<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: investigation]]></title>
    <link>http://securityratty.com/tag/investigation</link>
    <description></description>
    <pubDate>Thu, 03 Jul 2008 18:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Backup tape is stolen from Bristol-Myers Squibb]]></title>
      <link>http://securityratty.com/article/911478f22f756b8e8513c59d7f720d18</link>
      <guid>http://securityratty.com/article/911478f22f756b8e8513c59d7f720d18</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/17/08

Organization
Bristol-Myers Squibb Co. (&quot;BMS

Contractor/Consultant/Branch
Unknown

Victims
Current and former employees and some dependants
...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/bms.jpg" width="198" align="right" height="160"><font size="2"><b>Date Reported: </b><br>7/17/08<br><br><b>Organization: </b><br><a href="http://www.bms.com/landing/data/index.html">Bristol-Myers Squibb Co. ("BMS")</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>Unknown<br><br><span style="font-weight: bold;">Victims:</span><br>Current and former employees and some dependants<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown*<br><br><font size="1">*Bristol-Myers Squibb had "about 42,000 employees as of Dec. 31, the last date for which work force figures were available in regulatory filings.", Source: <a href="http://money.cnn.com/news/newsfeeds/articles/djf500/200807171514DOWJONESDJONLINE000844_FORTUNE5.htm">CNN Money</a></font> <br><br><span style="font-weight: bold;">Types of Data:</span><br>"name, address, date of birth, Social Security number, marital status, gender, salary, hire date, termination date, retirement date, and, in some instances bank account information"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"On June 4, 2008, Bristol-Myers Squibb Company ("BMS") learned that a back-up data tape containing BMS-related data was stolen while it was being transported for storage.&nbsp; Through subsequent forensic work, it was determined that the data tape included personal information of current and former BMS employees"<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.pharmalot.com/wp-content/uploads/2008/07/bms_letter.pdf">Pharmalot (copy of notification letter)</a> <br><a href="http://www.pharmalot.com/2008/07/bristol-myers-security-breach-hits-untold-thousands/">Pharmalot</a> <br><a href="http://money.cnn.com/news/newsfeeds/articles/djf500/200807171514DOWJONESDJONLINE000844_FORTUNE5.htm">CNNMoney</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Ed Silverman, Pharmalot<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>The drugmaker sent letters over the past week saying a data tape containing reams of personal information was stolen several weeks ago<br><br>On June 4, 2008, Bristol-Myers Squibb Company ("BMS") learned that a back-up data tape containing BMS-related data was stolen while it was being transported for storage. <br><span style="font-style: italic;">[Evan] This statement prompted me to list the contractor as "unknown" instead of "none".&nbsp; I presume that the data tape was being transported by a third-party vendor when it was stolen.&nbsp; I am looking for more information on this.</span><br><br>Through subsequent forensic work, it was determined that the data tape included personal information of current and former BMS employees, such as name, address, date of birth, Social Security number, marital status, gender, salary, hire date, termination date, retirement date, and, in some instances, bank account information.<br><span style="font-style: italic;">[Evan] Ugh, this looks like very sensitive HR and benefits data.</span><br><br>The names, addresses, and Social Security numbers of some employee dependents also were included on the tape.<br><br>an untold number of current and former employees - and their dependents - could be affected<br><br>BMS has initiated an investigation of this incident.<br><br>To date, BMS has no reason to believe that any of your personal information has been inappropriately accessed from the data tape by an unauthorized party, or that any identity theft, fraud or misuse of your personal information has occurred.<br><span style="font-style: italic;">[Evan] I agree with most of this statement except for the "misuse" part.&nbsp; There may be no evidence of misuse post stolen tape, but there may be an argument for misuse by BMS themselves.&nbsp; BMS is the data custodian in this scenario, not the data owner.&nbsp; If a data custodian does not care for the owner's information in a manner that is expected or communicated, does it constitute misuse?</span><br><br>In addition, there is no evidence that the data tape or the information contained on it was the target of the theft.<br><span style="font-style: italic;">[Evan] I am interested in knowing more about who was transporting the tape and whether or not other items were taken.</span><br><br>As a precaution, to help you detect any possible misuse of your data, BMS has arranged for you to enroll in credit monitoring for one full year, at no cost to you.<br><span style="font-style: italic;">[Evan] There is that "misuse" mention again.&nbsp; One year of free credit monitoring does nothing to protect a victim against fraud that occurs after one year, supposing the victim does not renew at his/her own expense.&nbsp; I wonder how many people renew on average.</span><br><br>If you have any questions, you may call the dedicated Privacy Help Line at 1-877-214-0689.&nbsp; Our representatives will be available to assist you Monday through Friday, between 8 a.m. and 5 p.m. ET.<br><br>the drugmaker is issuing this statement: "Bristol-Myers Squibb regrets that this incident occurred and is committed to providing appropriate assistance for affected individuals who had their personal information on the stolen data tape. We are committed to protecting the privacy and security of employee and dependent information. Maintaining the trust and confidence of our employees is paramount to Bristol-Myers Squibb."<br><br>Protecting the privacy and security of your information is extremely important to us.<br><br>In this regard, BMS wishes to reiterate that it does not have any evidence indicating that your personal information has been misused.<br><span style="font-style: italic;">[Evan] Another "misuse" mention.</span><br><br>the company is taking appropriate remedial steps, including enhancing security protocols regarding the handling of personal information and our back-up data tapes.<br><span style="font-style: italic;">[Evan] Like what? Encryption maybe?</span><br><br>On behalf of BMS, I apologize for any inconvenience or concern that this matter may cause for you.<br><br><span style="font-weight: bold;">Commentary:</span><br>I couldn't find any mention about encryption or whether or not police were called.&nbsp; You would think that a large, well-repected company like Bristol-Myers Squibb encrypts confidential data on tape, right? <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/18/bms.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Fri, 18 Jul 2008 07:26:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/tape">tape</category>
      <category domain="http://securityratty.com/tag/back-up data tape">back-up data tape</category>
      <category domain="http://securityratty.com/tag/data tape">data tape</category>
      <category domain="http://securityratty.com/tag/owner">owner</category>
      <category domain="http://securityratty.com/tag/data owner">data owner</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/bristol-myers squibb">bristol-myers squibb</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <source url="http://breachblog.com/2008/07/18/bms.aspx">Backup tape is stolen from Bristol-Myers Squibb</source>
    </item>
    <item>
      <title><![CDATA[A backup tape is stolen from Greensboro Gynecology Associates]]></title>
      <link>http://securityratty.com/article/50667ca11f139e2009a7776a17ed3db5</link>
      <guid>http://securityratty.com/article/50667ca11f139e2009a7776a17ed3db5</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/15/08

Organization
Greensboro Gynecology Associates

Contractor/Consultant/Branch
None

Victims
Physicians, staff members, and patients

Number...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/gga.jpg" width="70" align="right" height="70"><font size="2"><b>Date Reported: </b><br>7/15/08<br><br><b>Organization: </b><br><a href="http://www.greensborogynassoc.medem.com/">Greensboro Gynecology Associates</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Physicians, staff members, and patients<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, addresses, Social Security numbers, employers, insurance companies, policy numbers and family members"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"GREENSBORO - Patients at a Greensboro doctors’ office have been notified that their personal information - including Social Security numbers and addresses - was stolen in May."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.news-record.com/content/2008/07/15/article/security_breach_puts_patients_of_greensboro_gynecology_at_risk">News &amp; Record</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Ryan Seals, News &amp; Record<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>In a letter mailed to patients, Greensboro Gynecology Associates said a backup tape of their computer database was stolen.<br><span style="font-style: italic;">[Evan] Does "their computer database" include billing information and other confidential information other than personally identifiable information?</span><br style="font-style: italic;"><br>The letter was dated June 16, but some letters weren't postmarked until July 9.<br><br>The medical practice said a backup tape of patient information was stolen on May 29 from an employee who was taking the tape to an off-site storage facility for safekeeping.<br><span style="font-style: italic;">[Evan] I wonder what type of off-site storage facility.&nbsp; Some of the small businesses that I have encountered consider an employee's home to be an "off-site" storage facility.</span><br style="font-style: italic;"><br>The stolen information included patients' name, address, Social Security number, employer, insurance company, policy numbers and family members.<br><br>The tape did not include treatment or specific medical data.<br><br>"We are very concerned about this theft, as we too are victims," Pat Higgins, the practice's administrator, wrote in an e-mail Tuesday. "We are notifying our present and former patients. ..."<br><br>The practice at 719 Green Valley Road Suite 305 said personal information for its physicians and other staff members also was on the stolen tape.<br><br>the case is under investigation<br><br>did not respond to inquiries about how many patients were affected, how the theft occurred and whether anything else was taken<br><br>The practice's letter said the theft had been reported to police. However, officials with the Greensboro Police Department and the Guilford County Sheriff's Office said they had no such report on file.<br><span style="font-style: italic;">[Evan] This is interesting news.</span><br><br>The data was not encrypted, but Greensboro Gynecology Associates said the stolen data isn't likely to be accessed.<br><br>"We have consulted with several computer security experts, and they have advised it is highly unlikely the tapes can be accessed because of the program used and the language (the information) is written in," according to a recording on a hotline set up to address patients' concerns.<br><span style="font-style: italic;">[Evan] Who are these several computer security "experts'?&nbsp; I hate to disagree, but...&nbsp; The assessment is based on "the program used and the language" that the archived information is written in.&nbsp; Really?&nbsp; How hard is it to obtain the necessary hardware and software to access the information?&nbsp; Someone interested in accessing the tape could conceivably flip the data protection tab on the tape (to prevent data corruption through inadvertent writes), download some of the more popular backup software programs, buy a compatible drive (stolen or on eBay), and go to town.&nbsp; Couldn't they?&nbsp; Backup Exec is a very popular backup program.&nbsp; Anyone can download a 60-day trial for free.&nbsp; More talented professionals have even more sophisticated methods of accessing data on tape. </span><br style="font-style: italic;"><br>Greensboro Gynecology Associates said they are consulting with computer security experts to prevent similar thefts in the future.<br><span style="font-style: italic;">[Evan] I kind of hope that they are not consulting with the same computer security "experts" referenced above.</span><br style="font-style: italic;"><br>"We sincerely regret and apologize that this incident occurred," the letter said<br><br><span style="font-weight: bold;">Commentary:</span><br>Many backup software solutions include the option to encrypt the written data built-in.&nbsp; Why not use it?<br><br>Greensboro Gynecology Associates has established a hotline for concerned patients.&nbsp; The phone number is (336) 544-4590.&nbsp;&nbsp; The hotline asks patients to leave their name and telephone number for a staff member to return their call. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/16/gga.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Wed, 16 Jul 2008 12:16:26 +0000</pubDate>
      <category domain="http://securityratty.com/tag/greensboro gynecology">greensboro gynecology</category>
      <category domain="http://securityratty.com/tag/greensboro">greensboro</category>
      <category domain="http://securityratty.com/tag/tape">tape</category>
      <category domain="http://securityratty.com/tag/backup tape">backup tape</category>
      <category domain="http://securityratty.com/tag/data">data</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/specific medical data">specific medical data</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/computer security">computer security</category>
      <source url="http://breachblog.com/2008/07/16/gga.aspx">A backup tape is stolen from Greensboro Gynecology Associates</source>
    </item>
    <item>
      <title><![CDATA[Very few details are available for Missouri National Guard breach]]></title>
      <link>http://securityratty.com/article/a9da228def34f73b19354bb07ad9da29</link>
      <guid>http://securityratty.com/article/a9da228def34f73b19354bb07ad9da29</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/15/08

