[Senate Hearing 109-577]
[From the U.S. Government Printing Office]



                                                        S. Hrg. 109-577
 
VETERANS AFFAIRS DATA PRIVACY BREACH: TWENTY-SIX MILLION PEOPLE DESERVE 
                                ANSWERS

=======================================================================

                             JOINT HEARING

                               BEFORE THE

                     COMMITTEE ON VETERANS' AFFAIRS
                          AND THE COMMITTEE ON
                           HOMELAND SECURITY
                        AND GOVERNMENTAL AFFAIRS
                          UNITED STATES SENATE

                       ONE HUNDRED NINTH CONGRESS

                             SECOND SESSION

                               __________

                              MAY 25, 2006

                               __________

       Printed for the use of the Committee on Veterans' Affairs


 Available via the World Wide Web: http://www.access.gpo.gov/congress/
                                 senate


                                 ______

                    U.S. GOVERNMENT PRINTING OFFICE
28-754                      WASHINGTON : 2006
_____________________________________________________________________________
For Sale by the Superintendent of Documents, U.S. Government Printing Office
Internet: bookstore.gpo.gov  Phone: toll free (866) 512-1800; (202) 512�091800  
Fax: (202) 512�092250 Mail: Stop SSOP, Washington, DC 20402�090001

                     COMMITTEE ON VETERANS' AFFAIRS

                      Larry Craig, Idaho, Chairman
Arlen Specter, Pennsylvania          Daniel K. Akaka, Hawaii, Ranking 
Kay Bailey Hutchison, Texas              Member
Lindsey O. Graham, South Carolina    John D. Rockefeller IV, West 
Richard Burr, North Carolina             Virginia
John Ensign, Nevada                  James M. Jeffords, (I) Vermont
John Thune, South Dakota             Patty Murray, Washington
Johnny Isakson, Georgia              Barack Obama, Illinois
                                     Ken Salazar, Colorado
                  Lupe Wissel, Majority Staff Director
               D. Noelani Kalipi, Minority Staff Director
                              ----------                              

        COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS

                   Susan M. Collins, Maine, Chairman
Ted Stevens, Alaska                  Joseph I. Lieberman, Connecticut
George V. Voinovich, Ohio            Carl Levin, Michigan
Norm Coleman, Minnesota              Daniel K. Akaka, Hawaii
Tom Coburn, Oklahoma                 Thomas R. Carper, Delaware
Lincoln D. Chafee, Rhode Island      Mark Dayton, Minnesota
Robert F. Bennett, Utah              Frank Lautenberg, New Jersey
Pete V. Domenici, New Mexico         Mark Pryor, Arkansas
John W. Warner, Virginia
           Michael D. Bopp, Staff Director and Chief Counsel
                   Thomas R. Eldridge, Senior Counsel
             Michael L. Alexander, Minority Staff Director
               Lawrence B. Novey, Minority Senior Counsel
                  Trina Driessnack Tyrer, Chief Clerk


                            C O N T E N T S

                              ----------                              

                              May 25, 2006
                                SENATORS

                                                                   Page
Craig, Hon. Larry E., Chairman, Committee on Veterans' Affairs, 
  U.S. Senator from Idaho........................................     1
Collins, Hon. Susan M., Chairman, Committee on Homeland Security 
  and Governmental Affairs, U.S. Senator from Maine..............     3
Akaka, Hon. Daniel K., Ranking Member, U.S. Senator from Hawaii..     4
    Prepared statement...........................................     5
Lieberman, Hon. Joseph I., U.S. Senator from Connecticut.........     6
Warner, Hon. John W., U.S. Senator from Virginia.................     7
Jeffords, Hon. James M., U.S. Senator from Vermont...............     8
Murray, Hon. Patty, U.S. Senator from the State of Washington....     8
Isakson, Hon. Johnny, U.S. Senator from Georgia..................     9
    Letter from Richard F. Smith, Chairman and Chief Executive 
      Officer, Equifax, Inc......................................    10
Lautenberg, Hon. Frank R., U.S. Senator from New Jersey..........    10
Thune, Hon. John, U.S. Senator from South Dakota.................    11
Burr, Hon. Richard M., U.S. Senator from North Carolina..........    12
Obama, Hon. Barack, U.S. Senator from Illinois...................    13
Salazar, Hon. Ken, U.S. Senator from Colorado....................    14
    Prepared statement...........................................    15
Chafee, Hon. Lincoln D., U.S. Senator from Rhode Island..........    16
Pryor, Hon. Mark, U.S. Senator from Arkansas.....................    16

                               WITNESSES

Nicholson, Hon. R. James, Secretary, Department of Veterans 
  Affairs; accompanied by Tim S. McClain, General Counsel, 
  Department of Veterans Affairs.................................    16
    Prepared statement...........................................    22
    Response to written questions submitted by:
        Hon. Daniel K. Akaka.....................................    24
        Hon. Norm Coleman........................................    25
        Hon. Pete V. Domenici....................................    26
        Hon. Lincoln D. Chafee...................................    26
Opfer, Hon. George J., Inspector General, Department of Veterans 
  Affairs; accompanied by Jon A. Wooditch, Deputy Inspector 
  General, Department of Veterans Affairs........................    28
    Prepared statement...........................................    29

                                APPENDIX

Coleman, Hon. Norm, U.S. Senator from Minnesota, prepared 
  statement......................................................    51
Center for Democracy and Technology, prepared statement..........    51
Department of Veterans Affairs, prepared statement...............    53
VA's Notification letter to veterans.............................    53
Press Release: Frequently asked questions on VA's letter to 
  veterans.......................................................    54


VETERANS AFFAIRS DATA PRIVACY BREACH: TWENTY-SIX MILLION PEOPLE DESERVE 
                                ANSWERS

                              ----------                              


                         THURSDAY, MAY 25, 2006

                               U.S. Senate,
                     Committee on Veterans Affairs,
and Committee on Homeland Security and Governmental 
                                           Affairs,
                                                    Washington, DC.
    The Committees met, pursuant to notice, at 10:09 a.m., in 
room SD-342, Dirksen Senate Office Building, Hon. Larry E. 
Craig, Chairman of the Committee, presiding.
    Present: Senators Craig, Burr, Thune, Isakson, Collins, 
Chafee, Warner, Akaka, Murray, Obama, Salazar, Lieberman, 
Carper, Lautenberg, Pryor and Jeffords.

 OPENING STATEMENT OF HON. LARRY E. CRAIG, CHAIRMAN, COMMITTEE 
         ON VETERANS' AFFAIRS, U.S. SENATOR FROM IDAHO

    Chairman Craig. The Committee will be in order.
    I will ask the Secretary to sit down, take a deep breath 
and collect his thoughts. He has just come from a hearing in 
the House. Then we would appreciate photographers and media 
keeping it down as much as you can in the front. Thank you.
    We have an announced vote at or around 20 after, so we will 
attempt to get opening statements as much as we can prior.
    Good morning, ladies and gentlemen. On behalf of Chairman 
Collins, as well as the Ranking Members of the two Committees, 
Senator Akaka of Veterans' Affairs and Senator Joe Lieberman of 
Homeland Security and Governmental Affairs, I want to welcome 
all of you to this joint hearing this morning.
    First, I want to thank all of the Members of our two 
Committees for their willingness to participate jointly in this 
important hearing. I think the American public should 
understand that while this hearing is about the Department of 
Veterans Affairs and the compromising of sensitive personal 
information about our veterans, the issue of data security is a 
concern all across Government.
    As I said on the Senate floor just 2 days ago, nearly every 
agency of the Federal Government maintains sensitive 
information on millions of American citizens. Most of this data 
is not of the classified nature. Rather, it is information 
compiled simply to carry out the mission and programs of 
various agencies.
    For example, the Federal student financial aid form 
requires that you provide your name, address, Social Security 
number, date of birth, information of your parents, and their 
addresses, along with many other things. Clearly, the release 
of that data would be as devastating to the privacy of millions 
of students and their families as VA's breach was to millions 
of America's veterans and their families.
    Still, we are here today to talk about what the Secretary 
of Veterans Affairs announced to the Nation this past Monday. 
He told my Committee and other Members that an employee of the 
Department downloaded data of nearly 26 million veterans and 
then walked right out the front door with it. Subsequently, the 
data was stolen from this employee's home.
    Mr. Secretary, I must tell you, that is pretty 
unbelievable. How is it that VA's computer system permits one 
person to download the records of 26 million individuals and do 
so without any alert going off to anyone else who has the 
responsibility of the integrity of that system.
    Candidly to me, that is not even the most absurd part of 
the story as I now know it. What is even more important and 
mind-boggling is after he revealed the facts of the theft to 
his supervisor, it took 13 more days for anyone else to 
discover the lost data was on 26 million veterans and their 
families. Then it took 2 more days for the FBI to be notified. 
So somebody lost the names, the birthdates and the Social 
Security numbers of 26 million veterans and their families and 
the FBI knew nothing for nearly 2 weeks.
    Mr. Secretary, I read your statement yesterday in the press 
about the anger you felt at having discovered the lapse in 
security nearly 13 days after it happened. I am glad you are 
angry. You should be. You can only imagine how I and millions 
of veterans felt and now feel.
    I just came from doing C-SPAN. I did call-ins. America's 
veterans across this country are frustrated. The word scared 
was used. The words are we at risk were used. And what do we do 
to protect ourselves?
    Mr. Secretary, I understand the need to spend some time 
with your staff assessing problems and reviewing options, but I 
find it increasingly frustrating that decisions are made 
without the knowledge and the input of a few of us. I think we 
can be trusted. I think you know that.
    Now, before I turn to Chairman Collins for her comments, I 
want to say a word about the employee who took the data home, 
as I now know it. While there is still an ongoing investigation 
as to the situation by the FBI, and I know that will limit some 
statements this morning, as best as I can tell from the 
information I have thus far, this person is a dedicated Federal 
employee who took work home with the hopes of improving VA's 
operations. Yes, his actions were inexcusable. He knew better 
than to take information home, or I hope he did. I hope policy 
suggested he should not or insisted he should not. He knew 
better than to take information home. And yet, a terrible lapse 
in judgment, and now he is faced with the serious consequences. 
But at least he told his supervisors and the law enforcement 
right away, which is more than we have been accorded.
    I am not going to lose sight of the actions of everyone 
else in this situation. There were many lapses in judgment from 
many people. I hope this hearing today will shed some light on 
the shortcomings in VA's data security programs and on what 
needs to happen to ensure such a major breach never occurs 
again.
    Also, I think our discussion will heighten the awareness of 
many other agencies across our Government to the vigilance 
about data protection and information security. As I said 
earlier, students, farmers, and others who seek Government 
assistance deserve our best efforts to protect their critical, 
vital, private information.
    Most importantly, I hope today's hearings will provide 
millions of veterans and their families the assurance they 
deserve to have, that you are doing everything possible, Mr. 
Secretary, and we will do the same.
    Thank you for being with us.
    Chairman Collins.

