Data breaches at state, local agencies expose data about millions

By William Jackson

Connecting state and local government leaders

| October 20, 2008

Number of records exposed in breaches at state and local agencies outstripped those reported at federal agencies in the first three-quarters of 2008.

Data breaches at state and local government agencies exposed the personal information of nearly 3.8 million Americans in the first three quarters of this year, according to the Privacy Rights Clearinghouse.Most of the exposures came from a single incident in July at the Colorado Division of Motor Vehicles that compromised information on 3.4 million people. But even discounting that incident, the number of records exposed in breaches at state and local agencies outstripped those reported at federal agencies in the same period.The figures underscore the need for standardized and improved data security at state and local government agencies, said Abe Kleinfeld, president and chief executive officer of nCircle Network Security Inc., of San Francisco.'I don't think we are seeing an unusual amount of data breaches' at the state and local levels, Kleinfeld said. 'The danger is the kind of data they have. It is becoming increasingly important that states begin developing some kind of program.'The company compiled the data on state and local breaches from the , which documented 20 breaches through September.In the same period, the clearinghouse reported five incidents of breaches at federal agencies that exposed the records of 23,024 people. The largest was in May at the Marine Corps Reserve Center in San Antonio, where a contractor improperly accessed and stole 17,000 records. Another incident at the International Visa Service in Atlanta involved an employee's theft of data on 1,000 people.The lower federal numbers illustrate improvements in the government's data security, which Kleinfeld said can be attributed largely to the standardized processes and controls required under the Federal Information Security Management Act.'There are a lot of complaints about FISMA, but I think it is hard to argue that security has not improved in the federal government,' he said. 'It has improved.'States remain vulnerable because there is no similar overarching standard for data or information system security, he said. 'We need some kind of program like FISMA that extends across state and local governments,' he added.Imposing a nationwide standard for government data security would be difficult, and it is unlikely to happen in the short run, Kleinfeld said. But FISMA-like requirements could eventually be extended to state and local agencies that administer federal programs or share data with federal agencies.In the meantime, Sen. Norm Coleman (R-Minn.) introduced a bill last month that could help. , the State Cyber Security Protection Act of 2008, would give the Homeland Security Department $25 million to fund a pilot program to support cybersecurity efforts at the state level. The bill has been referred to the Homeland Security and Governmental Affairs Committee.A program to share best practices among agencies at all levels of government and create cybersecurity templates, even if they are not mandated, would be a big step forward in data security, Kleinfeld said.Security breaches with exposure of personal data at the state level, as reported by the Privacy Rights Clearinghouse through September, include:

Number of records exposed in breaches at state and local agencies outstripped those reported at federal agencies in the first three-quarters of 2008.

Related Links