theif could probably make a few bucks.

    I wonder if there are people at computer swap meets/hamfests with boxes of tapes that they sell for a few bucks apiece with interesting stuff on them.

    There have been multiple incidents of people buying "junk" HD's secondhand, taking them home and finding interesting stuff on them.

  • They're all stupid (Score:4, Interesting)

    by Avatar8 ( 748465 ) on Friday July 27, 2007 @10:56AM (#20010871)
    Not just the intern to blame here. There is obvious failure, lack of responsibility and plain stupidity amongst all those involved.


    Consultants reporting to consultants? Great plan if you don't care to remain in control of your company/organization.
    Making a single, bottom level, low income person responsible for your most valuable asset, data? Obviously no concept of sensitive information.
    No encryption? Dumb, dumber and dumbest omission of data management.

    My recommendations:
    1) Keep the intern. He now is knowledgeable and will make better decisions on similar matters; however, let him do the job appropriate to his level. Being fully responsible for off site data should not be part of his job.
    2) Update the policy in accordance with federal, SOX, ISO 17799 and whatever other standards apply to include data encryption and a *real* off site method.
    3) Get rid of one of the consultants. All consultants should be reporting directly to an employee who has interest in the company/organization.
    4) Use the money saved by removing the excess consultant to pay a professional company to pickup and store the tapes off site, in a secure, disaster recovery designed site. Iron Mountain does a pretty good job. (or use their online data transfer method) If nothing else, purchase a small, fireproof box with a lock and make the manager carry it home each night.

    These are really basic IT management decisions. I feel sorry for the people relying upon such an organization with an obvious lack of skill or concern.

Slashdot Top Deals

"An ounce of prevention is worth a ton of code." -- an anonymous programmer

Close