OPENING STATEMENT OF HON. SUSAN M. COLLINS, CHAIRMAN, HOMELAND 
SECURITY AND GOVERNMENTAL AFFAIRS COMMITTEE, U.S. SENATOR FROM 
                             MAINE

    Chairman Collins. Thank you, Mr. Chairman.
    First, let me begin by commending you for your leadership 
for seizing the initiative for suggesting this joint hearing. I 
and the Members of the Homeland Security Committee are very 
pleased to join you in this effort to quickly address a very 
serious matter that is of great concern to our Nation's 
veterans, including some 141,000 veterans in my home State of 
Maine.
    We are here today not merely to examine one incident, one 
moment of carelessness--make that recklessness--by one Federal 
employee. The specific incident compels us to confront the 
persistent and pervasive laxity with which the VA safeguards 
the personal information of the veterans it serves.
    For 5 straight years, the VA's Inspector General has 
criticized the Department for inadequate information security. 
On the annual Federal Computer Security Report Card issued by 
the House Government Reform Committee, the VA has received a 
grade of F for 4 of the last 5 years, including each of the 
last 2 years.
    This ongoing failure during a time when identity theft has 
been such a high-profile problem is simply appalling. The 
immediate result of this failure is what appears to be the 
largest theft of Social Security numbers ever. The fact that 
the information also included veterans' names and dates of 
birth means that the stolen data can easily be used to commit 
identity theft and financial fraud.
    The lingering result will be increased doubts among the 
American people about the Federal Government's commitment to 
safeguarding their personal, sensitive information.
    When we think of cyber security, we focus on protecting 
vital information systems against intrusion by criminals or 
terrorists. We now see that all the high-tech fixes in the 
world cannot protect these systems against one employee who 
disregards an established policy, and one agency that does not 
take sufficient measures to ensure compliance with the policy.
    I am also troubled by the VA's response. The burglary that 
led to this potentially massive intrusion occurred on May 3. 
Yet, as the Chairman indicated, it apparently was not reported 
to the FBI for 2 weeks. The American people, and most important 
our veterans, were not informed for nearly 3 weeks.
    Now, some delay prior to disclosure could well be 
reasonable, to allow law enforcement time to hunt for the 
stolen information or to put in place a system to respond to 
the many inquiries from our veterans. However, much of the 
delay in this case appears to be because the VA did not 
promptly investigate the nature and the scope of the data 
breach. It simply appears that the VA did not handle this 
matter with the clear sense of urgency that it required.
    I am also concerned about the initiatives the VA has taken 
to address the immediate crisis. Is it sufficient simply to 
establish a toll-free number for veterans to call? We have 
already heard, in my office and others, that veterans have 
called this number, but have been unable to learn much of 
anything.
    Is it sufficient to just accelerate a schedule of computer 
security training for VA employees? Or should more be done? We 
must ensure that the remedies the VA puts in place, both short-
term and long-term, are real, will make a difference and are 
not merely cosmetic.
    We must also view this incident as a wake-up call to the 
rest of the Federal Government. It is likely that the VA is not 
alone in the potential to suffer a data breach of this 
magnitude. Federal managers must recognize that they are 
stewards of a large amount of personal data on law abiding 
citizens, and they must guard this information wisely or lose 
the people's trust.
    It is tragically ironic that this profound betrayal of 
trust occurs just as the American people are preparing to honor 
our veterans. On this Memorial Day, the pride our veterans 
should feel in their service to our Nation will be dampened by 
anxiety and justifiable anger.
    These are the people who have served our Nation yesterday 
and who serve today. They are brave, patriotic, and devoted to 
duty. They deserve our gratitude and much more. They certainly 
deserve better than this. We owe them our best efforts so that 
the deep problems that this incident has exposed are fixed and 
so that the trust they should be able to have, not only in the 
VA but across our Government can be restored.
    Thank you, Mr. Chairman.
    Chairman Craig. Thank you, Madame Chairman.
    We do have a vote on and it started at 10:16. I suspect we 
can go. So Senator Akaka, if you would wish to go ahead with 
your opening statement, we will get a few more. I would ask 
that we keep these as limited as possible so we can get to the 
Secretary. But please proceed.

      STATEMENT OF HON. DANIEL K. AKAKA, RANKING MEMBER, 
                    U.S. SENATOR FROM HAWAII

    Senator Akaka. Thank you very much, Mr. Chairman, and 
Chairman Collins, for working together for calling this very 
important and timely joint hearing.
    As the Ranking Member on the Veterans' Affairs Committee 
and a senior Member on the Homeland Security and Governmental 
Affairs Committee, I am privileged to sit on two committees 
that have oversight on this issue. Having both Committees 
investigating this matter will allow us to address the 
specifics of the incident involving VA data and work to craft 
safeguards for the entire Government.
    I would like to say, Mr. Chairman, that I want to associate 
myself with the eloquent statement that you made.
    Let me be clear, the specific incident that brings us here 
today happens to involve VA and VA data. It could just as 
easily have involved other departments and agencies. It may be 
wise to have other departments and agencies examine their 
policies on classified and confidential data and the proper use 
and security for such data.
    Shortly after the news that the incident broke, I spoke 
with VA Inspector General George Opfer. He told me his office 
launched a full investigation into the matter which would 
examine all of the facts. I eagerly await his findings as the 
investigation will provide independent information for Congress 
to assess the situation.
    I also wrote to Secretary Nicholson with a number of 
questions and I look forward to his responses today.
    I have a longer statement, Mr. Chairman, but I will not 
read it so we have more time to hear from and question the 
witnesses. I ask that my full statement appear in the record as 
if read. Thank you very much, Mr. Chairman.
    [The prepared statement of Senator Akaka follows:]

      Prepared Statement of Hon. Daniel K. Akaka, Ranking Member, 
                        U.S. Senator from Hawaii

    Thank you Chairman Craig and Chairman Collins for working together 
to call this very important and timely joint hearing. As the Ranking 
Member on the Veterans' Affairs Committee and a senior member on the 
Homeland Security and Governmental Affairs Committee, I am privileged 
to sit on the two committees that have oversight on this issue. Having 
both Committees investigating this matter will allow us to address the 
specifics of the incident involving VA data and work to craft 
safeguards for the entire government.
    Let me be clear--the specific incident that brings us here today 
happens to involve VA and VA data. It could just as easily have 
involved other departments and agencies. Shortly after the news of this 
incident broke, I spoke with VA Inspector General George Opfer. He told 
me his office launched a full investigation into the matter that will 
examine all the facts. I eagerly await his findings as the 
investigation will provide independent information for Congress to 
assess this situation. I also wrote to Secretary Nicholson with a 
number of questions that need to be answered. I look forward to his 
response today.
    I am especially concerned with the manner in which VA handled this 
investigation. Although the breach occurred more than 3 weeks ago, 
Congress and the public were only notified of the incident this week.
    Regardless of whether identity theft actually occurs as a result of 
this incident, anytime the government loses a database of personal 
information, privacy is compromised. We must do all we can do to 
prevent this from ever happening again. The security mechanisms at VA 
are not working if a mid-level VA employee was able to walk out of the 
building with a massive amount of personal information. It seems to me 
that data of this magnitude and importance should be in the hands of 
very few VA employees and should be guarded with the utmost security. 
Thus far, VA has said the employee was not authorized to take the 
information home.
    I am troubled as to how an employee who is not authorized to take 
home the private information of more than twenty-six million veterans 
was still able to do just that. The VA failed to take several steps to 
safeguard this information. For example, VA could have scrambled Social 
Security numbers based upon an encryption formula, whereby access to 
files that translate scrambled Social Security numbers is only possible 
with special authorization. This procedure was not followed in this 
instance, and we need to know why. It is important to note how we came 
to learn about the loss of the data. The VA employee whose computer 
equipment was stolen disclosed this to VA. If the employee had chosen 
not to report the theft immediately, VA and the public could possibly 
still be in the dark about the incident.
    As I said earlier, while today's hearing is focusing on the 
information security practices at VA, I believe the data breach is 
indicative of broader information security and privacy problems 
throughout the government. I understand the problems that agencies 
face, as I have been working on Federal data collection and privacy for 
a number of years. At my request, the Government Accountability Office 
(GAO) conducted several investigations on Federal data mining 
activities and found that Federal agencies are not following all key 
privacy and information security practices. Last week, I introduced 
legislation to strengthen the investigative authority and independence 
of the Chief Privacy Officer at the Department of Homeland Security.
    I believe we need to make sure that all agencies have a strong 
privacy official to ensure that what happened at VA will not happen 
again. Last year, the Office of Management and Budget directed each 
agency to designate a senior privacy official. However, issues remain 
as to whether these individuals are focused on matters other than 
privacy, which may cause a conflict of interest; the training received 
by and the expertise of these individuals; and the enforcement 
authority of the privacy officers in each agency. Having policies and 
safeguards in place will not work if agencies are not following the 
law.
    The incident at VA demonstrates the need to review the Privacy Act. 
I believe it is appropriate at this time, Chairman Collins, for your 
Committee to undertake this review as soon as possible. The 
applicability of the Act in this increasingly electronic age, combined 
with limited remedial action, necessitates that we take a closer look, 
and make sure that the personal information that the government 
collects is properly maintained.
    It is unfortunate that, as the Nation prepares to celebrate those 
that paid the ultimate sacrifice in defense of our freedom, our 
government has breached the trust of its heroes. Our veterans deserve 
much better. I intend to work with all appropriate parties to provide 
real solutions to these glaring problems, not just in VA but across all 
government agencies and departments. Thank you.