Organization
National Guard Bureau

Contractor/Consultant/Branch
Missouri National Guard (&quot;MOGUARD

Victims
Citizen-Soldier and employee&quot;s
...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/moguard.jpg" width="155" align="right" height="155"><font size="2"><b>Date Reported: </b><br>7/15/08<br><br><b>Organization: </b><br><a href="http://www.ngb.army.mil/default.aspx">National Guard Bureau</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.moguard.com/">Missouri National Guard ("MOGUARD")</a> <br><br><span style="font-weight: bold;">Victims:</span><br>"Citizen-Soldier and employee"s<br><br><span style="font-weight: bold;">Number Affected:</span><br>"approximately 2,000"<br><br><span style="font-weight: bold;">Types of Data:</span><br>"some personal information"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"The Missouri National Guard learned on Monday, July 14, 2008, that some personal information was compromised. Details of how this information was compromised are being withheld at this time, so as not to interfere with the ongoing law enforcement investigation."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.moguard.com/What%20Happened%20in%20July%202008%20and%20How%20Does%20this%20Affect%20Me%20(Final%20Version)%2015JUL08.pdf">Missouri National Guard Press Release</a> <br><a href="http://www.stltoday.com/stltoday/news/stories.nsf/news/missouristatenews/story/ca0fe7785a2d8471862574870051f7fd?OpenDocument">St. Louis Post-Dispatch</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Missouri National Guard<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>The Missouri National Guard learned on Monday, July 14, 2008, that some personal information was compromised.<br><br>Details of how this information was compromised are being withheld at this time, so as not to interfere with the ongoing law enforcement investigation.<br><span style="font-style: italic;">[Evan] Sounds like a good excuse to not reveal details.</span><br><br>It is important to note that we have no reason to believe that the information that was compromised was for the purpose of gaining Citizen-Soldier or employee information or that the information has been or will be used inappropriately.<br><span style="font-style: italic;">[Evan] It's nice that MOGUARD can make this judgment call on behalf of the victims.&nbsp; Its too bad the victims are not allowed to make a determination themselves based on the facts surrounding this breach.</span><br><br>The Missouri National Guard has a list of those Citizen-Soldiers or employees whose information was compromised.<br><span style="font-style: italic;">[Evan] Keyword is "was", and not the phrase "may have been".</span><br><br>Letters are being sent to these individuals and/or their Families.<br><br>The list includes approximately 2,000 individuals.<br><br>At this time we have no confirmation of misuse of Citizen-Soldier or employee information resulting from the loss.<br><br>"I am distressed that sensitive information has been compromised," <a href="http://www.moguard.com/tag/MONG.tag.asp">Major General King Sidwell</a> <br><span style="font-style: italic;">[Evan] I am impressed when a leader of an organization steps forward and speaks about a breach.&nbsp; In my opinion it demonstrates strong leadership and the understanding that the "buck" ultimately stops with him.</span><br><br>"I am especially concerned about the problems and inconveniences this may cause for our Missouri National Guard Citizen-Soldiers and their families," King said.<br><br>Because Social Security Numbers may have been contained within the missing information, we advise individuals to monitor financial accounts continuously for suspicious activity as a matter of good practice.<br><span style="font-style: italic;">[Evan] This statement provide a clue as to what "some personal information" may be.</span><br><br>The Missouri National Guard has safeguards in place to protect private information.<br><br>We provide ongoing privacy training to all employees.<br><br>The Missouri National Guard has taken action to rectify this unfortunate situation, and is working to insure our Citizen-Soldier’s or employee’s information receives the highest standard of security and privacy protection.<br><br>Any soldier or family member with questions should call a hotline number at 1-888-526-6664 extension 7888.<br><br>If the soldier is deployed overseas, the soldier may use the Defense Switching Network and call 312-555-9500 extension. 7888. <br><br><span style="font-weight: bold;">Commentary:</span><br>We have no idea as to what the cause of this breach may have been.&nbsp; Anyone want to guess?&nbsp; If so, post a comment.<br><br>It’s a little ironic.&nbsp; I was just typing an email response to an information security friend of mine about military breaches and the way the military has a completely different way of disclosing details (if any).&nbsp; This breach is proof positive.&nbsp; We'll have to see if further details emerge over time.<br><br>I sincerely hope that the owners of the "personal information" (the victims) get all of the answers that they require in order to evaluate risk themselves and make educated decisions on how they will proceed. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/15/moguard.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 15 Jul 2008 10:15:48 +0000</pubDate>
      <category domain="http://securityratty.com/tag/missouri national guard">missouri national guard</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/employee information">employee information</category>
      <category domain="http://securityratty.com/tag/sensitive information">sensitive information</category>
      <category domain="http://securityratty.com/tag/employees information receives">employees information receives</category>
      <category domain="http://securityratty.com/tag/details">details</category>
      <category domain="http://securityratty.com/tag/breach description">breach description</category>
      <source url="http://breachblog.com/2008/07/15/moguard.aspx">Very few details are available for Missouri National Guard breach</source>
    </item>
    <item>
      <title><![CDATA[Waukesha County job applicant data exposed in mailing]]></title>
      <link>http://securityratty.com/article/6efea251f53508bced1039830009ef31</link>
      <guid>http://securityratty.com/article/6efea251f53508bced1039830009ef31</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/13/08

