Last month, the federal government was caught up in yet another security incident, this time involving a stolen laptop PC belonging to the National Institutes of Health. The laptop contained research data, including participants’ names, birth dates, hospital record numbers and medical reports.
Government officials could argue that the loss was less serious than it could have been: Only about 2,500 records were involved; the data had little, if any, commercial use; and the records offered identity thieves little usable information. The laptop did not contain Social Security numbers, addresses, phone numbers or financial information. One could also argue that the amount and portability of government-held information make such incidents inevitable.
Those arguments might win a legal case. Unfortunately, in the court of public opinion, the government has lost again. This incident is particularly painful because it seems to show that agencies didn’t learn from the Veterans Affairs Department’s experience when one of its laptop PCs was stolen in 2006. And there is an added twist: The laptop contained medical data on Rep. Joe Barton (R-Texas).
However, our intention isn’t to chastise NIH but rather encourage agencies to learn some important lessons. The incident reminds us how portable data has become. Large amounts of information can be transported effortlessly and lost just as easily.
Government officials said data on the NIH laptop should have been encrypted, which underscores the need to involve frontline employees in security efforts. Apparently, NIH researchers were reluctant to encrypt the data on their laptop PCs because doing so slowed them down and made it difficult to share that data with other authorized users. We don’t know if that is true, but it serves as a reminder that security measures must be relatively easy to use.
Last month, we highlighted a case in which another VA laptop was lost, but because the machine’s data was encrypted, it remained safe. However, VA researchers still balk at the department’s security requirements.
Federal leaders face a difficult task in ensuring that users have secure access to the information they need to perform their jobs. That challenge will only grow. As is so often the case, there are no easy answers.