            STATEMENT OF HON. JOSEPH I. LIEBERMAN, 
                  U.S SENATOR FROM CONNECTICUT

    Senator Lieberman. Thanks, Senator Akaka. We are going to 
continue going around and hope that Chairman Craig and Chairman 
Collins come back in time.
    I want to thank them and Senator Akaka for holding this 
hearing as quickly as they have, so that we can get some 
answers about this enormous security breach, how it occurred in 
the first place and how we can quickly assist those veterans to 
whom we all owe so much and who have been put at risk by the 
loss of their confidential information.
    The security of Government computer systems and the vast 
databases contained within them is a subject we on the Homeland 
Security and Governmental Affairs Committee have been working 
on for some time.
    As information technology continues to advance by leaps and 
bounds, we must take equivalent leaps and bounds to protect 
against the theft, misuse and abuse of information brought 
together as never before by that technology.
    At various times in our lives we, the American people, are 
required to provide the Government with all sorts of personal 
information. We do so out of necessity and sometimes out of 
choice. But we also, of course, provide it on the basis of 
trust. We, the American people, will not feel comfortable 
sharing that information that the Federal Government needs if 
the Federal Government cannot guarantee that it is kept private 
and secure.
    This latest incident at the VA is just the most recent 
reminder that the Federal Government generally, I have 
concluded, is not doing enough to guarantee that security. 
Three years ago, I asked the Government Accountability Office 
to assess and evaluate Federal privacy protections. GAO looked 
into the privacy practices of 25 Federal agencies and reported 
back that compliance was very uneven and that in nearly one-
third of cases when agencies disclosed personal information to 
non-Federal organizations, the agencies did not have procedures 
in place to ensure that the personal information disclosed was 
complete, accurate, relevant, and timely as required by the 
Privacy Act.
    Last year, Senator Collins and I took the Transportation 
Security Administration to task for violating the privacy of 
thousands of commercial airline passengers when it collected 
and stored personal information about those passengers. Not 
only did TSA violate its own privacy policy, it also failed to 
meet the basic requirements of the Privacy Act, which is law.
    The VA security lapse is particularly troubling to all of 
us. Infuriating, in fact, because of the population of veterans 
that may have been placed at risk. So we are here today to get 
answers to questions and they have really been framed by my 
colleagues who have spoken before.
    So, I will simply conclude by saying, Secretary Nicholson, 
I have great respect for you. I think you know that it is now 
up to you and your Department to restore the American public's 
trust in the VA, which is a good and efficient Department, and 
in the ability of Government as a whole to carry out its duties 
without jeopardizing personal and sensitive information the 
people of this country have and give to their Government.
    As part of that, I hope you will not hesitate to hold 
accountable anyone who was responsible for this failure to 
protect the confidential information of millions of American 
veterans.
    Thank you very much.
    Senator Warner.

               STATEMENT OF HON. JOHN W. WARNER, 
                   U.S. SENATOR FROM VIRGINIA

    Senator Warner. Thank you, Mr. Chairman.
    I want to first say a few words about the Secretary of 
Veterans Affairs. I have known him for a very long time. In 
times like this, when we have literally a very serious problem 
at hand, it is fortunate Jim Nicholson has stepped up for 
continued public service. He has about as distinguished a 
career in the United States military as one can have in 
contemporary times.
    I thank you, my good friend, for calling me very promptly 
on the early morning when this news first became public and 
reassuring me, as I am sure you are going to reassure veterans 
all over America, that you are going to have a total hand on 
the situation to hold accountable those who have perpetrated 
any wrongs or breach of law, and to reassure veterans that we 
are going to protect them to the extent we can.
    If I may say with some modesty, I am a veteran myself of 
World War II and Korea, and I have had a lifetime association, 
as you have Mr. Secretary, with the men and women of the Armed 
Forces who have served. And we must recognize, as my colleagues 
alluded, that technology has gone forward so rapidly. Ten years 
ago, if you were trying to plan a theft like this, you would 
have to have a six-wheeler van to haul the information out. Now 
a simple disk can slide into the pocket. Consequently, we have 
to take measures which keep apace with technology to give the 
security that is required in this situation.
    But I would like to once again say, as this hearing is 
commencing and as people are following it all across the United 
States, you will do a good job, Mr. Secretary. You will get to 
the bottom of this and solve it, because of your deep love, 
respect and affection for America's veterans.
    Thank you.
    I think we should stand in recess until the return of the 
Chair. Do you wish to--good, thank you very much.

             STATEMENT OF HON. JAMES M. JEFFORDS, 
                      U.S. SENATOR VERMONT

    Senator Jeffords. Mr. Chairman, I appreciate your holding 
this hearing on such short notice to examine the frightful 
breach of security at the VA that has led to the loss of 
significant data of millions of veterans. I understand that the 
Government, and in particular agencies such as the VA, who deal 
in direct health of individuals need to have sensitive personal 
information. But the Government therefore has a sacred 
obligation to make sure that this information is secure. This 
is an inexcusable breach of the basic compact of trust between 
the veteran and the VA. I am a veteran myself.
    The FBI must get to the bottom of how this happened and 
take immediate measure to ensure that it never happens again. 
We owe our veterans nothing less.
    I look forward to your testimony, Mr. Secretary, and hope 
you will give us reason to be reassured that the VA is taking 
immediate action to address this horrendous problem.
    Thank you, Mr. Chairman.
    The Committee will now stand in recess until the Chairman 
returns.
    [Recess.]
    Chairman Craig. The Committee will be back in order.
    Mr. Secretary, thank you for standing down for a few 
moments while we went to vote.
    Now let me turn to Senator Murray.

                STATEMENT OF HON. PATTY MURRAY, 
                  U.S. SENATOR FROM WASHINGTON

    Senator Murray. Let me thank Chairman Craig and Collins, as 
well as our Ranking Members Akaka and Lieberman, for calling 
this very important hearing today.
    Simply put, this is really a disaster. Our phones are 
ringing off the hook with veterans from all across the country 
who feel that their privacy has been violated and they are 
really losing faith in the VA. We have 85-year-old veterans who 
do not know the first thing about credit checks, and they are 
being told that their identity has been compromised and they 
really do not know what to do. We need to find a way to provide 
assistance for all of our veterans and give them the peace of 
mind that they deserve.
    Now, I know that some say that this is just an isolated 
incident, that this is an accident caused by one employee at 
the Department of Veterans Affairs, but Mr. Secretary, I have 
to tell you, from where I sit, this seems like just another 
demonstration of the agency's incompetence.
    As Chairman Collins said, the VA was told time and again by 
the IG that it had weaknesses in its information security 
systems. The VA was warned about the lack of protection for 
veterans' sensitive health care and benefits information, and 
these warnings seem to have gone unnoticed by leadership within 
the VA.
    I hope we hear this morning from you, Mr. Secretary, about 
how this happened, why it took so long to tell our veterans 
that their information was compromised, what we are going to do 
to rectify this situation and what steps you are taking to 
ensure that it never happens again.
    Again, as we have discussed before, these Committees and 
this Congress have instilled in you the responsibility to fight 
and defend our veterans. I know that all of our veterans need 
you to be their greatest advocate.
    I am very disappointed by what has transpired and I hope 
that this agency really now rises to the occasion under your 
leadership and show all of us here and the millions of veterans 
that are at risk that you are here to protect them even from 
your own agency's mistakes.
    Thank you, Mr. Chairman.
    Chairman Craig. Thank you, Senator.
    I note that statement was made in under 3 minutes. I 
appreciate that very much and would hope that our colleagues 
would attempt to adhere to that so that we can get to the 
Secretary.
    Let me turn to Senator Isakson.
    Johnny.

               STATEMENT OF HON. JOHNNY ISAKSON, 
                   U.S. SENATOR FROM GEORGIA

    Senator Isakson. Thank you, Mr. Chairman, and I will be 
brief.
    I thank you and Chairman Collins for calling this hearing.
    Mr. Secretary, I can empathically identify with the 760,000 
veterans in Georgia who are probably on this list, because a 
year ago I was notified that my information had been lost or 
stolen by an American corporation and I know how I felt. I also 
know how they responded. And I hope we will and the 
Administration will respond swiftly to ensure the veterans are 
protected and they get the information they need.
    To that end, Mr. Chairman, I would like to ask unanimous 
consent to submit a letter for the record.
    Chairman Craig. Without objection.
    [The letter referred to follows:]

                                              Equifax Inc.,
                           Peachtree Street, Georgia, May 24, 2006.
Hon. Johnny Isakson,
U.S. Senate,
Washington, DC.
    Dear Senator Isakson: At Equifax, we honor the enormity of our 
veteran's contribution to the success and security of our great 
country, and are pleased to assist them in any way possible. Upon 
learning of the data breach at the Veterans Administration Office, 
Equifax immediately developed a special assistance page on our 
Equifax.com website. This page is designed to educate and assist our 
veterans on identity theft, and the ways in which they can safeguard 
their personal, information. This special assistance page includes the 
following:
    1. How to place an initial fraud alert on their credit file. This 
will alert creditors of possible fraudulent activity and request they 
contact the veteran prior to establishing credit in their name.
    2. How to request a free copy of their credit file 
atannualcreditreport.com, or by phone or mail.
    3. A special offer for Equifax's Credit Watch products available to 
veterans at a 50 percent discount until June 30, 2006. Credit Watch, 
will monitor the veteran's credit file and alert them to changes that 
could be early warning signs of identity theft.
    We look forward to continuing to work with the Veterans 
Administration Office to assist our veterans.
            Sincerely,
                                          Richard F. Smith,
                Chairman and Chief Executive Officer, Equifax, Inc.

    Senator Isakson. The Equifax Corporation out of Atlanta, on 
the day of the announcement, notified the VA and all veterans 
of a hotline, affording them immediate access to a free credit 
report, and offered them a 50 percent discount on 1 year's 
credit card service to monitor their credit. Mr. Richard Smith, 
who is the CEO of that company, was in Washington yesterday. I 
had the chance to talk to him and I thanked him personally for 
their voluntary effort. But I think it is important that the 
agency come together with a seamless policy to protect all 
veterans.
    Lastly, Mr. Chairman, I want to commend you on your 
statement with regard to this being a wake-up call. As terrible 
as this loss of information is, just think if the Social 
Security Administration or the IRS and all their computer data 
information did not have a good security system.
    So I hope as we work to raise the level of interest in this 
issue and hold the VA accountable, we will make sure we are 
checking with every agency of the Government and making sure 
they are redoubling their efforts to ensure this does not 
happen in any other agency as well.
    I yield back the balance of my time.
    Chairman Craig. Thank you, Senator.
    I am proceeding on the order with which Senators first came 
to the Committee, and I will turn to Senator Salazar.
    Excuse me, he is not here.
    In that case, it is Senator Lautenberg.