Organization
Waukesha County, Wisconsin

Contractor/Consultant/Branch
Crivello Carlson, S.C

Victims
Job applicants from the year 2006

Number...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/waukesha.jpg" width="149" align="right" height="200"><font size="2"><b>Date Reported: </b><br>7/13/08<br><br><b>Organization: </b><br><a href="http://www.waukeshacounty.gov/">Waukesha County, Wisconsin</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.milwlaw.com/index.aspx">Crivello Carlson, S.C.</a> <br><br><span style="font-weight: bold;">Victims:</span><br>Job applicants from the year 2006<br><br><span style="font-weight: bold;">Number Affected:</span><br>"more than 130"<br><br><span style="font-weight: bold;">Types of Data:</span><br>Job applications including, names, addresses, job and education history, salary, and Social Security numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>"More than 130 people who applied for a job with Waukesha County in 2006 had their Social Security numbers, employment and salary information, addresses and phone numbers and other personal information released to one of the women who applied for the job. "<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.jsonline.com/story/index.aspx?id=772046">Milwaukee Journal Sentinel</a> <br><a href="http://www.newrichmond-news.com/articles/index.cfm?id=87905&amp;section=Wisconsin%20News&amp;property_id=19">New Richmond News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Raquel Rutledge, Milwaukee Journal Sentinel<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Taunya Thomas was horrified when she got a call from a stranger who knew almost everything about her.<br><br>The woman on the phone told Thomas she knew her Social Security number, where she lived and worked, how much money she made and where she went to high school and college. She rattled them off, not missing a single digit or fact.<br><br>She promised she wasn't going to use the information.<br><span style="font-style: italic;">[Evan] Yeah.&nbsp; The government body that exposed the information made the promise that "your Social Security number will remain confidential".&nbsp; So much for promises</span>.<br><br>She was calling, she said, because she wanted Thomas and others to know where she had gotten it.<br><br>She hadn't stolen it. <br><br>Waukesha County sent it to her in the mail, along with the same personal information for more than 130 other people who had all applied for a job with the county in 2006.<br><span style="font-style: italic;">[Evan] What's with Wisconsin and mailing confidential information (in error)?&nbsp; This is the third mailing error reported on The Breach Blog coming out of Wisconsin this year.</span><br><br>The woman on the phone, Bernadine Matthews, too had applied for the position as an economic support specialist.<br><br><img src="http://images.quickblogcast.com/95781-88451/matthews.jpg" width="324" border="0"><br><font size="1">This is Matthews displayed holding the applications.&nbsp; Source: Milwaukee Journal Sentinel</font><br><br>When she didn't get it, she filed a complaint with the Equal Employment Opportunity Commission.<br><br>As part of the complaint and the investigation, the EEOC requested copies of all the applications.<br><br>The law firm representing the county, Crivello Carlson, sent the applications to Matthews.<br><span style="font-style: italic;">[Evan] Really?&nbsp; Any second thoughts about the fact that this may put innocent people at risk?</span><br><br>Waukesha County tried to reclaim the documents sent to Matthews, threatening to get a search warrant and send a lawyer to her house, Matthews said.<br><br>When Matthews refused, they insisted she bring the documents to the law firm so they could white-out the private information in the applications.<br><br>Again, Matthews refused.<br><span style="font-style: italic;">[Evan] At what point does Matthews cross a line.&nbsp; The confidential information on those job applications does NOT belong to her.&nbsp; In my opinion, she has no right to maintain possession of the information.&nbsp; For Matthews to knowingly maintain information that does not belong to her almost seems criminal to me.</span><br><br>The applications would be critical to her discrimination suit, she thought.<br><span style="font-style: italic;">[Evan] So risk the disclosure of senstive information belonging to 130 people for your own benefit?&nbsp; If not criminal, it is certainly selfish.</span><br><br>She quickly hired an attorney, copied the documents and sent a set back to the county. She keeps her copies in an oversize safe-deposit box at her bank, she said.<br><span style="font-style: italic;">[Evan] Who authorized her to make copies?&nbsp; The data owners (victims) certainly did not.</span><br><br>"I'm not going to be like the county," Matthews said. "I'm going to protect the privacy of the information in this box. Obviously they didn't give a darn about the applicants' privacy."<br><br>The Waukesha County employment application specifically states it will protect Social Security numbers.<br><br>"Your Social Security Number will remain confidential and will not be copied or released but is required for applicant tracking purposes," the application reads.<br><br><a href="http://www.milwlaw.com/ourpeople/profile.aspx?id=285&amp;name=Raymond%20J.%20Pollen">Ray Pollen</a>, an attorney with Crivello Carlson, at first said it was no mistake that Matthews received the uncensored applications.<br><span style="font-style: italic;">[Evan] So Mr. Pollen sent the information on purpose.&nbsp; Did he stop to think that there might be a problem here?&nbsp; Did it occur to anyone that they should redact the most sensitive information such as Social Security numbers, or names?</span><br><br>He said it was required under federal law that all parties in an EEOC discrimination complaint receive copies of information requested by the agency investigating. He couldn't point to the specific provision.<br><span style="font-style: italic;">[Evan] Does a specific provision exist?&nbsp; I cannot think of a single purpose that a Social Security number would serve in this case.</span><br><br>Several days later, Pollen said the EEOC had no such requirement.<br><br>"The EEOC is silent on the issue," he said.<br><br>Instead it's the state's Equal Rights Division that requires all parties be copied on information requested by the division but even that provision doesn't mandate that attachments - such as the applications - be included. And, Matthew's case was not filed with the state.<br><br>"We followed the state's protocol," Pollen said.<br><br>P.I. asked: So anyone who applies for a job with Waukesha County could have their private information disclosed to a non-governmental third-party?<br>&nbsp;<br>Pollen answered: "We responded to a federal agency's request for information. . . . In my opinion there was no violation of any law or procedure."<br><span style="font-style: italic;">[Evan] Let's give Mr. Pollen the benefit of the doubt.&nbsp; Let's say that there was no violation of any law or procedure here.&nbsp; There certainly seems to be a violation of trust, a violation of good judgment, and a violation of privacy.&nbsp; The "if the law don't state it, then I must be able to do it" mentality is one of the reasons we have so many laws.&nbsp; Maybe if we used a little more common sense.</span><br><br>Taunya Thomas called the release of her information to a stranger shocking. She said at a minimum the county should have notified her that her information had been compromised.<br><br>"I'm devastated that it's that easy for my information to be disclosed," she said. "For someone to call me and tell me where I worked, where I went to school, recite my Social Security number verbatim to me, that's scary."<br><br><span style="font-weight: bold;">Commentary:</span><br>This is a very frustrating breach to read about.&nbsp; It is frustrating when someone knowingly discloses confidential information and then tries to justify it.&nbsp; Equally frustrating is when a person that has no right to the information refuses to part with it.&nbsp; In the middle of all of this are 130 innocent people.<br><br>I do not claim to know half as much about the law as Mr. Pollen does.&nbsp; His actions may be well within his legal rights for all I know. <br><br><b>Past Breaches:</b><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/15/waukesha.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 15 Jul 2008 04:07:06 +0000</pubDate>
      <category domain="http://securityratty.com/tag/job">job</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/county">county</category>
      <category domain="http://securityratty.com/tag/waukesha county">waukesha county</category>
      <category domain="http://securityratty.com/tag/senstive information">senstive information</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/sensitive information">sensitive information</category>
      <category domain="http://securityratty.com/tag/salary information">salary information</category>
      <source url="http://breachblog.com/2008/07/15/waukesha.aspx">Waukesha County job applicant data exposed in mailing</source>
    </item>
    <item>
      <title><![CDATA[Williamson County Schools learns of breach reported nine months ago]]></title>
      <link>http://securityratty.com/article/ab879007319944481d6c7e5668489293</link>
      <guid>http://securityratty.com/article/ab879007319944481d6c7e5668489293</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/11/08

Organization
Williamson County Schools

Contractor/Consultant/Branch
None

Victims
Students

3,052 ACT students and 2,117 students who took the...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/wcs.jpg" width="109" align="right" height="123"><font size="2"><b>Date Reported: </b><br>7/11/08<br><br><b>Organization: </b><br><a href="http://www.wcs.edu/">Williamson County Schools</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Students*<br><br><font size="1">*"3,052 ACT students and 2,117 students who took the second grade test were affected", Source: <a href="http://www.wcs.edu/student_information_conf.htm%20">Student Information News Conference Text 7/11/08</a><br></font> <br><span style="font-weight: bold;">Number Affected:</span><br>5,169<br><br><span style="font-weight: bold;">Types of Data:</span><br>Names, testing scores, and Social Security numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>"FRANKLIN, Tenn.- It now appears a security breach at Williamson County schools was much worse than expected. School officials now say more than 5,000 students may have been affected when a school employee accidently posted their personal information online."<br><br>Reference URL:<br><a href="http://www.wcs.edu/student_information_conf.htm">Williamson County Student Information News Conference</a> <br><a href="http://www.newschannel5.com/Global/story.asp?S=8662746">News Channel 5</a> <br><a href="http://www.wreg.com/Global/story.asp?S=8657599">WREG Channel 3 News</a> <br><a href="http://www.wsmv.com/news/16843341/detail.html#-">WSMV Channel 4 News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Liberty Coalition<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>FRANKLIN, Tenn.- It now appears a security breach at Williamson County schools was much worse than expected. School officials now say more than 5,000 students may have been affected when a school employee accidently posted their personal information online.<br><br>Now the county could lose some federal funding because of the mistake.<br><span style="font-style: italic;">[Evan] Do you really think that this will happen?&nbsp; If we looked deeper into the way the public school systems handle confidential information, half of the school districts would lose funding.&nbsp; Williamson County is in good company across the country.</span><br style="font-style: italic;"><br>The school district had to notify the Department of Education because this was a federal violation.<br><br>Director of Schools, Rebecca Sharber is taking on the responsibility of fixing the problem.<br><br>"I'm the head of the school system. I'm accountable," said Sharber.<br><span style="font-style: italic;">[Evan] What a fantastic statement.&nbsp; Corporate CEOs, non-profit executive directors, etc. ARE ultimately responsible for the protection of information.&nbsp; Ms. Sharber just earned my respect.</span><br style="font-style: italic;"><br>"It certainly is distressing to me that information was ever out there," said Sharber.<br><br>According to school officials, former assessment specialist, Chris Nugent is responsible for the computer mix-up.<br><br>He resigned Friday.<br><br>"Mr. Nugent has resigned his position as Assessment Specialist, effective immediately."<br><br>It was August last year when Nugent mistakenly loaded the info on a personal web page, but he never alerted the district.<br><br>They only found out a couple of weeks ago.<br><br>"A principal who had been contacted by a parent brought this to our attention on June 26th."<br><br>"The information given to us indicated that our assessment specialist, Chris Nugent, was involved. This was the first we had heard of this situation."<br><br>"We began our investigation immediately asking Mr. Nugent to gather all data that could possibly be associated with this situation."<br><br>"We thought at that time he would be able to supply the names of students possibly involved in the most timely manner."<br><br>"When Mr. Nugent was unable to get that information for us, our attorney Jason Golden contacted the Liberty Coalition, the organization that had posted the Internet report presented to us by the principal."<br><span style="font-style: italic;">[Evan] The Liberty Coalition posted the information surrounding the breach in October, 2007, many months before the victims were ever made aware.</span><br style="font-style: italic;"><br>"Yesterday afternoon, the Liberty Coalition was able to provide the names of the students affected."<br><br>"Our investigation indicates that the student information was posted on a private website created by Mr. Nugent sometime during the month of August, 2007."<br><br>"On August 28, 2007, the Liberty Coalition notified Mr. Nugent that private student information was on his web site."<br><br>"On August 29, 2007, the web site was shut down."<br><br>"Mr. Nugent did not notify school authorities."<br><br>"Our investigation has established that Mr. Nugent had confidential student files on the same thumb-drive with his personal files."<br><br>"We believe that when Mr. Nugent uploaded his personal files to a web site he created, he inadvertently uploaded our student files."<br><br>Sharber said the first step will be to look at revising policies on student information.<br><br>They will also pay for fraud alerts for the students.<br><br>It could cost the district hundreds of thousands of dollars to pay for those fraud alerts.<br><br>"I would say to other school districts they need to really, really check their policies and procedures on how student data is being used," said Sharber.<br><span style="font-style: italic;">[Evan] Again, did I mention that I respect Ms. Sharber?&nbsp; This statement is very good advice.</span><br><br>More than 5,000 students had their security information posted.<br><br>Most of those are high school students who took the ACT in the 2006-2007 school year, and second graders who took the TCAP the same year.<br><br>"We have learned that most students who took the second grade TCAP achievement test and most students who took the ACT test during the 2006-07 school year had social security numbers on a private website during August of 2007."<br><span style="font-style: italic;">[Evan] Is there some kind of legal requirement that states that a Social Security number must be tied to test scores, or was this just poor judgment?&nbsp; Are/were Social Security numbers used as student IDs at the district?</span><br style="font-style: italic;"><br>"Our review of the records shows that 3,052 ACT students and 2,117 students who took the second grade test were affected."<br><br>The information was on the internet for about a month.<br><br>"I want to thank the parents of Williamson County Schools for their patience and understanding and the positive suggestions they have shared as we have conducted our investigation and gone public with this information.", said Sharber<br><span style="font-style: italic;">[Evan] The Liberty Coalition went public with </span><a style="font-style: italic;" href="https://www.ssnbreach.org/release.php?g=13">this breach</a><span style="font-style: italic;"> in October, 2007.&nbsp; I appreciate the motives of the Liberty Coalition, but I am not pleased with the way they report breaches.&nbsp; I'll elaborate below in the commentary section.</span><br style="font-style: italic;"><br>"I understand the anxiety that our parents are experiencing.", said Sharber<br><br>"On Monday, we will be calling all parents of students whose social security numbers were exposed to let them know their child was affected, and we will follow up that phone call with a letter."<br><br>"We are working to locate a security company, and at our expense, we will cover the cost of fraud protection for the students affected."<br><span style="font-style: italic;">[Evan] I hope that the school locates a good "security company".&nbsp; Of course </span><a style="font-style: italic;" href="http://www.frsecure.com">FRSecure</a><span style="font-style: italic;"> would be glad to help.&nbsp; I promise to keep the plugs to a minimum <img src="http://breachblog.com/emoticons/smile.png" border="0" />.</span><br style="font-style: italic;"><br><span style="font-weight: bold;">Commentary:</span><br>OK.&nbsp; We all know that a breach affecting kids is especially bad.&nbsp; We all know that we are all human and all humans make mistakes.&nbsp; I presume that there are a number of risky information security behaviors at Williamson County Schools.&nbsp; This risky behavior just so happened to expose personal information online.&nbsp; What other risky behaviors will be addressed at the school district?<br><br>Now about the Liberty Coalition's role.&nbsp; I appreciate the motives of Aaron Titus and the Liberty Coalition.&nbsp; He maintains the SSNBreach.org web site where he publicizes information security breaches that his organization finds (or is informed about).&nbsp; My attention was first drawn to Aaron Titus in August 2007, when he reported the <a href="https://www.ssnbreach.org/release.php?g=1">Louisiana Board of Regents breach</a> affecting ~200,000 people.&nbsp; What drew my attention to his report was not the breach itself, but the way in which it he proceeded to report it.&nbsp; Lyger at Attrition.org covers it well <a href="http://attrition.org/security/rant/z/privacy.html">here</a>.<br><br>In this case, the Liberty Coalition publicly posted this breach in October, 2007 which is more than 9 months before the victims were ever made aware!&nbsp; According to the Liberty Coalition press release; "We updated this press release after becoming aware of Mr. Nugent's relationship with the school district. The Liberty Coalition also worked directly with district officials to help them notify the affected individuals."&nbsp; It would have been nice if the victims were notified prior to a public press release.&nbsp; I wonder why Mr. Nugent's relationship with the school district wasn't known earlier.&nbsp; I don't have the details that the Liberty Coalition does surrounding this breach, so I can only speculate.<br><br>The fact that some breaches are reported on SSNBreach.org prior to notification (in this case nine months), I chose to generally not report them here at The Breach Blog. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/12/wcs.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Sat, 12 Jul 2008 20:12:01 +0000</pubDate>
      <category domain="http://securityratty.com/tag/school">school</category>
      <category domain="http://securityratty.com/tag/school students">school students</category>
      <category domain="http://securityratty.com/tag/schools">schools</category>
      <category domain="http://securityratty.com/tag/williamson county schools">williamson county schools</category>
      <category domain="http://securityratty.com/tag/williamson county">williamson county</category>
      <category domain="http://securityratty.com/tag/county">county</category>
      <category domain="http://securityratty.com/tag/breach">breach</category>
      <category domain="http://securityratty.com/tag/school authorities">school authorities</category>
      <category domain="http://securityratty.com/tag/school district">school district</category>
      <source url="http://breachblog.com/2008/07/12/wcs.aspx">Williamson County Schools learns of breach reported nine months ago</source>
    </item>
    <item>
      <title><![CDATA[Fort Lewis soldiers exposed by laptop theft]]></title>
      <link>http://securityratty.com/article/fd0ce367aedf3e489eb5d0a155241be5</link>
      <guid>http://securityratty.com/article/fd0ce367aedf3e489eb5d0a155241be5</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/9/08 (UPDATED 7/11/08 - Laptop with information about soldier found; Lacey teen arrested

