07/20/2006

By HOPE YEN  / Associated Press

Veterans Affairs Secretary Jim Nicholson on Thursday defended the government's decision to withdraw free credit monitoring for millions of veterans, saying there was little risk their sensitive data would be compromised.

Testifying to a Senate panel, Nicholson acknowledged there were no 100 percent guarantees that names, birthdates and Social Security numbers stored on a VA employee's stolen laptop and external drive were not accessed or copied. But he said the low risk did not justify a year of personalized monitoring at a taxpayer cost of $160.5 million.

"Facts have changed, the situation has changed," Nicholson said, noting that the stolen equipment has been recovered and that the FBI determined with a "high degree of confidence" that the data was not compromised.

Speaking of veterans groups, some of whom are fiercely opposed to the decision, Nicholson added: "Some oppose, but some concur, thinking it would be a waste of $160.5 million."

Congress is investigating the steps leading up to and after the May 3 theft at a VA employee's suburban Maryland home. It also is pondering legislation to improve information security.

On Thursday, the House Veterans Affairs Committee passed a bill that would create a new VA undersecretary of information services whose duties would be focused on data protection. The bill would also provide for free credit monitoring after a breach, upon the request of affected individuals.

Talk of security changes at the VA came in the aftermath of the May 3 theft of 26.5 million people's data. It was the worst-ever breach of government data.

During Thursday's hearing, lawmakers on the Senate Veterans Affairs Committee expressed concern that the VA might be breaking its promise after informing veterans last month that it would provide free monitoring. While the stolen equipment was later recovered, some veterans say they should still get some protection, they said.

"I know the FBI says it has a high level of certainty that the data was not accessed, but frankly I wouldn't bet my credit on it," said Sen. Patty Murray, D-Wash. "And more importantly, the VA still has an inadequate data security system. Until that's fixed, I think the VA should keep its commitment."

Sen. Richard Burr, R-N.C., saying that many veterans still don't feel reassured, added: "As long as 100 percent are comfortable, I'm comfortable. But unless we reach that consensus, we still have some work to do."

Nicholson said the VA was in the process of hiring a company to provide data breach analysis to detect potential patterns of misuse of data. In addition, the department planned to send letters to veterans informing them of free services already available to all citizens, including free monitoring for 90 days and credit reports three times a year.

Meanwhile, the VA is creating a new Office of Cyber & Information Security Training to help coordinate information security and is developing policies to restrict access of sensitive information with encryption and other tools.

"Excellence in information security will take the full commitment of VA's senior leadership, both political appointees and career senior executives," Nicholson said. "It will take time, but my sense of urgency is clear."

Sen. Larry Craig, chairman of the Senate panel, praised some of the VA's initiatives so far and said he did not believe additional monitoring was needed. Still, he called the May 3 burglary a "wholesale failure" and cautioned the VA that he considered the matter far from closed.

"There is not a single American who doesn't expect and, frankly, doesn't deserve, assurance that their government — one of the world's largest custodians of sensitive personal information — is vigilantly guarding that personal information," said Craig, R-Idaho.

___

On the Net:

Department of Veterans Affairs: http://www.va.gov/