State ordered protection of data
7/15/2007COLUMBUS - State employees had been ordered to remove thousands of Social Security numbers from a new payroll and accounting system two months before a computer backup tape containing the personal data was stolen from an intern, a newspaper reported yesterday.
David White, executive program manager for the new computer project called the Ohio Administrative Knowledge System, sent an e-mail to four workers on April 4 telling them to move sensitive files to a secure part of the system, according to The Columbus Dispatch, which obtained a copy of the e-mail through a public records request.
"I want all files that can be identified with SSN data put into a secure directory today," Mr. White wrote.
The theft in June from a state intern's unlocked car at an apartment complex in Hilliard, Ohio, prompted Gov. Ted Strickland to order a review of how state data is handled.
He also ended the practice of employees taking backup devices home for safekeeping.
Ohio Inspector General Tom Charles told Associated Press yesterday that his office aims to issue a report on the stolen backup tape this week.
Mr. Charles wouldn't comment on whether Mr. White's order to move sensitive data off the main network was ignored.
The intern, Jared Ilovar, hasn't been accused of wrongdoing.
The device contained sensitive data on 859,852 people, including 64,000 state employees and about 770,000 taxpayers with uncashed state income refund checks.
It also held records on at least 258,529 entities, including businesses, vendors, school districts, and local governments.
Once an investigation is complete, Mr. Strickland will take appropriate disciplinary action to hold responsible anyone who placed personal data at risk, said Keith Dailey, a spokesman for the Ohio governor.
Mr. Strickland has said there is no evidence that information on the device has been accessed.
Extracting the data on the device would require a high degree of knowledge and specialized equipment.
About 58,300 people have enrolled in identity-theft protection services offered through the state since the device went missing.
The state's total cost for ID-protection services and other expenses related to the theft could reach $2 million.