            STATEMENT OF HON. FRANK R. LAUTENBERG, 
                  U.S. SENATOR FROM NEW JERSEY

    Senator Lautenberg. Thanks, Mr. Chairman, and I will join 
the race to the 3-minute mark and see if I can rush through.
    Madame Chairman and our guest Chairman, thank you very much 
for arranging this joint hearing on such short notice. I 
appreciate the opportunity to learn about this alarming breach 
of security that has compromised the personal information of 26 
million veterans and families.
    I served at an earlier time and the records regarding my 
service and those who served at my time were destroyed in a 
fire in St. Louis in the Veterans Administration facility. So 
it does not install a lot of confidence when we see what has 
happened now.
    In the next few days, we are going home for Memorial Day, a 
day we want to honor our veterans and their service. But this 
week we learned that the Government has failed them, put them 
at risk, at significant risk. Our veterans deserve the best in 
health care and other services. But what they got in this case 
is a security breach that puts them at risk for theft of their 
identity.
    In recent years, we have all learned that identity theft 
has serious consequences for its victims. This incident, 
involving the VA, is the largest breach of Social Security 
numbers ever and it is appalling that something could happen. 
To make matters worse, the VA's response to the crisis has not 
been satisfactory. As a matter of fact, it really destroys 
confidence in the functioning of the VA.
    They have a call center in New Jersey and veterans who call 
there do not think the VA call center is very helpful. These 
veterans will probably have to take some steps themselves to 
make sure that their credit information is not compromised and 
that they are not subjected to deep losses as a result.
    We should make it simple for them as much as we can. And 
that is why I am joining Senator John Kerry in supporting his 
bill to help veterans to stay informed about their credit 
status in the aftermath of this incident.
    Again, thank you very much, Mr. Chairman and Madame 
Chairman.
    Chairman Craig. Senator, thank you very much. Now let me 
turn to Senator Thune.
    John.

                 STATEMENT OF HON. JOHN THUNE, 
                 U.S. SENATOR FROM SOUTH DAKOTA

    Senator Thune. Thank you, Mr. Chairman and Madame Chair.
    I appreciate, as well, very much your holding this 
emergency hearing to deal with the theft of personal 
information for millions of our veterans, and I want to thank 
Secretary Nicholson for appearing today.
    Mr. Chairman, I share your commitment to understand all the 
facts of this case before taking action, and I hope this 
hearing will generate light that we can use to do that.
    Having said that, this breach of information security at 
the VA is causing a lot of anxiety across the country among our 
veterans. And they are rightfully demanding that we act quickly 
on this issue. I have many veterans in my State of South Dakota 
who are justifiably concerned about identity theft, and they 
deserve to have peace of mind about their privacy.
    That is why we have to work quickly here on these 
committees to learn all the relevant facts and then take the 
appropriate action. And that, I think includes, in the short 
term, finding out the exact proportions of the problem and 
developing a proportionate remedy. Also, looking at the long 
term, at what we can do to make sure that this thing never 
happens again.
    As a number of Members of the Committee have already noted, 
the IG's most recent strategic plan indicated that one of the 
strategic goals was in the area of information management. It 
also noted many of the challenges the VA faces in the privacy 
of and the security of the information it manages. The 
strategic plan further states that information systems security 
has been identified as a material weakness as early as 1998 
within the VA.
    And then there is this key passage on page 58, which I want 
to just read for you,

          The potential vulnerability of Federal information systems 
        cannot be overestimated. Presently, VA systems are not 
        protected from authorized access, risk of potential exposure, 
        loss of sensitive data, fraudulent claims and disruption of 
        critical activities remain. Security over VA IT resources needs 
        to assure that only authorized users access VA resources and 
        only authorized use is made of VA resources. Legal requirements 
        such as the Privacy Act, the Federal Information Security 
        Management Act of 2002, and the Health Information Portability 
        and Accountability Act of 1996 impose detailed duties on the VA 
        to protect sensitive medical and personal information it 
        maintains on veterans, their families and its employees.

Clearly, what the Inspector General was concerned about in 
terms of information security has now become a reality that we 
must deal with. I believe that this event occurred at least in 
part because many of the VA's IT systems are compartmentalized 
within the VA's three administrations: health, benefits and 
cemeteries; and there is not a uniform policy in terms of 
information security across the entire VA.
    That is why, Mr. Chairman, I introduced a bill, last fall, 
to improve the management of IT within the VA. My bill would 
provide for the VA's Chief Information Officer to have 
authority over resources, budget and personnel related to the 
support function of information technology. An identical bill 
has passed the House. I hope that this will give us an 
opportunity to pass it in the Senate.
    I appreciate again, Mr. Chairman, your holding this 
hearing. We are here to understand the entire context of this 
situation and then to work on both short-term and long-term 
solutions. We must do all that we can to ensure the information 
privacy of our veterans who have sacrificed so much for all of 
us.
    So thank you again and I look forward to the testimony.
    Chairman Craig. Senator, thank you.
    Senator Burr.

              STATEMENT OF HON. RICHARD M. BURR, 
                U.S. SENATOR FROM NORTH CAROLINA

    Senator Burr. I thank both the Chairs.
    Mr. Secretary, Senator Isakson and I have something in 
common, in the fact that we both participated in this before 
from the standpoint of our records being lost. Mine happened to 
be a stolen laptop with my pertinent information from the 
accounting firm that does my taxes. I remember vividly getting 
the call and being walked through exactly what they were doing 
to make sure that they minimized what was a huge mistake.
    Fortunately, I have never had any repercussions from that 
over the several months that I have gone through. I am sure we 
can find a number of ways to tongue lash the system, and you 
and the Administration.
    Let me suggest to my colleagues, that is not what we are 
here to do. We are here to figure out--to work with you--to try 
to figure out how to remediate a problem that we do not know 
the scope of yet, to once again remind the Veterans 
Administration and every branch of Government that it is 
unacceptable to have the delay in notification to the Congress, 
to the Federal law enforcement folks, that these are policies 
that we need to look at, that this cannot be something we make 
up on the go.
    I certainly commit myself to you and to the Chairs to work 
aggressively to find how we can adopt a policy that we all feel 
confident is structured in a way that minimizes the risk of 
this in the future.
    But more importantly, a policy that we can communicate to 
all concerned of exactly what we do if it ever does. I think 
the belief that we can assure with 100 percent accuracy that we 
can eliminate this is a dream. We cannot. That is why it is 
just as important that we understand that we need a policy in 
place that everybody understands that helps us to remediate 
this.
    Once again, I do want to say publicly to you that it is 
unacceptable to have had a 60-day delay or a 15-day delay 
between the time that notification went out to the 
Administration, the Congress and the FBI.
    My hope is that through this hearing, it is the start of 
the road to a recovery from where we are.
    I thank the Chairs.
    Chairman Craig. Senator, thank you very much.
    Senator Obama.

                STATEMENT OF HON. BARACK OBAMA, 
                   U.S. SENATOR FROM ILLINOIS

    Senator Obama. Thank you very much to the Chairs for 
holding this hearing. I will try to be brief.
    This episode raises so many questions, but I think maybe 
the most poignant one was raised by Sonny McQueen, a DC area 
veteran. He said, ``How else can the country let us down?'' And 
I think that is a feeling that may be pervasive among a lot of 
veterans.
    I hope this hearing is the first step toward answering some 
of those questions. As has already been noted, why did it take 
2 weeks for the VA to notify the FBI? That was a 2-week head 
start for criminals to potentially wreck havoc. Why did the VA 
wait nearly 3 weeks to notify the veterans who were at risk? 
That is a policy issue.
    I have no doubt, Mr. Secretary, that you are as outraged as 
we are about this problem. But I am concerned about what is it 
structurally inside the VA that is preventing information from 
being dealt with properly? And what is preventing the VA from 
being forthcoming to veterans and the American people?
    We have a duty to make this right. The average identity 
theft victim spend 40 hours, apparently, to clean up his or her 
finances after something like this happens. So as a first step, 
I am hoping that the VA is going to be thinking about how it is 
going to provide credit monitoring and counseling services to 
the veterans who may be affected. This is a problem that may 
take a lot of time and money to fix, but we are going to need 
to make our veterans whole.
    Beyond that, I think it is important for us to understand 
that, although this may be a mistake of one employee, the 
reality is that this is a system that was destined to failure. 
Just a couple of quick facts. This is a system that scored an F 
in information security in 4 of the past 5 years on a House 
Committee report card. This is a system that in 2001 allowed VA 
employees in Atlanta to steal $11 million in benefits. The VA 
Inspector General, as has already been noted, has argued for 
years that the VA needed to improve its IT security. The VA 
Chief Information Officer abruptly resigned a month ago because 
the agency was not moving fast enough on its IT reorganization.
    So, we cannot pin this on one individual. This is a 
systemic breakdown. The system is so poorly designed that one 
employee could compromise the entire thing. That raises the 
question how could managers not realize that so many files were 
downloaded and brought offsite? And what steps is the VA going 
to take to secure veterans' data used in other programs?
    I hope that through this hearing we can get to the bottom 
of this fiasco. I think we need to hold VA officials 
accountable. We also need to look forward and try to prevent 
identity theft across the private and public sector. It is 
estimated that 10 million consumers are affected annually.
    I understand that Senators Specter and Leahy are going to 
be looking at ways in that Committee to deal with issues of 
identity theft. I hope that all of us work on this. In the 
meantime, we are going to have to figure out how to clean up 
this mess.
    Thank you very much Mr. Chairman, Madame Chair. I look 
forward to the hearing.
    Chairman Craig. Thank you very much, Senator.
    Again on the order with which Senators came to the 
beginning of the hearing, let me turn to Senator Salazar and 
then to Senator Chafee. Thank you.
    Ken.