Organization
United States Army
...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/usarmy.jpg" width="88" align="right" height="119"><font size="2"><b>Date Reported: </b><br>7/9/08 (UPDATED 7/11/08 - </font><a href="http://www.theolympian.com/377/story/504243.html">Laptop with information about soldier found; Lacey teen arrested</a>)<br><font size="2"><br><b>Organization: </b><br><a href="http://www.army.mil/">United States Army</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br><a href="http://www.lewis.army.mil/index.asp">Fort Lewis</a>*<br><font size="1"><br>*The principal Fort Lewis maneuver units are the 1st Brigade, 25th Infantry Division and the 3d Brigade, 2nd Infantry Division. It is also home to the 593d Corps Support Group, the 555th Engineer Group, the 1st MP Brigade (Provisional), the I Corps NCO Academy, Headquarters, Fourth ROTC Region, the 1st Personnel Support Group, 1st Special Forces Group (Airborne), 2d Battalion (Ranger), 75th Infantry, and Headquarters, 5th Army (West).&nbsp; Fort Lewis has more than 25,000 soldiers and civilian workers, source: <a href="http://www.lewis.army.mil/about-ft-lewis.asp">About Fort Lewis</a> </font><br><br><span style="font-weight: bold;">Victims:</span><br>Soldiers<br><br><span style="font-weight: bold;">Number Affected:</span><br>~800 - 900<br><br><span style="font-weight: bold;">Types of Data:</span><br>"personal information"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"A laptop computer that was reported stolen from an Army employee’s truck last week contained personal information on about 800 to 900 Fort Lewis soldiers, said military and Lacey police officials."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.king5.com/localnews/stories/NW_070808WAB_soldiers_ID_theft_KC.3e0bcdc6.html">KING Channel 5 News</a> <br><a href="http://www.thenewstribune.com/news/local/story/409911.html">Tacoma News</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Elisa Hahn, KING Channel 5 News<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>A laptop computer that was reported stolen from an Army employee’s truck last week contained personal information on about 800 to 900 Fort Lewis soldiers, said military and Lacey police officials.<br><br>In this case, an Army employee told Lacey police he left the laptop and a 500-gigabyte removable hard drive on the seat of his Dodge truck, parked unlocked in front of his house overnight July 3<br><span style="font-style: italic;">[Evan] Storing personal information on removable devices such as laptops, external hard drives and flash drives without encryption, strike one.&nbsp; Moving the mobile device outside of a controlled area is strike two.&nbsp; Leaving the mobile device overnight in an unlocked vehicle in plain sight of passers-by is an emphatic strike three.</span><br><br>He reported them stolen about 10 a.m. on July 4.<br><span style="font-style: italic;">[Evan] A soldier's personal information stolen on the day our country celebrates our independence is insulting.</span><br><br>A post spokeswoman said officials were notifying the involved soldiers out of concern that the case might put them at risk for identity theft.<br><br>the Army began no later than Wednesday notifying the affected soldiers through e-mail and phone calls. They’ll get follow-up letters.<br><br>Officials said the employee, a civilian military personnel specialist, appears to have violated Army standards and policies for protecting personal information and government property.<br><br>Army laptops and removable storage devices containing personal information are generally restricted to on-post workplaces but can be signed out with a supervisor’s permission.<br><br>They’re also supposed to be password-protected and personal information is supposed to be encrypted<br><br>The Army is assisting Lacey police with the theft investigation and conducting its own review, said Catherine Caruso, a Fort Lewis spokeswoman.<br><br>"We’re not releasing anything more about what information was inappropriately compromised or about the soldiers whose information was involved," Caruso said.<br><br>"Clearly it was personal information regarding 800 to 900 soldiers from Fort Lewis. Beyond that, we’d rather not specify."<br><br>there was no classified, secret or top-secret information on the laptop and the hard drive.<br><br>Caruso said the employee was working on a project regarding a particular unit at a location other than his office.<br><br>She said "it would be inappropriate to speculate" about what potential disciplinary action the worker might face if he is found to have broken security rules.<br><span style="font-style: italic;">[Evan] It is probably inappropriate to speculate, but you know we will anyway.&nbsp; My guess is that there is another person looking for a job in the Olympia, Washington area.</span><br><br>Since the theft, post officials have set new training requirements for military personnel staff and prepared a memo for each employee to sign outlining the safeguarding and reporting requirements<br><br><span style="font-weight: bold;">Commentary:</span><br>When someone's poor judgment creates unnecessary risk to military personnel it carries a little more weight for me.&nbsp; These men and women give everything to protect us.&nbsp; Without them I wouldn't be able to write this, and without them you wouldn't be able to read it. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>United States Army:<br>June, 2008 - <a href="http://breachblog.com/2008/06/03/walterreed.aspx">Walter Reed Army Medical Center breach through P2P</a> <br>April, 2008 - <a href="http://breachblog.com/2008/04/13/usaasc.aspx%20">Excel Spreadsheet on the web exposes Army officers and civilians</a> <br><br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/11/usarmy.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Fri, 11 Jul 2008 09:44:02 +0000</pubDate>
      <category domain="http://securityratty.com/tag/fort lewis soldiers">fort lewis soldiers</category>
      <category domain="http://securityratty.com/tag/soldiers">soldiers</category>
      <category domain="http://securityratty.com/tag/fort lewis">fort lewis</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/lacey police officials">lacey police officials</category>
      <category domain="http://securityratty.com/tag/officials">officials</category>
      <category domain="http://securityratty.com/tag/army">army</category>
      <category domain="http://securityratty.com/tag/army standards">army standards</category>
      <source url="http://breachblog.com/2008/07/11/usarmy.aspx">Fort Lewis soldiers exposed by laptop theft</source>
    </item>
    <item>
      <title><![CDATA[Employee fraud hits Baptist Health in Arkansas]]></title>
      <link>http://securityratty.com/article/4227f770b7017f7d953c43516b49d951</link>
      <guid>http://securityratty.com/article/4227f770b7017f7d953c43516b49d951</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/2/08

