Complain about a product or service

TSA Loses Hard Drive With 100,000 Employee Names, Data

By Martin H. Bosworth
ConsumerAffairs.com

May 7, 2006

Data Theft • Bank Data Breach Threatens 248,000 in North Carolina • GPS Not Foolproof • Countrywide Warns Millions of Data Breach • Thieves Steal AT&T Laptop with Employee Data • Report: Data Breach Disclosure Laws Don't Affect Identity Theft • Patient Information Exposed in Data Breach at Walter Reed • Supermarket Chain Reports Data Breach • Report: Feds Still Not Doing Enough To Secure Data • Data Thieves Hit Georgetown University Students, Faculty • 800,000 Job Seekers At Risk In Gap Data Breach • TJX Data Breach Settlement Has Strings Attached • More ...

In its latest privacy foul-up, the Transportation Security Administration (TSA) has lost a computer hard drive containing information on 100,000 employees.

The employees worked for the agency from January 2002 until August 2005. The drive contained names, addresses, Social Security numbers, dates of birth, and payroll and bank account information -- a potential treasure trove for identity thieves and cybercriminals.

TSA sent out a notice to affected individuals and promised to fund one year of free credit monitoring for anyone affected by the breach.

The statement, also published on the TSA Web site, apologised for the breach but claimed there was "no evidence" that the missing information had been used for fraud or identity theft.

"We are notifying you out of an abundance of caution at this early stage of the investigation given the significance of the information contained on the device," TSA Administrator Kip Hawley said in the statement. "We apologize that your information may be subject to unauthorized access, and I deeply regret this incident."

The TSA, a division of the Department of Homeland Security (DHS) is not unfamiliar with data breaches and privacy problems.

Tech and outsourcing company Accenture mistakenly mailed forms containing personal information on 1,200 TSA employees to other employees in September 2006.

The agency has repeatedly tried to implement a passenger screening program variously called "CAPPS II" and "Secure Flight," but was heavily criticized for permitting another contractor to collect data on Americans without their knowledge as part of a "study" for the program. The program was scuttled in 2005, but could conceivably be revived.

The agency's existing "terrorist watch lists" are riddled with errors so severe that individuals ranging from toddlers to Senator Edward Kennedy (D-MA) have been repeatedly stopped at airport check-ins and required to go through extra screening.

TSA's "Registered Traveler" program, where private companies administer "express check-in" services at airports for passengers who pay a fee and submit their information to a background check, has also been called a privacy problem. The program effectively creates two classes of travelers, one of which bypasses security screening if they have the money to pay for it--even if they may actually be terrorists using fake credentials.

In the case of the hard drive breach, at least one security expert is willing to give TSA credit. Ed Dickson, who writes the Fraud, Phishing, and Financial Misdeeds blog, credited TSA with reporting the incident quickly, rather than months after the fact as other organizations have.

"[T]hey appear to be handling the matter a lot more responsibly than many organizations that have breached recently," Dickson wrote. "In my humble opinion, the TSA is taking this seriously and handling this matter the best way it can be."

Others wanted to know if the data on the hard drive was protected against misuse. "[It would b]e nice to know whether the agency in charge of airport security protocols is following best-practice data security protocols," wrote PIRG's Ed Mierzwinski . "While these data were reported to be 'archived,' that does not mean encrypted."

And still others were fuming at what appears to be yet another case of poor data handling by the government.

"Trusting the government to provide security for the nation’s transportation infrastructure is utterly absurd," wrote Michael Hampton at the Homeland Stupidity blog. "They can’t even secure their own offices, let alone the airport. Nationalizing airport security was not the right answer then or now."

Report Your Experience
If you've had a bad experience -- or a good one -- with a consumer product or service, we'd like to hear about it. All complaints are reviewed by class action attorneys and are considered for publication on our site. Knowledge is power! Help spread the word. File your consumer report now.

Back to the top |