                   STATEMENT OF KEN SALAZAR, 
                   U.S. SENATOR FROM COLORADO

    Senator Salazar. Thank you very much, Chairman Craig and 
Ranking Member Akaka and Chairman Susan Collins and Ranking 
Member Lieberman, for holding this hearing.
    Let me just say I think my colleagues have stated the 
concerns that we all share. And I know that Secretary Nicholson 
has also stated his concerns and how appalled he is about what 
has happened here with the records of 26.5 million veterans. It 
is a huge issue that we need to address and we need to address 
effectively to make sure that we prevent this kind of thing 
from ever happening again.
    Secondly, we need to make sure that we are taking every 
step in the world possible to safeguard the getting out of this 
information, from where ever this information happens to be 
today.
    But I also think it calls into question, even beyond the 
VA, what is happening with respect to all other Government 
agencies that have huge amount of information and the 
safeguarding of that information in the new kind of technology.
    I was thinking about 26.5 million names and records related 
to 26.5 million names. You know, 20 or 30 years ago you would 
never be able to put that into any kind of a file on a laptop. 
Well, that has all changed. And I think part of what we are 
seeing here is somehow the policies and oversight of 
information within our Government has not kept pace with the 
new technological capacities that have been developed with the 
computer capacities that we currently have.
    So I look forward to working with you, Secretary Nicholson, 
to get us to a solution that will address the issue within the 
VA, but also I think for all of us in Government, we need to 
understand that this is an issue that also goes beyond the VA.
    Thank you and I have a more formal statement for the 
record, Mr. Chairman.
    Chairman Craig. Without objection, it will be a part of the 
record.
    [The prepared statement of Senator Salazar follows:]

   Prepared Statement of Hon. Ken Salazar, U.S. Senator from Colorado

    I want to start by thanking Chairman Craig, Chairman Collins, 
Senator Akaka, and Senator Lieberman for bringing together this 
critical hearing on such short notice. As we all know, one of the 
central questions in this troubling incident relates to whether or not 
the VA could have responded more quickly to the news that the personal 
information of 26.5 million veterans had been compromised. In light of 
those concerns, I believe it is imperative for Congress to act as 
quickly as possible to address this situation, and I hope today's 
hearing will set an example.
    I also want to thank today's panelists for agreeing to come before 
our committees today to discuss this important matter. I realize that 
many of you had to change your plans to be able to be here. But our 
veterans weren't planning on having their information put at risk, 
either, and it's important we do everything within our power to protect 
them during what must be a worrisome time. So, thank you.
    I am extremely troubled by what we learned earlier this week from 
the Department of Veterans' Affairs. First and foremost, I share the 
concern of our Nation's veterans about the potential for misuse of 
their names, birthdates, and Social Security numbers, and the 
consequences--both personal and financial--that could result.
    What is most troubling to me is the nature of the information that 
has been compromised. This is not like losing your keys or your credit 
card, where you can change your locks or your account information. 
These are the fundamental keys to a person's identity, and they could 
be used to open a bank account, take out a loan, obtain lines of 
credit, buy property--and the list goes on. The lives of millions of 
our Nation's veterans could be turned upside down as a result of this 
security lapse.
    Second, this incident raises serious questions about the gaping 
holes in security that exist at VA, and about why more hasn't been done 
about them in recent years. We have known that VA's security safeguards 
are insufficient for years, and yet very little has been done to 
prevent the kind of theft we saw earlier this month. We need to know 
why, and we need to know what the VA plans to do now to ensure this 
kind of nightmare never happens again.
    Finally, as I have mentioned, we need to know more about how this 
event and VA's response to this event unfolded, and why the department 
did not act more quickly to notify law enforcement, Congress, and most 
importantly, our veterans.
    I look forward to working with my colleagues to address this issue. 
I have written to VA urging the department to do everything it can to 
protect our veterans and make sure it doesn't happen again. I am also a 
cosponsor of legislation introduced by Senator Kerry that would require 
VA to provide 1 year of free credit monitoring to affected individuals, 
and one free credit report each year for 2 years thereafter.
    Our Nation owes a debt to our veterans that can never be fully 
repaid. It is deeply concerning to me that the very agency responsible 
for providing these veterans with the care and services they have 
earned failed to protect their most basic personal information. For 
that reason, I am hopeful that we can get to the bottom of some of 
these issues today.
    Thank you.

    Chairman Craig. Senator Chafee.

             STATEMENT OF HON. LINCOLN D. CHAFEE, 
                 U.S. SENATOR FROM RHODE ISLAND

    Senator Chafee. Thank you, very much, Mr. Chairman. 
Welcome, Secretary.
    I share my colleagues great, great concern about what 
occurred and want to work with you, after appropriate 
investigations and reviews are done, to any legislative fixes 
or funding concerns you might have to rectify the situation.
    I noticed in your opening statement, no specific requests 
at this point. But maybe after further reviews and 
investigations, there will be some concrete requests. I look 
forward to working with you on that, and also with Inspector 
General Opfer.
    Thank you, Mr. Secretary. Thank you, Mr. Chairman.
    Chairman Craig. Senator, thank you.
    Senator Pryor.

                 STATEMENT OF HON. MARK PRYOR, 
                   U.S. SENATOR FROM ARKANSAS

    Senator Pryor. Thank you, Mr. Chairman.
    I think most of our colleagues here have covered my 
concerns with the VA and the bad news that we received in the 
last few days regarding the VA. But I do think that this is a 
reminder again, for Members of the Senate and Members of the 
House, that we need to act. And we need to spend time working 
through solutions for this so that the American public can 
protect itself.
    One thing we passed last year, I guess or in the last 
several months, in the Commerce Committee is a security freeze 
bill. Basically what that would allow Americans to do is work 
through a credit bureau and freeze their financial information 
so that someone could not tap into that, get credit cards, 
loans, et cetera, in their name without their permission.
    So, here you have a breach of 26-whatever million veterans 
and the security freeze would allow every person, if they chose 
to, to protect themselves in that way. So I think it is a good 
common-sense solution. It is something that has been through 
the Committee. Hopefully, Senator Frist and Senator Reid will 
work out some time on the floor. I would love to have you all 
look at it when it gets to the floor. I think it is something 
that once you understand what it does and once you see it, you 
will realize the American public would really like to have this 
option to protect themselves against things like this.
    Thank you, Mr. Chairman.
    Chairman Craig. Thank you.
    Mr. Secretary, again welcome to the Committee. Please tell 
us you are mad as hell.

       STATEMENT OF HON. R. JAMES NICHOLSON, SECRETARY, 
DEPARTMENT OF VETERANS AFFAIRS; ACCOMPANIED BY TIM S. McCLAIN, 
        GENERAL COUNSEL, DEPARTMENT OF VETERANS AFFAIRS

