Report prepared in Strickland transition warned of data risk

6/22/2007
ASSOCIATED PRESS

COLUMBUS, Ohio Months before a computer device containing the Social Security numbers and other personal information of more than 500,000 Ohioans was stolen from an intern s car, the state was warned it was vulnerable to data theft, The Columbus Dispatch reported Friday.

Before he took office in January, Gov. Ted Strickland asked teams of experts to evaluate key areas of state government and submit findings and recommendations.

The team studying the Office of Information Technology concluded the state had little to no policy guidance or standards for protecting Social Security numbers and other sensitive information, according to a report prepared as part of Strickland s transition team.

Ohio s lack of a robust, unified privacy/security capacity lays it open to the type of data spills and breaches that have been plaguing the government and the corporate sectors in increasing numbers over the past few years, the report said.

The report concluded the state needed clear policy and standards set in cooperation with the Legislature, plus proper monitoring and auditing, or the danger of a data breach will continue to grow.

Strickland disclosed last week that a computer backup tape containing personal information on all state employees, welfare recipients and residents who had not cashed state income tax refund checks, among others, was stolen June 10 out of the unlocked car of a 22-year-old intern who had been designated to take the backup device home as part of a standard security procedure.

The governor announced an executive order ending the practice of employees taking backup devices home for safekeeping and mandating a review of how state data is handled, including establishing an encryption protocol.

Data security experts said the unencrypted tape could be breached by someone with computer expertise, time and financial resources, although the Strickland administration maintains it does not believe the information has been accessed.

The state is paying more than $700,000 to provide identity-theft protection services and to hire an independent computer expert to review what data the tape contained. The inspector general s office is investigating the theft of the tape and the state s response.

Read more in later editions of The Blade and toledoblade.com.