Stolen VA Laptop Recovered

lancejjj writes "Remember how the VA was pinning the theft of 26.5 million veterans' personal records on a hard working-but-renegade employee whose laptop was stolen? Surprise! It turns out that the employee had written permission to bring the sensitive data home. Fortunately, the laptop has been recovered. It is still unclear how the laptop was recovered, or if any of the veterans' personal data was leaked."

Nothing taken

[paganizer]

I believe it said on the FBI's report that it looked like the data had not been looked at.

I'm sure it's safe

[jeffmeden]

There is no way the thief who had it thought to himself "Hmm all these VA logos, some huge files with a bunch of names and 9 digit numbers. I obviously have nothing important here, I should just return this to the rightful owner." I mean it's not like this was all over the news or anything. Where would he get an idea like 'steal the identities of 26 million veterans'??? I know I can sleep a little easier (mostly because I was never in the armed services). On a more serious note, why aren't the headlines reading "VA wrongly accused employee of negligence, prepared to take full blame"? That seems to be the gist of this event.

New requirements for protection of Personal Data.

[Chyeburashka]

Meanwhile, the Whitehouse published this memo [whitehouse.gov] last Friday. It's about time, IMHO.

Re:Data Wasn't Accessed

[ewhac]

The data probably wasn't accessed. If the thief knew what they had, and was at all clever, they could have pulled the drive, performed a raw sector copy, and put it back. Poof! No date changes. I'm sure the FBI forensics team will be checking for this possibility.

Schwab

Load of crap

[NynexNinja]

It sounds like a coverup to me. They never found that laptop, and if they did, it wasn't the one that was missing. I bet after a whole bunch of politicians got in hot water over this story when it first broke, they quietly orchestrated a nice plan to sweep this mess back under the carpet where it belongs! While this case quietly goes away, the real issues (data security, privacy of sensitive data, etc, etc, etc) do not have to be addressed.

Re:Nothing taken

[Anonymous Coward]

I believe it said on the FBI's report that it looked like the data had not been looked at.

Remove drive, copy contents, re-insert drive not leaving fingerprints and how could they tell? It never booted, so what is in the returned or recovered computer must be considered compromized. There is no way to know if this did in fact, or did not in fact occur. So at best, it is a guess unless they analysed the screws with a scope for scraches and the like, unless it is a model that just pops out.

Re:Nothing taken

[crowemojo]

Ok, the best you could possibly do is try and reconstruct when the computer was turned on or logged into. At best, you can say that; since the laptop had been taken, it had not been logged into. Even then, that is no assurance that the data was not copied, since the drive could have been taking out and copied.

There is no reliable forensic technique to determine beyond doubt that data has not been read. Imagine if you had left a page with notes in a public, high traffic area. When you found that page a day later, how would you go about determining if anyone had looked at it?

I smell a fish...

[indigence_is_best]

My data just happened to be on that hard drive, so I am a little upset about it to say the least. We in the armed forces have been told that the individual was definitely NOT supposed to take that data home. It even says so on the VA website reguarding this incident. http://www.firstgov.gov/veteransinfo.shtml [firstgov.gov] If he had written authorization to do so, then that is a completely different story, and all of us that were affected should be even more angry. There are procedures in place for bringing ANY government property home; whether it be DATA or PHYSICAL media. Especially privacy act information.

So which is it? He was or he wasn't allowed to? It is a bit too convenient for my taste that the laptop was recovered so magically and with the data intact.

This kind of back-and-forth "truth" on these kinds of issues gets very old very fast.

Smells fishy...

TrueCrypt needs admin privileges; now what?

[KWTm]

I, too, am pleased with TrueCrypt; the cross-platform feature allows removable drives to be interchanged between my (k)Ubuntu Dapper systems and my wife's Win2k system (she refuses to use WinXP). Finally we can easily store something on a CF card, pull it out and not worry about data being stolen!

Unfortunately, this does not work on our laptops at work; I am being coerced to use WinXP at work (damn you!) without admin privileges, and TrueCrypt refuses to install without admin privileges.

Does anyone know a workaround for this? I recognize that it's probably unlikely; if it works without admin privileges, it's probably not that secure.

Before anyone suggests that I ask the IT department of our firm: I already asked if it was okay to install certain programs. "Like what?" they asked. "Firefox," I said. "What's Firefox?" they asked. So that pretty much nixes that idea.

I did notice that GPG and WinPT install okay without needing admin privileges, so I am able to have *some* form of encryption, but it is non-ideal for various reasons.

Btw, for those of you using Ubuntu Dapper, here's a web page on how to install it easily. I ended up compiling (pretty much my first time compiling anything), and it was easier than I thought.

http://www.ubuntuforums.org/showthread.php?t=19936 7&highlight=truecrypt [ubuntuforums.org]

Re:Nothing taken

[swattz101]

Yeah, I'm sure they at least looked at the database file, and looked at the 'last accessed date'. {/snide remark}

In actuality, they probably ran some sort of forsenics tool against the drive and preliminary investigation says it probably was not accessed. But my question is, is there a way to track cloaing of a drive. What's to say that whoever had it didn't make a bit-by-bit clone that can't be traced. Granted, I get the feeling that the dumba$$ who stole the computer may not have had the knowledge to do that, but as a vetern and a network administrator, I wouldn't bet my identy on it. I will still take advantage of the credit monitoring when it comes out.