    Secretary Nicholson. You can count on that, Mr. Chairman.
    Chairman Craig. Thank you.
    Secretary Nicholson. Mr. Chairman, Members of the 
Committee, I appreciate having this opportunity to appear 
before you to talk about this devastating occurrence that has 
happened in my agency and come to my attention only recently 
and was announced to the veterans and to the public and to the 
Congress this past Monday.
    I am the person ultimately responsible to our veterans. And 
therefore, I am the person responsible for this situation. This 
responsibility rests on me.
    A VA employee, a data analyst, took home electronic data 
files from the VA. He was not authorized to do so. His house 
was burglarized and the data were stolen. This happened on May 
3rd.
    If this were not bad enough, I was not notified about this 
event until May 16th. So I can tell you, as a 34-year veteran 
myself, I am mad as hell. I am outraged by all of this. I am 
outraged that this employee would do this so recklessly. And I 
am outraged that I was not notified of it sooner.
    But I still must carry on and lead the efforts needed to 
get to the bottom of this and take the corrective actions to 
see that this does not happen again. My compass for this is the 
veterans. I feel so badly for them and what they are going 
through potentially and the anxiety that this is causing and 
what it could cause.
    As has been said, these stolen data contained the 
information, including the names and date of birth, for 26.5 
million veterans and some spouses. In addition, that 
information, plus Social Security numbers, were available for 
some 19.6 million of those veterans, of those 26.5 million. 
Also included possibly were some numerical disability ratings 
and the diagnostic codes that identify their disability.
    It is good to note that the data did not include any VA 
electronic health records. Neither did it contain explicit 
financial information, although knowing a disability rating 
code could lead one to compute at least what that compensation 
payment was.
    On May 3rd this employee's home was broken into and local 
law enforcement was notified immediately. They report that they 
think this was a routine breaking and entering. That is, it was 
not a targeted burglary. It was a random burglary.
    The employee has been placed on administrative leave 
pending the outcome of this investigation, with which he is 
cooperating.
    As I have said, I am a veteran and this is just 
incredulous. I am so damned mad at the loss of our veterans 
data and the fact that one person could put all of us at risk, 
one person in violation of VA policies.
    I am just as mad and disappointed that I was not made aware 
of this before I was.
    So, I am upset about the timing of our response. I will not 
tolerate inaction and poor judgment when it comes to protecting 
our veterans.
    Appropriate law enforcement agencies, including local 
police, the FBI, and the Inspector General, have now launched 
full-scale investigations. Authorities believe it is unlikely 
the perpetrators targeted the items stolen because of any 
knowledge of the data contents. It is possible that the thieves 
remain unaware of the information they possess and how to make 
use of it.
    Because of that, we attempted to not be too specific about 
the description of the equipment stolen, the location from 
which it came and other information in general. We do not want 
to provide information to the thieves that might be more 
helpful to the nature of what they have and we still hope this 
was a common theft and that no use will be made in this VA 
data.
    From the moment I was informed, the VA began taking all 
possible steps to protect and inform our veterans. However, 
there were those in the law-enforcement community who wanted me 
to wait longer before announcing this theft, so as to pursue 
leads and to keep the burglars in the dark. I chose to inform 
our veterans nevertheless, but limiting the details of where 
and when initially so as not to tip our hand to the robbers.
    Whether it is one veteran or the numbers we are talking 
about here today, the VA needed to act in a manner that 
maintained a balance between protecting them and informing the 
perpetrators. I chose to get the information out at that point 
to the veterans, in spite of the continuing investigations.
    Another very disturbing aspect of this is that although it 
happened on May 3rd, and this employee informed his boss of 
this fact on that day, as I said, I was not made aware until 
May 16th. Equally disturbing is that Federal law enforcement 
head and investigating agencies were not informed immediately 
either. Local were, but not Federal. It was not until May 10th 
that the VA IG became aware of it.
    I cannot explain these lapses in judgment on the part of my 
people. Most of them are really great, hard-working people. It 
makes me so angry and disappointed. And after the IG finishes 
his investigation as to exactly what happened, I plan to take 
decisive actions. I have to.
    The VA now has also begun a relentless examination of our 
policies and procedures to find out how we can prevent 
something like this from happening again. We will stay focused 
on the problems until we get them fixed. I have formed a 
special task force to examine comprehensively all of our 
information programs and policies to bring about a ringing 
change in the way we do business.
    I have begun recruiting to see if I can find the right 
individual to come into our agency to be the personal 
information security czar, if you will, who has nothing else in 
his or her portfolio, to focus on that and report directly to 
me.
    As has been stated here, ever since 1999 the VA has gotten 
low marks from the IG on its information and cyber security 
programs. Last year the GAO flunked the VA on its cyber 
security system. This has got to change.
    This situation is exacerbated by the fact that the 
Assistant Secretary for IT, who had been at the VA for about 
2\1/2\ years, has just recently resigned. He had come to the VA 
from the private sector, from Dell. He has returned to the 
private sector. He did a very good job and I will say that I 
think we are off to a real solid start in the IT transformation 
that we are doing.
    And this is beyond the scope here, but VA has gotten 
decentralized down literally to almost clinics, of which there 
are 900. We are pulling this back into a centralized format in 
this major IT transformation that we are in. And that is 
launched. But as is painfully evident, we have a great deal to 
do.
    I was also pleased that just yesterday, President Bush 
announced his intention to nominate a brilliant, recently 
retired Navy Admiral that we have recruited to come into our 
agency to head up our Office of Policy and Planning, which is 
the office in which this transgression occurred. We hope to 
have him on board very soon.
    Additionally, we are taking direct and immediate action to 
address and alleviate veterans' concerns and to regain their 
confidence. Those actions include that we have directed all VA 
employees to complete the VA Cyber Security Awareness Training 
Course and a separate General Employee Privacy Awareness course 
and to do so by June 30th of this year.
    I have also directed that a memo be issued requiring all VA 
employees to sign annually an employee statement of awareness, 
including their awareness of the Privacy Act, their awareness 
as to unauthorized disclosing or using directly or indirectly 
information obtained as a result of their employment in the VA, 
which is of a confidential nature or represents a matter of 
trust, or other information so obtained of such a character 
that its disclosure or use would be contrary to the best 
interest of the veterans and of their awareness of the loss or 
damage or unauthorized use of Government property or its 
carelessness or negligence in its use therein.
    Additionally, the Department will immediately be conducting 
an inventory and review of all current positions requiring 
access to VA data.
    This, I think, is a very important point because, as it 
turns out, we do not know anything about these people. The 
person who took this data home, the last that I can tell, had a 
background check, just a National Agency and Inquiries Check, 
32 years ago. Yet, we entrust this kind of data to people.
    And I might say, by the way, and this is not said in anyway 
as some kind of an excuse, but this man or others, they do not 
have to carry this data out. They can send it out. If they have 
Internet Explorer on their computer, they can send it to their 
account and then get on their own computer and receive it.
    I also would tell you, and please, this is not said in any 
way to excuse or mitigate what happened thus, but I am holding 
in my hand a hard drive. This is unrelated to the equipment in 
this incident. But that data that we are talking about for 
these 26.5 million veterans is 5 gigabytes. This little thing 
right here, that slips so easily into my vest pocket, holds 60 
gigabytes. We could have 12 times the data that is the subject 
of this pain that we are in on this thing, this little hard 
drive.
    This, as you probably all know, which most people that use 
these use them as a key chain, and call them most commonly a 
thumb drive, this would hold about three-quarters of the data 
that we are talking about, this size. Most people that use 
these in my agency have them hanging around their neck with 
their ID card and walk in and out.
    There are lots of things that we are going to have to do as 
an agency, and I think as a Government. But the key, it seems 
like to me, is going to be the law. And by the way, this person 
did not violate any law, because there is no law. We have 
internal policies against what he did. But he did not violate 
the law, as near as I can tell.
    And we are going to have to--for people that have access to 
this kind of data, we are going to have to know something about 
them. If they were in the military and they were privy to 
confidential information, they would have a background 
investigation. And a lot of that, you read in the paper what we 
are giving them access to.
    So, I am proposing that we are going to do an updated 
National Agency Check on those. And for those that have special 
access, request a minimum background investigation.
    I have directed the Office of Information and Technology to 
publish by June 30th a VA directive and revisions to security 
guidelines for single user remote access developed by the 
Office of Cyber and Information Security. This document will 
set the standards for access, for use and information security, 
including physical security and reporting.
    We are working with Members of the Congress, the VSOs and 
the news media and other agencies to ensure that other veterans 
and their families are aware of this situation and the steps 
that they may take to protect themselves for the misuse of 
their personal information.
    We are coordinating with other agencies to send individual 
notifications to all 19.6 million individuals whose Social 
Security numbers were stolen. That is, we are going to send a 
letter to each of these people, instructing them and asking 
them to be both vigilant in order to detect any signs of 
possible identity theft and how to protect themselves.
    As you know, in the meantime, they can go to the Internet 
portal we have established, which is www.FirstGov.gov, for 
information on this matter. And this is a Federal site that is 
capable of handling a great amount of traffic.
    Additionally, we have set up a manned call center that 
veterans can use to get information and learn more about 
consumer identity protections. You can reach that with a toll-
free number of 1-800-333-4636. It operates 14 hours a day and 
will as long as it is needed. It can handle 20,000 calls per 
hour. By the end of the day yesterday, concerned veterans had 
made a total of 105,753 calls to this number.
    I do want to acknowledge the significant efforts of 
numerous Government agencies in assisting the VA to prepare for 
the announcement last Monday. Agencies at all levels pitched in 
to ensure that our veterans had information on actions that 
they could take with respect to their credit. Hundreds of 
people worked around the clock, that is they worked through the 
night, in helping to set up these call centers and get the 
messages composed and out and did a yeoman's job. I want to 
thank each of them and these agencies for their efforts on 
behalf of our veterans.
    The three national credit card bureaus have established 
special procedures to handle inquiries and requests for fraud 
alerts from veterans. Experian and TransUnion have placed a 
front-end message on their existing toll-free fraud lines, 
bypassing the usual phone tree with instructions for placing a 
fraud alert. Equifax has set up a new toll-free number for 
veterans to place fraud alerts.
    The new procedures became operational on Tuesday. The 
bureaus report a spike in phone calls, 171 percent of normal, 
and in requests for free credit report through the annual free 
credit report web site.
    The Federal Trade Commission also experienced high call 
volumes about the incident earlier this week.
    On Monday, the Office of Comptroller of the Currency 
notified its examiners of this theft. On Tuesday, the Office of 
Comptroller posted an advisory on an Internet network available 
to its banks and instructed the examiners to direct their banks 
to the advisory. It explains what happened and asks the banks 
to exercise extra diligence in processing veterans' payments. 
The advisory also reminds banks of their legal obligations to 
verify the identities of persons seeking to open new accounts 
and to safeguard customer information against unauthorized 
access or use and attaches a summary of relevant regulations.
    I briefed the Attorney General and the Chairman of the 
Federal Trade Commission, the co-chairs of the President's 
Identity Theft Task Force, shortly after I became aware of this 
occurrence. They have been very cooperative. Task Force members 
have already taken actions to protect the affected workers, 
including--excuse me, to protect the affected veterans, 
including working with the credit bureaus to help ensure that 
veterans receive free credit reports that they are entitled to.
    Additionally, the Task Force met on Monday to coordinate 
the comprehensive Federal response to recommend further ways to 
protect affected veterans and increase safeguards to prevent 
the recurrence of such incidents. On Monday following the 
announcement of this incident, I also issued a memorandum to 
all VA employees. The purpose was to remind them of the public 
trust that we hold and to set forth the requirements that all 
employees complete their annual general privacy training and 
cyber security for this current year by the end of next month.
    Following that, all will be required to sign a statement of 
commitment and understanding which will acknowledge the 
consequences for noncompliance.
    Information security is challenging business and ultimately 
it depends on the integrity and the ethics of the workforce. As 
has been said here, as technology has advanced, it has become 
possible to store vast quantities of data on devices no larger 
than one's thumbnail.
    All of us carry a cell phone, a BlackBerry or a personal 
digital assistant, and each of these contains vast quantities 
of data. Someone intent on taking this data and using it 
inappropriately has many opportunities to do that.
    It is also the fact that great numbers of people in this 
agency and in this Government telecommute. For example, 
yesterday I was talking to an employee of ours who is an 
information technology specialist. And he told me of needing 
some medical records. He asked for them to be burned onto a CD, 
and that was done and it was delivered to him very promptly and 
neatly.
    And so he wrote the person an e-mail back saying thank you 
for this prompt, efficient work. He said, ``By the way, where 
do you work here in the central office? Maybe we could have a 
cup of coffee some time.'' And the person responded by saying, 
``I do not work in the central office. I work in South 
Dakota.''
    It illustrates how far-flung and distended some of this has 
gotten. We need obviously to know who they are, know what kind 
of people they are out there with this data, and absolutely get 
better control over it.
    And I promise you that we are going to do everything in our 
power to structure a regime at the VA that makes clear what is 
proper in the use of data by our employees and train our 
employees in those policies and enforce them.
    We have already begun discussions regarding the immediate 
automatic encryption of all sensitive information. We will also 
work with the President's Task Force on Identity Theft. I am a 
member of the Task Force. And it will help to structure 
policies that will be put in place throughout the Government to 
help ensure that situations such as this do not occur at other 
agencies.
    In summary, Mr. Chairman and Members of the Committees, I 
want to say that the VA's mission is to serve and honor our 
Nation's veterans, and we take it very seriously. I am also 
proud to say that most of the 235,000 people that work there 
are terrific and take it seriously and are dedicated to our 
veterans. So, I am so saddened by what has happened here, in 
this case by one person, and the anxiety and concern that this 
is causing to our veterans and our families because they have 
enough to deal with.
    We honor the service of our veterans and we consider it a 
privilege to work for them at our agency. I want you and them 
to know that we are and are going to work hard to keep this 
most awful thing from happening again.
    Thank you.
    [The prepared statement of R. James Nicholson follows:]

