News

Data Breaches at State, Local Agencies Expose Data about Millions

• By William Jackson
• October 21, 2008

Most of the exposures came from a single incident in July at the Colorado Division of Motor Vehicles that compromised information on 3.4 million people. But even discounting that incident, the number of records exposed in breaches at state and local agencies outstripped those reported at federal agencies in the same period.

The figures underscore the need for standardized and improved data security at state and local government agencies, said Abe Kleinfeld, president and chief executive officer of nCircle Network Security Inc., of San Francisco.

"I don't think we are seeing an unusual amount of data breaches" at the state and local levels, Kleinfeld said. "The danger is the kind of data they have. It is becoming increasingly important that states begin developing some kind of program."

The company compiled the data on state and local breaches from the Privacy Rights Clearinghouse, which documented 20 breaches through September.

In the same period, the clearinghouse reported five incidents of breaches at federal agencies that exposed the records of 23,024 people. The largest was in May at the Marine Corps Reserve Center in San Antonio, where a contractor improperly accessed and stole 17,000 records. Another incident at the International Visa Service in Atlanta involved an employee's theft of data on 1,000 people.

The lower federal numbers illustrate improvements in the government's data security, which Kleinfeld said can be attributed largely to the standardized processes and controls required under the Federal Information Security Management Act.

"There are a lot of complaints about FISMA, but I think it is hard to argue that security has not improved in the federal government," he said. "It has improved."

States remain vulnerable because there is no similar overarching standard for data or information system security, he said. "We need some kind of program like FISMA that extends across state and local governments," he added.

Imposing a nationwide standard for government data security would be difficult, and it is unlikely to happen in the short run, Kleinfeld said. But FISMA-like requirements could eventually be extended to state and local agencies that administer federal programs or share data with federal agencies.

In the meantime, Sen. Norm Coleman (R-Minn.) introduced a bill last month that could help. S. 3460, the State Cyber Security Protection Act of 2008, would give the Homeland Security Department $25 million to fund a pilot program to support cybersecurity efforts at the state level. The bill has been referred to the Homeland Security and Governmental Affairs Committee.

A program to share best practices among agencies at all levels of government and create cybersecurity templates, even if they are not mandated, would be a big step forward in data security, Kleinfeld said.

Security breaches with exposure of personal data at the state level, as reported by the Privacy Rights Clearinghouse through September, include:

• Florida Department of Children and Families -- 1,200 records exposed.
• Maryland Department of Assessments and Taxation -- 900 records exposed.
• Wisconsin Department of Health and Family Services -- 260,000 records exposed.
• Virginia Department of Social Services -- 1,500 records exposed.
• Wisconsin Department of Revenue -- 5,000 records exposed.
• South Carolina Department of Health and Environmental Control -- 400 records exposed.
• Nevada Department of Public Safety -- 109 records exposed.
• Utah Division of Finance -- 500 records exposed.
• Pennsylvania Department of State -- 30,000 records exposed.
• Rhode Island Department of Administration -- 1,400 records exposed.
• Oklahoma Department of Corrections -- 10,597 records exposed.
• Baltimore Highway Administration -- 1,800 records exposed.
• Oklahoma Corporation Commission -- 5,000 records exposed.
• Connecticut Department of Labor -- 2,100 records exposed.
• California Department of Consumer Affairs -- 5,000 records exposed.
• Texas Department of Public Safety -- 826 records exposed.
• Florida Agency for Health Care Administration -- 55,000 records exposed.
• Colorado Division of Motor Vehicles -- 3.4 million records exposed.
• California Department of Consumer Affairs -- 5,000 records exposed.
• Pennsylvania Department of Public Welfare -- 2,845 records exposed.