Organization
Baptist Health

Baptist Health is the largest not-for-profit healthcare organization in Arkansas

Contractor/Consultant/Branch
None...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/baptisthealth.jpg" width="120" align="right" height="274"><font size="2"><b>Date Reported: </b><br>7/2/08<br><br><b>Organization: </b><br><a href="http://www.baptist-health.org/">Baptist Health*</a><br><br><font size="1">*Baptist Health is the largest not-for-profit healthcare organization in Arkansas</font><br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Patients<br><br><span style="font-weight: bold;">Number Affected:</span><br>~1,800<br><br><span style="font-weight: bold;">Types of Data:</span><br>"name, address, date of birth, Social Security number, and reason for coming to Baptist Health"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"LITTLE ROCK (AP) - A North Little Rock woman has been arrested for using financial information from patients at Baptist Health to illegally obtain Wal-Mart gift cards for her own use. The hospital has notified about 1,800 patrons of the ID theft."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://www.wxvt.com/Global/story.asp?S=8609129&amp;nav=menu1344_2">Associated Press via WXVT Channel 15 News</a> <br><a href="http://arkansasmatters.com/content/fulltext/news/?cid=80211">KARK Channel 4 News</a> <br><a href="http://www.nwanews.com/adg/News/230290/">Arkansas Democrat-Gazette</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>Toby Manthey, Arkansas Democrat-Gazette<br><br><span style="font-weight: bold;">Response:</span><br>From the online sources cited above:<br><br>Baptist Health has sent letters warning about 1,800 patients that the hospital system’s records may have been breached<br><span style="font-style: italic;">[Evan] Uh, "may have been breached"?!</span><br><br>The notification came after the arrest of a Baptist Health employee at a Wal-Mart store on 25 counts of financial identity fraud.<br><span style="font-style: italic;">[Evan] Wouldn't life be grand if we could trust our employees?&nbsp; Maybe, I suppose.</span><br><br>The letters, mailed last week, follow the firing of the woman in early June<br><br>North Little Rock police say Tamara Hill, 30, of that city worked at Baptist Health Medical Center-North Little Rock in the emergency department.<br><br>Hill, an admissions clerk, was arrested May 30 at the Wal-Mart<br><br>Ebony Flowers, 25, also of North Little Rock, was arrested at the store the same day on three counts of identity fraud<br><br>Flowers was listed in a police report as a janitor for the North Little Rock School District<br><span style="font-style: italic;">[Evan] Key word is "was".</span><br><br>Baptist Health recorded more than 950,000 patient visits systemwide in 2007, a number that includes repeat visits.<br><br>Mark Lowman, spokesman for the Little Rock-based Baptist Health system, confirmed that the system fired the employee after notification of the arrest.<br><br>Police reports say the women used a victim’s personal information to obtain temporary Wal-Mart "account authorization numbers" - credit cards, essentially - used to buy Wal-Mart gift cards.<br><br>The victim reported to police that he had not authorized the transactions<br><br>the same victim confirmed he was a Baptist Health patient<br><br>He expressed appreciation of the handling of the case by the system and by the North Little Rock police. <br><br>Among the items found during a search connected with the arrest of Hill was personal information for 24 other people, including "screen shots" - printouts showing the exact appearance of the images on a computer screen - that showed victims’ personal information.<br><span style="font-style: italic;">[Evan] This seems like confirmation that "may have been breached" is not all that accurate.</span><br><br>Also found were four Wal-Mart gift cards and $ 1,490 in cash<br><br>Police found a small bag of marijuana on Flowers, according to the reports. In a search connected with her arrest, they also discovered a. 25-caliber magazine with six bullets, as well as a receipt for four of the gift cards and information on three-identity theft victims.<br><span style="font-style: italic;">[Evan] A thug.</span><br><br>The U. S. Secret Service is helping with the investigation. <br><br>"Due to a breach of our information systems security policies, there is a possibility that some personal information, such as your name, address, date of birth, Social Security number, and reason for coming to Baptist Health, was accessed by an unauthorized person."<br><span style="font-style: italic;">[Evan] This is from the letter to the victims.</span><br><br>No information in the patient’s "medical records" and no information about the patient’s diagnosis or prognosis was accessed<br><br>while no "medical record" information was accessed, the letter mentioned the patient’s "reason for coming" to the system possibly was accessed<br><br>Lowman said a reason stated by a patient using the system isn’t considered medical information because the reason is a layman’s explanation, not one from a medical professional.<br><span style="font-style: italic;">[Evan] This is Mark Lowman, spokesman for the Little Rock-based Baptist Health system</span><br><br>He said the breach wouldn’t violate the Health Insurance Portability and Accountability Act, or HIPAA. <br><br>But Pam Dixon, executive director of the San Diego-based World Privacy Forum, a privacy advocacy group, thinks all the information mentioned in the letter falls under HIPAA.<br><br>"It doesn’t matter that [it’s not ] a prognosis or diagnosis," she said. <br><span style="font-style: italic;">[Evan] Splitting hairs.&nbsp; The bottom line is that confidential personal information was stolen and there are victims.&nbsp; Whether or not it is a HIPAA violation seems somewhat irrelevant.</span><br><br>Dixon found the system’s letter lacking in several respects, such as clarifying the exact meaning of a "reason for coming to Baptist Health." The letter also should have mentioned when and for how long the breach occurred, she said.<br><br>"Almost all breach letters have that," Dixon added.<br><span style="font-style: italic;">[Evan] Almost all breach letters have what?&nbsp; A mention about for how long the breach occurred?&nbsp; I must be reading some of the wrong breach letters because it seems to me that this information is 50/50 at best.&nbsp; Also missing is the "we have no reason to believe that the information will be misused", but this one doesn't fit does it?</span><br><br>Dixon said Baptist Health should have offered in the letter to set up free credit monitoring for victims.<br><span style="font-style: italic;">[Evan] Why?&nbsp; One year (or two) of credit monitoring is almost useless.&nbsp; Credit monitoring alerts a victim after fraud has already occurred and one year (or two) of monitoring is too limited for information that has a much longer lifespan.&nbsp; I guess credit monitoring would be better than nothing, but not by much.</span><br><br>Lowman said the health system continually conducts audits to know which staff members are accessing what information, and whether or not the access is appropriate.<br><span style="font-style: italic;">[Evan] Good!</span><br><br>"We’re always looking to provide better audits and better oversight of private, confidential and protected information," Lowman said.<br><span style="font-style: italic;">[Evan] And Good!</span><br><br><span style="font-weight: bold;">Commentary:</span><br>Preventing and detecting employee fraud has always been a challenge.&nbsp; This doesn't mean we give up though.&nbsp; We have some tools at our disposal such as employee background checks, role-based access control, segregation of duties, and job rotation to name a few.<br><br>I don't think that these two crooks are anything more than common criminals.&nbsp; The fact of the matter is that identity theft and fraud are very easy crimes to commit and require very little skill. <br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/10/baptisthealth.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Thu, 10 Jul 2008 20:00:20 +0000</pubDate>
      <category domain="http://securityratty.com/tag/confidential personal information">confidential personal information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/baptist health system">baptist health system</category>
      <category domain="http://securityratty.com/tag/health system">health system</category>
      <category domain="http://securityratty.com/tag/fraud">fraud</category>
      <category domain="http://securityratty.com/tag/victims personal information">victims personal information</category>
      <category domain="http://securityratty.com/tag/employee fraud">employee fraud</category>
      <category domain="http://securityratty.com/tag/baptist health">baptist health</category>
      <category domain="http://securityratty.com/tag/employee">employee</category>
      <source url="http://breachblog.com/2008/07/10/baptisthealth.aspx">Employee fraud hits Baptist Health in Arkansas</source>
    </item>
    <item>
      <title><![CDATA[Houghton Mifflin Harcourt server breach leads to notification]]></title>
      <link>http://securityratty.com/article/a32c42499f84224830293f2af83d152f</link>
      <guid>http://securityratty.com/article/a32c42499f84224830293f2af83d152f</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
7/1/08