       Prepared Statement of Hon. R. James Nicholson, Secretary, 
                     Department of Veterans Affairs

    Mr. Chairman and Members of the Committee:
    Thank you for the opportunity to appear before you today to explain 
a devastating situation.
    A VA employee, a data analyst, took home electronic data files from 
VA. He was not authorized to do so.
    These data contained identifying information including names and 
dates of birth for up to 26.5 million veterans and some of their 
spouses. In addition, that information, plus social security numbers, 
was available for some 19.6 million of those veterans. Also possibly 
included were some numerical disability ratings and the diagnostic 
codes which identify the disabilities being compensated.
    It is important to note that the data did not include any of VA's 
electronic health records. Neither did it contain explicit financial 
information, although knowing of a disability rating could enable one 
to compute what that implied in terms of compensation payments.
    On May 3, the employee's home was broken into in what appears to 
local law enforcement to have been a routine breaking and entering, and 
the VA data were stolen. The employee has been placed on administrative 
leave pending the outcome of an investigation with which I understand 
he is cooperating.
    I am outraged at the loss of this veterans' data and the fact an 
employee would put it at risk by taking it home in violation of VA 
policies. However, the employee promptly reported the theft to the 
local police and to the Department of Veterans Affairs. But it was not 
until May 16th that I was notified. I am gravely concerned about the 
timing of the Department's response once the burglary became known. I 
will not tolerate inaction and poor judgment when it comes to 
protecting our veterans.
    Appropriate law enforcement agencies, including local police, the 
FBI and the VA Inspector General's office, have launched full-scale 
investigations into this matter. Authorities believe it is unlikely the 
perpetrators targeted the items stolen because of any knowledge of the 
data contents. It is possible that the thieves remain unaware of the 
information they possess or of how to make use of it. Because of that, 
we have attempted to describe the equipment stolen, the location from 
which it was stolen and other information in very general terms. We do 
not want to provide information to the thieves that might be 
informative as to the nature of what they have stolen. We still hope 
that this was a common theft, and that no use will be made of the VA 
data.
    From the moment I was informed, VA began taking all possible steps 
to protect and inform our veterans.
    In our post-disclosure assessment, we have seen the gaps between 
what we said and the way we are seen.
    VA has begun a top to bottom examination of our business, policies, 
and procedures to find out how we can prevent something like this from 
happening again. We will stay focused on the problems until they are 
fixed. In addition, we will take direct and immediate action to address 
and alleviate veterans' concerns and to regain their confidence.
    I have taken the following actions so far:
     I have directed all VA employees to complete the annual 
``VA Cyber Security Awareness Training Course'' and complete the 
separate ``General Employee Privacy Awareness Course'' by June 30, 
2006.
    This includes:
     The Privacy Act;
     Unauthorized disclosing or using, directly or indirectly, 
information obtained as a result of employment in VA, which is of a 
confidential nature or which represents a matter of trust, or other 
information so obtained of such a character that its disclosure or use 
would be contrary to the best interests of the VA or veterans being 
served by it; and,
     Loss of, damage to, or unauthorized use of Government 
property, through carelessness or negligence, or through maliciousness 
or intent.
     I have also directed that all VA employees sign annually 
an Employee Statement of Commitment and Understanding which will also 
acknowledge consequences for non compliance.
    In addition the Department will immediately begin to conduct an 
inventory and review of all current positions requiring access to 
sensitive VA data. The inventory will determine whether positions in 
fact require such access. We will then require all employees who need 
access to sensitive VA data to do their jobs to undergo an updated 
National Agency Check and Inquiries (NACI) and/or a Minimum Background 
Investigation (MBI) depending on the level of access required and the 
responsibilities associated with their position.
    And I have directed the Office of Information & Technology to 
publish, as a VA Directive, the revisions to the Security Guidelines 
for Single-User Remote Access developed by the Office of Cyber and 
Information Security. I have asked that this be done by June 30, 2006. 
This document will set the standards for access, use, and information 
security, including physical security, incident reporting and 
responsibilities.
    VA is working with Members of Congress, the news media, veterans' 
service organizations, and numerous government agencies to help ensure 
that those veterans and their families are aware of the situation and 
of the steps they may take to protect themselves from misuse of 
personal information.
    VA is coordinating with other agencies to send individual 
notifications to those individuals whose social security numbers were 
stolen, instructing them to be vigilant in order to detect any signs of 
possible identity theft and telling them how to protect themselves. In 
the meantime, veterans can also go to www.firstgov.gov for more 
information in this matter. This is a Federal Government Web site 
capable of handling large amounts of web traffic.
    Additionally, working with other government agencies, VA has set up 
a manned call center that veterans may use to get information about 
this situation and learn more about consumer-identity protections. That 
toll free number is 1-800-FED INFO (333-4636). The call center is 
operating from 8 am to 9 pm (EDT), Monday-Saturday as long as it is 
needed. The call center is able to handle up to 20,000 calls per hour 
(260,000 calls per day). Through the end of the day on Tuesday, 
concerned veterans had made a total of 105,753 calls to this number.
    I want to acknowledge the significant efforts of numerous 
government agencies in assisting VA to prepare for our announcement on 
May 22nd. Agencies at all levels of the Federal Government pitched in 
to ensure that our veterans had information on actions they could take 
to protect their credit. Hundreds of people worked around the clock 
writing materials to inform the veterans and setting up call centers 
and a website to ensure maximum dissemination of the information. I 
want to personally thank each of those agencies and those individuals 
for their selfless efforts on behalf of our veterans.
    The three nationwide credit bureaus have established special 
procedures to handle inquiries and requests for fraud alerts from 
veterans.
    Experian and TransUnion have placed a front-end message on their 
existing toll-free fraud lines, bypassing the usual phone tree, with 
instructions for placing a fraud alert. Equifax has set up a new toll-
free number for veterans to place fraud alerts. The new Equifax number 
is 1-877-576-5734. The new procedures became operational on Tuesday. 
The bureaus report a spike in phone calls (171 percent of normal) and 
in requests for free credit reports through the annual free credit 
report web site (annualcreditreport.com). The Federal Trade Commission 
also experienced high call volumes about the incident earlier this 
week.
    On Monday, the Office of Comptroller of the Currency notified its 
examiners of the theft. On Tuesday, OCC posted an advisory on an 
internal network available to its banks and instructed the examiners to 
direct their banks to the advisory. It explains what happened and asks 
the banks to exercise extra diligence in processing veterans' payments. 
The advisory also reminds the banks of their legal obligations to 
verify the identities of persons seeking to open new accounts and to 
safeguard customer information against unauthorized access or use. It 
also includes a summary of relevant laws and regulations.
    I briefed the Attorney General and the Chairman of the Federal 
Trade Commission, co-chairs of the President's Identity Theft Task 
Force, shortly after I became aware of this occurrence.
    Task Force members have already taken actions to protect the 
affected veterans, including working with the credit bureaus to help 
ensure that veterans receive the free credit report they are entitled 
to under the law. Additionally, the Task Force met on Monday to 
coordinate the comprehensive Federal response, recommend further ways 
to protect affected veterans, and increase safeguards to prevent the 
recurrence of such incidents.
    On Monday, following the announcement of this incident, I also 
issued a memorandum to all VA employees. The purpose was to remind them 
of the public trust we hold and to set forth the requirement that all 
employees complete their annual General Privacy Training and VA Cyber 
Security Awareness training for the current year by June 30.
    As technology has advanced, it has become possible to store vast 
quantities of data on devices no larger than one's thumb. All of us 
carry a cell phone, a BlackBerry or a Personal Digital Assistant, and 
each of these contains vast quantities of data. Someone intent on 
taking such data and using it inappropriately would have many 
opportunities to do that.
    I can promise you that we will do everything in our power to make 
clear what is appropriate and inappropriate use of data by our 
employees. We will train employees in those policies, and we will 
enforce them. We have already begun discussions regarding the immediate 
automatic encryption of all sensitive information.
    We will also work with the President's Task Force on Identity 
Theft, of which I am a member, to help structure policies that will be 
put in place throughout the government to ensure that situations such 
as this do not occur at other agencies.
    VA's mission to serve and honor our Nation's veterans is one we 
take very seriously and the 235,000 VA employees are deeply saddened by 
any concern or anxiety this incident may cause to those veterans and 
their families. We honor the service our veterans have given their 
country and we are working diligently to protect them from any harm as 
a result of this incident.
                                 ______
                                 
    Response to Written Questions Submitted by Hon. Daniel K. Akaka 
                       to Hon. R. James Nicholson

    On February 11, 2005, Office of Management and Budget (OMB) Deputy 
Director for Management Clay Johnson issued a memorandum directing each 
agency to designate a senior official who would have agency-wide 
responsibility for privacy issues relative to information management.
    Question 1a. Who is VA's senior privacy official? When was this 
position established at VA?
    Question 1b. What training does VA's designated privacy official 
receive? Is this training then passed on to all agency personnel? 
Please provide a copy of the training documents VA provides its 
employees.
    Question 1c. I understand that OMB meets with all the agencies' 
senior privacy officials and their teams to review the status of the 
agencies' privacy programs. Has OMB met with VA's privacy official, and 
if so, do you know what OMB found with respect to VA's privacy program? 
If problems were found, how has VA addressed the problems identified? 
Are the problems identified by OMB still remain at VA?
    Question 1d. If the privacy official has a concern about an agency 
practice or program, what enforcement authority does he or she have? To 
whom does the senior privacy official report?
    Question 1e. What is the working relationship between the VA 
privacy official and Privacy and Civil Liberties Oversight Board?
    Question 2. Recently VA announced the naming of Special Advisor for 
Information Security. What will be the role and responsibilities of the 
Special Advisor? How will the responsibilities and duties of this 
official differ from those assigned to the senior privacy official? How 
will this individual work with the senior official designated for 
privacy issues and the Chief Information Officer at VA?
    Question 3. The Privacy Act does not require the VA to provide 
notice of a data breach. What Federal or state law required the VA to 
notify the public of the data breach?
    Response. VA did not respond to the questions.
                                 ______
                                 
