The Security Mentor

Privacy advocates talk in lofty abstractions and most people don't see what their point is.

One concrete problem with the government building dossiers on us is that the information tends to stop being "government" information before too long. The Veteran's Administration just had 26.5 million records slip out of their custody, including dates of birth and Social Security numbers.

Then there's abuse. As long as governments are made of humans, every government database will be abused. There was a tragic example last year of a 911 dispatcher using the database(s) at work to stalk his ex-girlfriend. After hunting her down he murdered her and her new boyfriend.

To quote one of my favorite science fiction shows, "A government is a body of men, usually notably ungoverned".

UPDATE 5/26:

The VA leak was worse than initially reported. Via the Emergent Chaos blog:

[VA Secretary] Nicholson initially told the committee that the stolen information “did not include any of the VA’s electronic health records,” but after further questioning by Rep. Bob Filner (D-California), the Bush cabinet secretary admitted the data did include codes representing veterans’ specific physical ailments, Reuters reports. (From "VA Data Theft Could Cost Taxpayers $500M" in CSO Online.)

UPDATE 6/3:

The Washington Post reports that the VA information on the stolen laptop may be hard for crooks to read because it "was stored in a specialized, standard format used for data manipulation and statistical analysis". I'm not impressed.

Statistical analysis software is an everyday tool that's easy to find, and besides, apply a little logic: doesn't it seem likely that the employee who took the laptop home to work on the data also had the software to work on the data?

UPDATE 6/29:

The government got the laptop back! Nobody's saying how.

The VA is trying to fire the analyst who took all the information home. They accuse him of negligence. It turns out, though, theat he reported the theft immediately but the VA sat on the report for weeks. It also turns out that he didn't just walk out the door with the data: he asked for, and received, written permission on three occasions to take personal data and software home.

AP story about VA laptop.