Organization
Houghton Mifflin Harcourt (&quot;HMH

Contractor/Consultant/Branch
None

Victims
individuals affiliated with Harcourt Trade

Number...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/hmh.jpg" width="200" align="right" height="44"><font size="2"><b>Date Reported: </b><br>7/1/08<br><br><b>Organization: </b><br><a href="http://www.hmco.com/indexf.html">Houghton Mifflin Harcourt ("HMH")</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>"individuals affiliated with Harcourt Trade"<br><br><span style="font-weight: bold;">Number Affected:</span><br>194<br><br><span style="font-weight: bold;">Types of Data:</span><br>Social Security numbers<br><br><span style="font-weight: bold;">Breach Description:</span><br>"Houghton Mifflin Harcourt (HMH), a publishing company based in Boston, will begin notifying individuals whose information may have been compromised by a worldwide Internet-based attack that affected one of its websites."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://doj.nh.gov/consumer/pdf/wilmerhale.pdf">New Hampshire State Attorney General breach notification</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>The New Hampshire State Attorney General<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>Houghton Mifflin Harcourt (HMH), a publishing company based in Boston, will begin notifying individuals whose information may have been compromised by a worldwide Internet-based attack that affected one of its websites.<br><span style="font-style: italic;">[Evan] A "worldwide Internet-based attack" sounds impressive.&nbsp; In order for an attack to be successful, a vulnerability must be exploited.&nbsp; I wonder what the vulnerability was.</span><br><br>On April 25, 2008, HMH's Information Security group learned of a worldwide Internet-based attack that affected one of its non-e-commerce websites.<br><br>Within minutes, HMH took steps to secure the affected databases.<br><br>HMH has reported this matter to the U.S. Secret Service and state law enforcement, who are actively investigating the incident.<br><span style="font-style: italic;">[Evan] I question how "actively" the U.S. Secret Service is investigating this incident.&nbsp; The incident doesn't seem to be significant enough.&nbsp; Sad but usually true.&nbsp; The Secret Service has to prioritize just like everyone else.</span><br><br>As part of its internal investigation, which is still ongoing, HMH retained digital forensics experts to collect and analyze data from the relevant computer systems.<br><span style="font-style: italic;">[Evan] The attack was detected on April 25th (not necessarily originated on this date), and the notification went out to the New Hampshire State Attorney General on June 1st.&nbsp; This is a long forensic investigation!&nbsp; I also noticed that this statement mentions "computer systems".&nbsp; Does this mean that more than one server was compromised?</span><br><br>They have determined that social security numbers of approximately 194 individuals affiliated with Harcourt Trade, 2 of whom are New Hampshire residents, were in a company database on the affected computer server, and may have been compromised as a result.<br><span style="font-style: italic;">[Evan] I don't like the "may have been" portion of this statement.&nbsp; My definition of compromise probably differs though.</span><br><br>HMH has no evidence to date to suggest that the data has been misused.<br><br>Although we do not know whether any of your information has been misused, we are committed to doing what we can to make sure support is available to you<br><br>Since learning of the incident, HHM [sic] has:<br></font><ol><li><font size="2">Reported this matter to the U.S. Secret Service and state law enforcement;</font></li><li>Cooperated with law enforcement, which is actively investigating the incident;</li><li>Conducted a thorough investigation of the incident, including an assessment of whether or not the theft created any prospective data security risk;</li><li>Identified the sensitive personal information about individuals stored on the affected server; and</li><li>Made arrangements to notify affected individuals about the incident in accordance with state laws, offer premium credit monitoring, ID theft insurance, and ID theft resolution services, and provide additional information about prevention and detection of ID theft including information about credit alerts and credit freezes.<br></li></ol><font size="2"><br>HMH is continuing to work with information security professionals to review current policies and procedures to identify steps that can be taken to better protect against incidents of this kind.<br><br>We apologize and deeply regret that this happened.<br><br>I have asked our editors to reach out directly to everyone affected by this matter and I hope they will be or already have been able to answer your questions.<br><span style="font-style: italic;">[Evan] This is a nice touch.&nbsp; The letter to the affected persons was signed by Gary Gentel, President or Houghton Mifflin Harcourt Publishing Company, Trade and Reference Division.</span><br><br><span style="font-weight: bold;">Commentary:</span><br>There aren't many publicly available details available other than those outlined in the breach notification, so we are left to speculate.&nbsp; Why was a server that contained a database of Social Security numbers available to this "worldwide Internet-based attack"? <br><br><b>Past Breaches:</b><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/08/hmh.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Tue, 08 Jul 2008 08:22:09 +0000</pubDate>
      <category domain="http://securityratty.com/tag/houghton mifflin harcourt">houghton mifflin harcourt</category>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/information security professionals">information security professionals</category>
      <category domain="http://securityratty.com/tag/sensitive personal information">sensitive personal information</category>
      <category domain="http://securityratty.com/tag/information security">information security</category>
      <category domain="http://securityratty.com/tag/server">server</category>
      <category domain="http://securityratty.com/tag/notification">notification</category>
      <category domain="http://securityratty.com/tag/hmh">hmh</category>
      <category domain="http://securityratty.com/tag/company based">company based</category>
      <source url="http://breachblog.com/2008/07/08/hmh.aspx">Houghton Mifflin Harcourt server breach leads to notification</source>
    </item>
    <item>
      <title><![CDATA[Laptop containing personal information is stolen from U.S. Foodservice]]></title>
      <link>http://securityratty.com/article/75e76f13934090aa771da66fbd1be73c</link>
      <guid>http://securityratty.com/article/75e76f13934090aa771da66fbd1be73c</guid>
      <description><![CDATA[Technorati Tag: Security Breach

Date Reported
6/13/08

Organization
U.S. Foodservice, Inc

Contractor/Consultant/Branch
None

Victims
Present and former employees, &quot;and in a few instances, their...]]></description>
      <content:encoded><![CDATA[Technorati Tag: <a href="http://technorati.com/tag/security+breach" rel="tag">Security Breach</a><br><br>
<img src="http://breachblog.com/images/95781-88451/usfoodservice.jpg" width="146" align="right" height="71"><font size="2"><b>Date Reported: </b><br>6/13/08<br><br><b>Organization: </b><br><a href="http://www.usfoodservice.com/usf/html/index1.html">U.S. Foodservice, Inc.</a> <br><br><span style="font-weight: bold;">Contractor/Consultant/Branch:</span><br>None<br><br><span style="font-weight: bold;">Victims:</span><br>Present and former employees, "and in a few instances, their dependents and applicants for jobs at USF"<br><br><span style="font-weight: bold;">Number Affected:</span><br>Unknown<br><br><span style="font-weight: bold;">Types of Data:</span><br>"names, social security numbers, home addresses, and/or dates of birth"<br><br><span style="font-weight: bold;">Breach Description:</span><br>"We were informed recently of the theft of a U.S. Foodservice, Inc. ("USF") laptop computer, which contained sensitive personnel information."<br><br><span style="font-weight: bold;">Reference URL:</span><br><a href="http://doj.nh.gov/consumer/pdf/us_foodservice.pdf">New Hampshire State Attorney General breach notification</a> <br><br><span style="font-weight: bold;">Report Credit:</span><br>The New Hampshire State Attorney General<br><br><span style="font-weight: bold;">Response:</span><br>From the online source cited above:<br><br>We were informed recently of the theft of a U.S. Foodservice, Inc. ("USF") laptop computer, which contained sensitive personnel information.<br><span style="font-style: italic;">[Evan] We now add U.S. Foodservice to the ever-growing list of organizations that refuse to encrypt laptops, yet allow confidential information to be stored on them.</span><br><br>Local authorities were immediately notified and we conducted an internal investigation.<br><br>the laptop contained certain old data files<br><span style="font-style: italic;">[Evan] I wonder how old these data files were.&nbsp; I also wonder if these files were supposed to have been removed and/or destroyed, but were missed.</span><br><br>In the course of our investigation, we determined that the laptop computer contained the names, social security numbers, home addresses, and/or dates of birth of some present and former USF employees, and in a few instances, their dependents and applicants for jobs at USF.<br><br>We are sending a notification letter to individuals impacted by this incident.<br><br>We expect to begin mailing the notification letters on June 13, 2008.<br><br>we have no indication that any of the information is being misused<br><span style="font-style: italic;">[Evan] A breach notification is almost not a real breach notification without this mention.</span><br><br>Please note that several years ago, the Company stopped using social security numbers to identify employees for internal reporting or other purposes.<br><span style="font-style: italic;">[Evan] A good move by the Company.&nbsp; USF is still required to collect Social Security numbers however.</span><br><br>Pursuant to USF policies, the laptop was protected by a unique user ID and password, but the individual files containing personal information were not encrypted or password protected.<br><span style="font-style: italic;">[Evan] I am interested in reading the USF policies.&nbsp; Do the policies only require a user ID and password to protect (or access) confidential information?&nbsp; Probably not sufficient.</span><br><br>U.S. Foodservice takes the security of your personal information seriously and apologizes for any inconvenience or worry this incident may cause you.<br><br>As a precautionary measure, we are making several services available at the Company's expense, free of charge to you, to assist you in protecting your identity.<br><span style="font-style: italic;">[Evan] A true "precautionary measure" might have been restricting confidential information storage on laptops (and other mobile media) or encryption.</span><br><br>Although at this point we have no indication that your information has been compromised<br><span style="font-style: italic;">[Evan] My definition of "compromised" obviously differs.&nbsp; In my opinion, if the confidentiality, integrity or availability of information cannot be reasonable assured, then the information IS compromised.&nbsp; If you believe that password-protection provides reasonable assurance, then you and I disagree.</span><br><br>Call the Toll Free Help Line at 1-866-584-9681 to get answer [sic] to your questions.<br></font><ul><li><font size="2">Staffed by a team of professionals</font></li><li>Monday through Friday from 6:00 a.m. to 6:00 p.m. (Pacific Daylight Time)</li><li>Saturday and Sunday from 8:00 a.m. to 5:00 p.m. (Pacific Daylight Time)<br></li></ul><font size="2"><br>Please know that while we have information security policies in place, we are reviewing those practices and procedures to see what changes need to be made.<br><span style="font-style: italic;">[Evan] Its good the USF has information security policies in place, but it doesn't mean that they are effective or that they are well enforced.&nbsp; A poorly enforced policy isn't worth the paper its written on.</span><br style="font-style: italic;"><br><span style="font-weight: bold;">Commentary:</span><br>U.S. Foodservice is also offering one year of free credit monitoring and identity theft insurance.&nbsp; This would be fine minus the fact that a Social Security number has an effective lifespan that far exceeds one year.<br><br>If only there were other controls available to protect information stored on a laptop.&nbsp; Wait, we do!<br>&nbsp;<br><br><span style="font-weight: bold;">Past Breaches:</span><br>Unknown<br></font><br>
<script src="http://feeds.feedburner.com/%7Es/breachblog?i=http://breachblog.com/2008/07/05/usfoodservice.aspx" type="text/javascript" charset="utf-8"></script>]]></content:encoded>
      <pubDate>Mon, 07 Jul 2008 19:35:13 +0000</pubDate>
      <category domain="http://securityratty.com/tag/information">information</category>
      <category domain="http://securityratty.com/tag/personal information">personal information</category>
      <category domain="http://securityratty.com/tag/confidential information">confidential information</category>
      <category domain="http://securityratty.com/tag/protect information">protect information</category>
      <category domain="http://securityratty.com/tag/information security policies">information security policies</category>
      <category domain="http://securityratty.com/tag/usf">usf</category>
      <category domain="http://securityratty.com/tag/usf policies">usf policies</category>
      <category domain="http://securityratty.com/tag/policies">policies</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <source url="http://breachblog.com/2008/07/07/usfoodservice.aspx">Laptop containing personal information is stolen from U.S. Foodservice</source>
    </item>
    <item>
      <title><![CDATA[U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar]]></title>
      <link>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</link>
      <guid>http://securityratty.com/article/a494b708fadf3d4f453c6495d8064dc2</guid>
      <description><![CDATA[Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense...]]></description>
      <content:encoded><![CDATA[<p>
Former congressman Curt Weldon is helping broker deals between Russian and Ukranian weapons suppliers and the Iraqi and Libyan governments as part of his new job with a private American defense consulting firm, Wired.com has learned. 
</p>

