The Law Protects Your Privacy!

I wrote Why is the Census Bureau Taking GPS Coordinates of Americans' Front Doors? and Fuck the Census Bureau and Their 2006 Census Test (among others) without much comment regarding the practical problems of such a massive centralization of American demographic data.

Well, here's one: Census Bureau Loses Hundreds of Laptops

The Census Bureau collects the most personal information about Americans, from how much money they earn and where they spend it to how they live and die. It's all confidential - as long as no one steals it.

Lost or stolen from the Census Bureau since 2003 are 217 laptop computers, 46 portable data storage devices and 15 handheld devices used by survey takers.

Although the number of people affected isn't known, the Commerce Department reports that passwords, encryptions and other safeguards were in place. Nothing so far indicates a misuse of any information.

Let's just say that the degree of my trust in the state to physically secure their hardware is about as much as my trust in the state to digitally secure their software.

"The department takes very seriously these high instances of missing laptops, as well as potential breaches of personal identity data," Commerce Secretary Carlos M. Gutierrez said Thursday in response to an internal review of Commerce Department computers.

"All of the equipment that was lost or stolen contained protections to prevent a breach of personal information," he said in a statement. "The amount of missing computers is high, but fortunately, the vulnerability for data misuse is low."

Once a secured device is in the hands of a determined cracker, all bets are off. Every IT department knows the average office worker has little concept of security. People will do all sorts of dangerous things to make their passwords easily memorable. If the software allows it, they'll use their

• user ID
  
• name
  
• birthday
  
• address
  
• social security number
  
• names of family members and pets
  
• and other easily harvestable user-specific code

as their password. Often, they'll use that exact password for several (if not all) systems that require one. Sometimes they'll write it down on a post-it note and stick it to the monitor or save it in a text file. A dedicated hacker will try social engineering and talk this information out of users and their co-workers.

Commerce found that since 2001 the department's 15 operating units had lost track of 1,137 laptop computers. Most, 672, belonged to the Census Bureau. Of those, 246 contained personal information.

Thousands of Census field representatives - many of them temporary, hourly employees - use laptop computers to compile survey data. The department said half of the laptops containing personal information were stolen, often from employees' vehicles, and 113 were not returned.

[...]

Among government departments recently reporting data thefts and security breaches, the Veterans Affairs Department suffered the biggest loss with the theft in May of a laptop and external drive containing information for 26.5 million veterans and active-duty troops. Burglars stole the equipment from the home of a Veterans Affairs employee, but the computer was recovered and showed no signs of having been accessed for the personal data.

Other departments reporting the loss of computers with personal information include the departments of Agriculture, Defense, Education, Energy, Health and Human Services, and Transportation. The Federal Trade Commission also has lost laptops with sensitive data.

Second only to the Census Bureau in missing laptops at the Commerce Department was the National Oceanic and Atmospheric Administration. It reported 325 missing computers, three of them containing personal data.

Among those stolen was one used by a NOAA law enforcement agent and containing some case file information. In July, a laptop containing Social Security numbers and other information on 146 employees and contractors was reported stolen after a fire in a NOAA facility in Seattle, the department said.

Gutierrez said the department was taking steps to protect against further missing laptops or potential breaches of personal identity data. Among them were inventory reforms, including creating a database for all departmental property, and "raising employee accountability standards."

Copyright 2006 Associated Press. All right reserved.

The law can't protect against the general stupidity, forgetfulness, and malice of government agents. Just one more reason to want The Law to have as little power and reach as possible.

P.S.
What about private companies amassing giant databases of customer information? If that information is collected voluntarily and without the threat of violence against holdouts then the people who've given their information understand there is the possibility of their information leaking out. This is one reason why, if given the option, refuse to store bank/credit card/address info in online shopping cart systems and flat-out will not use an online billing system with anything less than 128-bit encryption for transactions.

Posted by Drizzten at September 22, 2006 10:00 AM