It isn't just the British government that can't seem to hang on to highly personal data. It is happening right here in the US. In Nashville, Tennessee for example:
The theft of a laptop containing Social Security numbers of Nashville, Tennessee, area voters is expected to cost local officials about US$1 million as they roll out identity-theft protection to those affected.
County officials say that thieves broke into Davidson County Election Commission offices on the weekend before Christmas, smashing a window with a rock and then making off with a $3,000 router, a digital camera and a pair of Dell Latitude laptops containing names and Social Security numbers of all 337,000 registered voters in the county.
County election officials began notifying residents of the breach on Jan. 2, and the local government is offering victims one year of free identity theft protection from Debix Identity Protection Network.
Debix says that 25 percent to 35 percent of victims of this type of breach typically request this service. With the city paying Debix just under $10 per account, the price tag for the laptop theft is expected to be in the $1 million range.
Since state data breach disclosure laws went into effect a few years ago, the theft of an unencrypted laptop computer can become a major problem for any organization that stores sensitive data.
"It is a very bad information-handling practice to keep sensitive information about individuals including their Social Security numbers on an unencrypted laptop or any other device that is removable," said Paul Stephens director of policy and advocacy with Privacy Rights Clearinghouse, a privacy advocacy group that has tracked the exposure of 217 million records in the U.S. over the past three years.
For heaven's sake. Why aren't these idiots encrypting data? This is not rocket surgery, people. Lest you think only governments pull this sort of boneheaded maneuver, there is another item this morning regarding GE Money. They have managed to lose an unencrypted backup tape containing the Social Security numbers of a lot of people:
A backup tape containing credit-card information from hundreds of U.S. retailers is missing, forcing the company responsible for the data to warn customers that they may become the targets of data fraud.
GE Money, which manages in-store credit-card programs for the majority of U.S. retailers, first realized that the tape was missing from an Iron Mountain secure storage facility in October, said Richard Jones, a company spokesman. "We were informed that one of the tapes could not be located. But at the same time there was no record of it ever having been checked out," he said.
The tape contained in-store credit-card information on 650,000 retail customers, including those of J.C. Penney, he said. GE Money employees are also affected by the breach.
The missing backup tape was unencrypted.
Although J.C. Penney was the only company that Jones would confirm as affected by the missing tape, that retailer accounts for just a small percentage of all accounts that were compromised. In total, 230 retailers are affected by the breach. "Clearly that number includes many of the national retail organizations," he said.
About 150,000 Social Security numbers were on that tape. This is not going to stop until the people in charge are held accountable for their lax security practices. Smart lawyer money-making opportunity alert! (Today just seems to be a technology-oriented day here at the Crabitat.)