Veterans Groups Sue over VA Data Theft

A number of veterans groups are charging in a lawsuit that their privacy rights were violated after data on 26.5 million veterans was stolen from a Department of Veterans Affairs (VA) employee, an Associated Press article on reports.

The lawsuit demands that the VA fully disclose which military personnel are affected by the theft, and seeks $1,000 in damages for each person—up to $26.5 billion total. The article states that the veterans are also asking for a court order barring VA employees from using sensitive data until independent experts determine proper safeguards.

"VA arrogantly compounded its disregard for veterans’ privacy rights by recklessly failing to make even the most rudimentary effort to safeguard this trove of the personally identifiable information from unauthorized disclosure," the complaint states.

The AP reports the class-action lawsuit against the federal government is the second suit since the VA disclosed the May 3 burglary on May 22. Since then, the VA said the stolen information included names, birth dates, phone numbers, addresses, Social Security numbers, disability codes, and personal information of up to 50,000 active Navy and National Guard personnel.

Initially, the VA reported that personal information on only veterans discharged since 1975, and some of their spouses, was stolen.

The groups cite violations of a 1974 federal privacy law requiring agencies to have protections to prevent unauthorized disclosure of personal information, and the VA stated that the data analyst who took the data home violated its established procedures.

A spokesman for the VA did not have immediate comment after the suit was filed on Tuesday, the AP reports.

The lawsuit also states that VA Secretary Jim Nicholson and other VA officials were at fault, noting that the agency’s inspector general warned every year since 2001 that access controls were weak. It also said the VA acted irresponsibly by failing to publicize the burglary after the analyst promptly told his supervisors.

The AP reports the five veterans groups involved in the lawsuit are Citizen Soldier in New York; National Gulf War Resource Center in Kansas City; Radiated Veterans of America in Carson City, Nev.; Veterans for Peace in St. Louis; and Vietnam Veterans of America in Silver Spring, Md.

For more on the veteran data story, read Data Theft at the VA.

Keep checking in at our Security Feed page, or subscribe via RSS, for updated news coverage.

Compiled by Paul Kerstein

Copyright © 2006 IDG Communications, Inc.

7 hot cybersecurity trends (and 2 going cold)