<p>
Weldon, who is currently being investigated by the FBI over alleged corruption during his time in office, visited Libya in March to discuss a possible military deal, according to a letter describing the trip from Weldon to <a href="http://www.ds-pa.com/">Defense Solutions</a> CEO Timothy Ringgold. In May, Weldon, together with Ringgold and another company representative, traveled to Moscow to discuss working with Russia's weapons-export agency on arms sales to the Middle East.
</p>

<p>
Both trips were part of the company's effort to tap into the growing -- and often legally murky -- market for selling weapons from former Eastern Bloc countries to the Middle East and Afghanistan.
</p>



<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 250px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/weldon_350px.jpg" width="250px" alt="Curt Weldon">

<div id="caption">

Ex-Rep. Curt Weldon, R-Penn., is helping broker deals between Russian weapons suppliers and the Iraqi and Libyan governments through his company, Defense Solutions.<br />
<em>Photo: H. Rumph Jr/AP</em>

</div> 

</div>

<p>
The Russians want to sell weapons to Iraq directly, but "must go slow on Iraq because of political reasons" and want to work with an "intermediary" like Defense Solutions, CEO Ringgold subsequently wrote to colleagues. "They have not spoken with any American company that can offer the quid pro quo that we can or that has the connections in Russia that we have," he boasted.
</p>



<p>
A few years ago, an American company proposing to sell weapons to Libya might have triggered a congressional hearing. So, too, would have a proposal to conduct arms deals with Russia, which the United States has accused of selling high-tech weapons to Syria and Iran. 
</p>

<p>However, U.S. government efforts to rapidly equip countries like Afghanistan and Iraq -- which have largely Soviet-origin weapons -- have created legal ambiguities and loopholes in export controls that didn't exist in years past and given rise to a new class of arms trade middlemen. So, even though both Libya and the Russian arms export agency are on official U.S. blacklists, government officials and analysts involved in weapons sales say the rules have become unclear as the push to equip allies in the global war on terror has blazed new but uncertain legal ground. 
</p>




<p>
Eagerly stepping into that virgin territory is <a href="http://www.ds-pa.com/">Defense Solutions</a>, a Pennsylvania-based company that is carving out a small but lucrative niche in a new international arms bazaar. The firm boasts as its advisors a number of influential Washington insiders, such as retired General Barry McCaffrey, the former White House drug czar.
</p>

<p>
Helping the firm make key connections is Curt Weldon, a former Republican congressman from Pennsylvania at the center of an FBI investigation into alleged conflicts of interest during his time in office.  Weldon, now a key executive at Defense Solutions, is working with the company to set up these weapons deals.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/btr_60_350px.jpg" alt="">

<div id="caption">

Defense Solutions has also proposed refurbishing Libya's BTR-60 armored personnel carriers, according to a sales proposal seen by Wired.com. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
It's an unusual, if not an entirely unexpected chapter for Weldon, whose time in office included frequent trips to Russia. As an influential member of the House Armed Services Committee, Weldon pushed for multibillion-dollar defense programs, like ballistic missile defense, and earned a reputation as a foreign policy gadfly, boasting of his contacts with officials in nations labeled by the administration as "rogue states" such as Libya and North Korea. Weldon's wild claims about a 9/11 cover-up and his sensationalist book warning of an Iranian terror plot, sometimes earned him official scorn and public ridicule, but it was accusations that he steered contracts to Eastern European businesses linked to his daughter's lobbying firm that drew the government's attention.
</p>


<!--pagebreak-->
<p>
Weldon was voted out of office in 2006 just weeks after the FBI raided his daughter's home, and that of one of her associates.
</p>

<p>
Weldon did not respond to e-mails and phone requests to be interviewed or comment for this article. But in a 2006 interview, before the FBI probe was public, Weldon spoke enthusiastically about setting up a "front company" to work with the Russian arms agency, Rosoboronexport. Weldon hoped this company could sell weapons to the Middle East, and other regions, particularly to countries where the U.S. has strained relations. He claimed the director of Rosoboronexport approached him to work with "an American company that would act as a front for weapons these nations want to buy."
</p>

<p>
Weldon called the proposal an "unbelievable offer."
</p>

<p>
The administration, he acknowledged at the time, did not welcome the idea of an American company selling Russian weapons to potentially unfriendly countries. But two years later, Weldon, now a private citizen and chief strategic officer for Defense Solutions, appears to be working on precisely that sort of deal. And whether illegal or not, Defense Solutions' business represents a new phenomenon in the international arms trade business.
</p>

<p>
In years past arms brokers -- firms or individuals who serve as middlemen to facilitate weapons sales between countries -- were largely the stuff of spy thrillers. Unlike traditional American defense companies, like Lockheed Martin or Boeing, which typically sell weapons directly to NATO countries or other governments regarded as friendly to the United States, brokers are often small outfits run by people with sometimes questionable experience and reputations they will sell to anyone. One of the most infamous arms brokers, a Russian named <a href="http://en.wikipedia.org/wiki/Victor_Bout">Viktor Bout</a>, is charged by the United States, United Nations, Interpol and others of funneling arms to terrorists and rebels around the world. He was recently arrested in Thailand. The United States is requesting his extradition on charges of supplying arms to a terrorist organization.
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/bmp_1_350px.jpg" alt="" />

<div id="caption">

Two Marines lower the trim vane on the front of an Iraqi BMP-1 mechanized infantry combat vehicle that was captured during Operation Desert Storm. The American defense consulting firm Defense Solutions has proposed refurbishing Libya's aging fleet of BMP-1s. Defense Solutions denies drafting a sales proposal to Libya.

</div> 

</div>

<p>
But ironically, Iraq has fueled a new market for these professional middlemen; the United States is funneling billions of dollars into modernizing Iraq's army so that the country's government can fend for itself after coalition troops withdraw. And Iraq's largely Soviet-equipped military is a natural market for Eastern European countries brimming with old or out-of-date equipment they would like to unload. The middlemen, in these cases, serve a key role by allowing the U.S. government to do business with an American company, which in turn buys equipment from Eastern Bloc countries in deals worth hundreds of millions of dollars, much of it financed with U.S. taxpayer dollars.
</p>

<p>
One of Defense Solutions' sales -- a deal to sell Hungarian-owed T-72 tanks to Iraq in 2005 -- was typical of these new foreign military sales. But on the more questionable side is the company's plans to work with Rosoboronexport, which is barred from doing business with the U.S. government, and Libya, which is still on the State Department's arms embargo list. 
</p>

<p>
The Eastern European-Middle East arms-brokering business, while in some cases sanctioned by the U.S. government, has run into problems, including outright corruption and quality. Defense contractor Dale Stoffel, the president of Wye Oak Technology, and another American were gunned down in Iraq in December 2004 after Stoffel alleged that the Iraqi Ministry of Defense was involved in a kickback scheme. Like Defense Solutions, the company Stoffel worked for was refurbishing the Iraq's army Eastern Bloc equipment.
</p>

<p>
Another problem is quality. Weapons from the former Soviet Bloc, which the U.S. military euphemistically calls "nonstandard equipment," have been flagged as substandard, acknowledges Brigadier General Charles Luckey, who is in charge of security assistance at <a href="http://www.mnstci.iraq.centcom.mil/">Multi-National Security Transition Command-Iraq</a>. In an interview from Iraq, Brigadier General Luckey said: "One of the frustrating things about buying nonstandard [weapons], is that I'm the guy who has to deal with the fact that some broker I've never heard of allowed weapons to get to Iraq before they were inspected."
</p>

<div id="embed" style="margin: 0px 0px 15px 15px; float: right; width: 350px; height: auto;">

<img src="http://www.wired.com/images/article/full/2008/07/tank_350px.jpg" alt="" />

<div id="caption">

Defense Solutions is carving a new niche in the arms trade, selling Soviet-made weapons to Middle Eastern countries like Afghanistan and Iraq. Defense Solutions sold Hungarian-owed T-72 tanks to Iraq in 2005.

</div> 

</div>


<p>
In one high-profile case, Iraqi officials alleged that a corrupt firm sold them $400 million in shoddy helicopters from Poland. More recently, a company led by a 21-year-old and a former masseur was offered a U.S. government contract worth nearly $300 million to sell ammunition to Afghanistan. The ammunition turned out to be outdated and of dubious origin and several people connected with the company have been indicted. A congressional investigation concluded that the company, which was on a State Department watch list, was able to take advantage of regulatory loopholes by using middlemen.
</p>

<p>
For those concerned about illicit arms trade, this new wave of weapons deals is rife with the potential for corruption and abuse, but for companies eager to pursue markets once regarded as dubious, it represents a lucrative business opportunity.  The problem in these cases, according to those familiar with arms sales, is that it's no longer clear what's legal and what's not.
</p>
<!--pagebreak-->
<p>
Rachel Stohl, an expert on international arms trade and a senior analyst at Center for Defense Information, says that in many ways, the rush to equip Iraq has led the United States to throw caution to the wind. She points to a report by the Government Accountability Office last year that found that some 190,000 weapons sold to Iraq have gone missing. "I think the reality is we won't know, until way after the fact, about all of these irregularities with the Iraq weapons provision program," she said. "We were providing them all these assault rifles that have gone missing. Why? They were not following the standard procedures that were in place."
</p>

<p>
But Iraq and Afghanistan aren't the only markets available to arms brokers like Defense Solutions. The gradual normalization of relations with Libya opens another door into a quasi-legal area of sales. 
</p>

<p>
Like Iraq, Libya has a substantial arsenal of Soviet-origin military weapons, offering a potential market for brokers working with Russia and other former Soviet states. But even when there's not an outright ban, sales to the Middle East are often fraught with controversy, particularly to countries like Libya, which was under international sanction for more than a decade. Even as sanctions against it have been lifted, European companies proposing to sell arms to Libya have faced steep criticism, particularly since the country is still ruled by dictator Muammar Gaddafi, who took power in a military coup in 1969. 
</p>

<p>
While the United States lifted Libya's "state sponsor of terrorism" designation in 2006, other restrictions, such as on the sale of arms, remain in place. A State Department spokesperson confirmed that exports of "lethal munitions" to Libya, such as tanks or related equipment, are still banned, although sales of nonlethal equipment are now allowed on a case-by-case basis.
</p>

<p>
In late March, Weldon traveled to Libya for a weeklong trip at the invitation of the <a href="http://gdf.org.ly/index.php?lang=ar&Page=101&lang=en">Gaddafi Foundation</a>, a group run by the son of Libya's leader, and the chairman of Libya's foreign affairs committee, according to <a href="http://blog.wired.com/defense/files/libya_trip_report.doc">the report he sent to Defense Solutions</a> (.pdf), a copy of which was obtained by Wired.com. The trip reports states: "Agreement reached for Weldon to quickly return to Libya for meetings with son [of Libyan leader Gaddafi] Morti regarding defense and security cooperation."
</p>

<p>
A document dated April 16, just two weeks after Weldon's trip, outlines Defense Solutions' proposal to Libya to refurbish the country's fleet of armored vehicles, including its T-72 tanks, BMP-1 infantry fighting vehicles, and BTR-60 armored personnel carriers. A copy of the sales proposal, also provided to Wired.com, is on Defense Solutions' letterhead, appears to bear the signature of company CEO Timothy Ringgold, and is addressed to Libya's defense procurement council. "Defense Solutions is committed to delivering a full end-to-end solution to its clients," the proposal states. "Besides refurbishing these vehicles, we are capable of providing a full logistics support package, including a two year supply of spare parts, maintenance and repair services, and operator, maintenance, and repair training."
</p>

<p>
In an interview with Wired.com, Ringgold admitted that he's interested in doing business in Libya and confirms receiving Weldon's trip report from Libya, but denies drafting or signing an arms-sale proposal. "I've never made such a document to Libya," Ringgold insisted, after being read the proposal, and told that his signature is on it.
</p>

<p>
In addition to the Libyan arms-deal document, Wired.com has also reviewed copies of e-mails from Ringgold discussing the Libyan deal.
</p>

<p>
While Ringgold denies proposing an arms sale to Libya, he is open about speaking with Rosoboronexport, which has been on a U.S. government sanctions list since 2006, after the Russian state agency allegedly violated the Iran and Syria Nonproliferation Act. An April e-mail provided to Wired.com describes Ringgold, Weldon and Stephan Minikes, a senior advisor to Defense Solutions and a former ambassador, meeting with Rosoboronexport. The conversations included a number of potential deals, including supplying Mi-17 helicopters to Afghanistan and spare parts for Iraq's infantry fighting vehicles. Ringgold wrote to colleagues following the visit, describing the meetings as a "spectacular success," saying the Russian agency "has the ability to undercut all cost proposals from brokers."
</p>

<p>
Ringgold confirmed those discussions and said that his company has sought to do business with Rosoboronexport. Asked whether Ringgold considers his dealings with Russia to be legal, he argued that U.S. companies could work with Rosoboronexport on a "case-by-case" basis. "The particular purpose of the meeting we had -- and I want to be crystal clear -- was in response to a U.S. government requirement," he said.
</p>

<p>
A number of officials at the State Department and in the Pentagon, when contacted for this article, could not say whether working with Rosoboronexport is legal or not. A Pentagon spokeswoman said she was familiar with the issue, but deferred the question to the State Department. When asked about Rosoboronexport's status on the blacklist, John Herzberg, a State Department spokesman replied: "What's on there is on there."
</p>

<p>
Asked whether, given the ban, there was any way a company could legally work with Rosoboronexport, as Ringgold suggested, Herzberg provided an equivocal answer. "At the stage of the process we're at, I'm unable to give you an answer," he said. "You can try elsewhere in government, and maybe they'll be braver than me."
</p>

<p>
In an interview from Iraq, General Luckey conceded it was a murky area, but said, "My understanding is they are currently on our no-go list." 
</p>

<p>
The confusion over debarred parties has even led the U.S. government into its own legal tangles, according to Jim McAleese, a Washington attorney who specializes in government contracting and foreign military sales. Because the Russian government violated U.S. nonproliferation laws, even NASA had to go to Congress to ensure it could work with Russia on Soyuz flights to the international space station. "What I'm warning you about is, don't be surprised by the confusion," McAleese said. "There are a whole bunch of different statutes that were adopted piecemeal and were never intended to be reconciled."
</p>

<p>
But it's the very ambiguity of the law that troubles those who monitor export control. "It's highly unusual to do anything with the Russians, particularly Rosoboronexport," said Scott Jones, director of Export Control Programs at the <a href="http://www.uga.edu/cits/">Center for International Trade and Security</a> at the University of Georgia. 
</p>

<p>
Legal or not, reputable American companies simply don't want to work with banned entities, Jones said, for fear of risking their reputations and business. "Even if it's not an outright prohibition, most companies don't want to put themselves in a liability situation that has really bad PR … and they stay away from it," Jones said. "But if that's your business, pimping out arms from the U.S. or Russia, that's the way it works, and you push as much as possible."
</p>

<p>
Finding any U.S. defense company working with the Russian government at this point would be "remarkable," Jones added.
</p>

<p>
In the meantime, the future for Weldon is unclear. The FBI investigation continues and Weldon's former chief of staff recently pleaded guilty to a conspiracy charge and is cooperating with the government, notes Melanie Sloan, the executive director of <a href="http://www.citizensforethics.org/">Citizens for Responsibility and Ethics in Washington</a>, which filed a complaint against Weldon in 2004. Sloan speculated that Weldon may be charged with "honest service fraud" for misusing his office for personal gain. "It's an easier standard than bribery," she said. "I wouldn't be surprised [if he's charged] with bribery, but I think it will be honest services fraud."
</p>

<p>
Ringgold insists that he and Weldon are on the right side of the law. "Everything we do is in strict compliance with international and U.S. law and we operate only in the best interests of the U.S. government," he said. "I didn't serve 30 years in the United States Army to throw that away on a whim."
</p>

<p>
Asked if Weldon is still working for the company, Ringgold replied: "Absolutely, proudly so." 
</p><br style="clear: both;"/>
  <img alt="" style="border: 0; height:1px; width:1px;" border="0" src="http://www.pheedo.com/img.phdo?i=3c1b81ed8ecb441b359b5fd6e6dec750" height="1" width="1"/>
<img src="http://www.pheedo.com/feeds/tracker.php?i=3c1b81ed8ecb441b359b5fd6e6dec750" style="display: none;" border="0" height="1" width="1" alt=""/><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=f5EjSJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=f5EjSJ" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=zYmkhj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=zYmkhj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=S9Ojfj"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=S9Ojfj" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/wired/politics/privacy?a=xPEQRJ"><img src="http://feeds.feedburner.com/~f/wired/politics/privacy?i=xPEQRJ" border="0"></img></a>
 <a href="http://feeds.wired.com/~f/wired/politics/security?a=OTsesJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OTsesJ" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=wFj1Jj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=wFj1Jj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=OExjrj"><img src="http://feeds.wired.com/~f/wired/politics/security?i=OExjrj" border="0"></img></a> <a href="http://feeds.wired.com/~f/wired/politics/security?a=DKk6TJ"><img src="http://feeds.wired.com/~f/wired/politics/security?i=DKk6TJ" border="0"></img></a> </div><img src="http://feeds.feedburner.com/~r/wired/politics/privacy/~4/326164069" height="1" width="1"/><img src="http://feeds.wired.com/~r/wired/politics/security/~4/326164070" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 03 Jul 2008 18:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/arms brokers">arms brokers</category>
      <category domain="http://securityratty.com/tag/brokers">brokers</category>
      <category domain="http://securityratty.com/tag/infamous arms brokers">infamous arms brokers</category>
      <category domain="http://securityratty.com/tag/defense">defense</category>
      <category domain="http://securityratty.com/tag/firm defense solutions">firm defense solutions</category>
      <category domain="http://securityratty.com/tag/arms">arms</category>
      <category domain="http://securityratty.com/tag/arms trade">arms trade</category>
      <category domain="http://securityratty.com/tag/international arms trade">international arms trade</category>
      <category domain="http://securityratty.com/tag/russian weapons suppliers">russian weapons suppliers</category>
      <source url="http://feeds.wired.com/~r/wired/politics/security/~3/326164070/defense_solutions">U.S. Arms Dealer Tests Legal Bounds in Middle East Arms Bazaar</source>
    </item>
  </channel>
</rss>