          Written Questions Submitted by Hon. Norm Coleman to 
                        Hon. R. James Nicholson

    The senior VA employee who took the sensitive information home was 
working on a project which involved improving telephone interactions 
between the Department and Veterans. While the employee was authorized 
to have access to this data in connection with the project, the 
employee was not authorized to take the data home to work on it. 
Although the employee received the required training on protecting the 
privacy and security of this kind of information and knew it was 
against VA policy, the employee still chose to take it home.
    Question 1a. How confident are you that other VA employees do not 
similarly have confidential data in their homes? Can we be 100 percent 
confident?
    Question 1b. Would you say it is routine for employees who have 
access to sensitive information to remove it from the VA to work on at 
home? Is it easy to remove this information?
    Question 1c. Is there any way for you to know how many employees 
remove sensitive information from the VA?
    Question 1d. Are employees aware of the penalties for removing 
sensitive information from the VA? Can you tell us what the penalties 
are?
    Mr. Secretary, you found out about the security breech on May 16th, 
yet veterans were not informed until May 22nd. On May 19th, the 
Inspector General and your staff decided not to go public because the 
hotline being established by the FTC to handle veterans' calls had not 
been fully set up. However, when this type of security breech has 
happened in the private sector, consumers have been alerted very 
quickly, often in less than 24 hours.
    Question 2a. Do you still think it was the right decision to wait 
to inform veterans that their information may have been compromised?
    Question 2b. What would have been the downside to making an 
announcement so veterans could begin reviewing their financial 
information while putting information on your website and saying a call 
center would be up and running in a few days?
    Question 2c. Are you getting any feedback on whether the call 
centers are helpful? Is the VA partnering with the Veterans Service 
Organizations to provide information to their members about what 
happened and what they can do to protect this information?
    On May 3rd, the same day as the discovery of the burglary and 
theft, the VA employee called and reported to a supervisor and VA 
security officials the loss of sensitive privacy data. However, Mr. 
Secretary, you did not find out until almost 2 weeks later on May 16th.
    Question 3a. Do you recall your reaction when you found out about 
this?
    Question 3b. Did you inquire why something of this magnitude took 
almost 2 weeks to reach your desk?
    Question 3c. When did you become aware that your Chief of Staff 
knew this information a week earlier?
    Question 3d. Do you know why you were not told at that time of what 
had happened?
    Question 3e. Is it customary for important matters such as this to 
be caught up in bureaucracy for 2 weeks or is there a system in place 
to get things to you quicker? If so, do you know why this information 
did not get to you sooner?
    Since 2001, the VA Inspector General has warned that access 
controls were a ``material weakness'' in the department's security of 
information. Vulnerabilities cited included operating systems, 
passwords, and a lack of strong detection alerts. While this case 
involved a VA employee with authorized access to sensitive information, 
I am concerned the VA is also vulnerable to a cyber-attacker without 
authorized access that breaks into the system and removes sensitive 
information.
    Question 4a. Mr. Secretary, how vulnerable is the VA to a cyber-
attack from someone outside of the VA who has no authorization to any 
VA information?
    Question 4b. Were you aware of the VA Inspector General's reports 
that were critical of the department's information protection systems?
    Question 4c. What actions has the department taken to improve 
information security since you became Secretary in February, 2005?
    Response. VA did not respond to the questions.
                                 ______
                                 
        Written Questions Submitted by Hon. Pete V. Domenici to 
                        Hon. R. James Nicholson

    Question 1. In recent years identity theft has become a major issue 
in this country. Given that the theft of personal information is 
nothing new, what policies and procedures did the Department of 
Veterans Affairs have in place prior to this incident to insure the 
personal data of our Nation's veterans was protected?
    Question 2. It is my understanding that to date there is no 
evidence anyone has illegally used the missing data belonging to 26.5 
million of our Nation's veterans including names, social security 
numbers, and dates of birth. However, I am particularly concerned for 
those veterans who are retired or nearing retirement and who may be on 
a fixed income and therefore less able to respond to the consequences 
of identity theft. How is the VA preparing to minimize the disturbance 
to their lives in the event this stolen information is improperly used? 
Furthermore, what steps has the VA taken to notify the 26.5 million 
veteran's involved in this incident?
    Question 3. In light of this loss of information, I think it is 
clear the Department of Veterans Affairs must take steps to better 
protect sensitive personal data in the future. At this time, what 
changes has the VA implemented or plans to implement to insure veterans 
do not have to face the fear of their personal information being 
misused in the future?
    Response. VA did not respond to the questions.
                                 ______
                                 
       Written Questions Submitted by Hon. Lincoln D. Chafee to 
                        Hon. R. James Nicholson

    Question 1. Members of our military have risked their lives in 
service of our country. Our grateful Nation fully supports veterans 
programs, including medical, educational, employment, and other 
assistance. I too support these important programs. In all times, and 
especially in a time of war, ensuring our veterans receive the best 
medical care is our Nation's duty. Earlier this year, in his budget 
request, the President proposed higher fees and co-pays for certain 
veterans receiving VA assistance. In my view, a policy that leads to 
increased denial of service to veterans is simply unacceptable, which 
is why I cosponsored an amendment to the Budget allocating money for 
the government to cover these costs. Secretary Nicholson, what are you 
doing to make sure quality VA care remains accessible to all veterans 
who need it?
    Question 2. Battlefield medicine has made huge strides in the last 
few decades. The result has been a much higher percentage of wounded 
soldiers living through their initial injuries, able to return home to 
their families. These wonderful advances in medicine deserve our 
praise, but they mean that the VA will be caring for more and more 
injured soldiers as they return home. Many of these injuries, such as 
burns, amputations, blindness, and PTSD, are of the type that will 
require care for a lifetime. How is the VA preparing for an increase in 
the number of veterans who will require long term medical assistance? 
Furthermore, how is the VA making sure it immediately cares for 
returning Iraq War veterans, but does not forget about those older 
veterans who continue to require medical assistance?
    Response. VA did not respond to the questions.

    Chairman Craig. Mr. Secretary, thank you very much.
    As you have noted, the Secretary is accompanied by Tim 
McClain, who is General Counsel for the Department of Veterans 
Affairs.
    You will notice there are two empty chairs. George Opfer, 
Inspector General for the Department of Veterans Affairs, I do 
not know if he was held hostage. At least he was detained in 
the U.S. House of Representatives. And I understand he is en 
route or nearly here. So the moment he arrives, we will allow 
him to make his statement before we go to questions. In the 
meantime, I will ask the Secretary a question.
    Mr. Secretary, you have mentioned, as many of our 
colleagues here have mentioned, that there has been a long 
history of Inspector General review and litany recommending 
greatly improved informational technology security at VA. In 
fact, a grade of ``F'' and the word flunk have been used.
    I do not know if this is the ultimate wake-up call, but it 
most assuredly appears to be.
    Does VA have some legitimate reason why it ignored IT 
security recommendations from the IG for 4 years running?
    Now I know your watch has not been during all of those 
periods of time. But I am greatly concerned that it took 
something like this to begin to unravel the rigidity of a 
bureaucracy that would deny the legitimate approach of an 
overall encompassing IT system that now we must get at the 
business of doing.
    Your reaction.
    Secretary Nicholson. My reaction, Mr. Chairman, is that 
there is no excuse for this. I have been there 15 months and I 
am aware of those previous years' reports and the assessment 
that we got. We did launch this significant change in the way 
that we are going to do IT business by pulling it back and 
centralizing it, which would give us considerably more control 
and accountability. But that is just in the launch phase.
    I also have discovered that there have been directives that 
have been issued by my predecessor to which there has been no 
attention given. There are directives that have come out which 
are called guidelines, which some employees do not interpret as 
being mandatory or operative to them, because they are a 
guideline. I have had that discussion just yesterday with some 
employees in that respect.
    So the whole thing needs to really be tightened up. We are 
on that path, I will say, and give the recently departed CIO 
credit for getting us there. But it is nascent, just starting.
    Chairman Craig. Mr. Opfer, we appreciate your being able to 
make it.
    We will allow you to sit down and take a deep breath, and 
we would ask that you--the Secretary has just completed his 
statement and we were just starting into a round of questions. 
But we want you to make your statements so that the questions 
of my colleagues can be directed to either of you.
    You are accompanied by Jon Wooditch is that correct?
    Mr. Opfer. Yes, sir.
    Chairman Craig. Deputy Inspector General, Department of 
Veterans Affairs.
    So Mr. Inspector General, please proceed with your 
statement, if you would, please.

     STATEMENT OF HON. GEORGE J. OPFER, INSPECTOR GENERAL, 
DEPARTMENT OF VETERANS AFFAIRS; ACCOMPANIED BY JON A. WOODITCH, 
                   DEPUTY INSPECTOR GENERAL, 
                 DEPARTMENT OF VETERANS AFFAIRS

    Mr. Opfer. Thank you, Mr. Chairman and Members of the 
Committee. Thank you for the opportunity to testify today on 
the loss of VA sensitive data.
    I am prepared to give a short statement and request that my 
full statement be submitted for the record.
    Chairman Craig. Without objection, it will.
    Mr. Opfer. I am accompanied, as you said, Mr. Chairman, by 
Jon Wooditch, the Deputy Inspector General, and Mike Stanley, 
the Assistant Inspector General for Audits.
    My statement will focus on the incident involving a VA 
employee who took home sensitive data and confidential 
information which was stolen from the employee's home when it 
was burglarized.
    Our involvement in this matter from the IG perspective is 
threefold. One, an ongoing criminal investigation into the 
theft of the data. Two, an administrative investigation. And 
three, a review of the VA policies and procedures for using and 
protecting privacy data.
    In addition to discussing each of these reviews, my 
statement will also provide an overview of the OIG reports that 
have shown the need for continued improvements in addressing 
information security weaknesses in VA and the status of those 
OIG recommendations for corrective action.
    On May 3rd, the home of a VA employee was burglarized. 
According to the employee, information stolen included the 
names, birth dates and Social Security numbers of approximately 
26.5 million veterans that was stored on his personally owned 
computer hardware. The employee said that he routinely took 
sensitive data home to work on and has been doing so since 
2003.
    On Wednesday, May 10th, an Information Security Officer of 
the OIG, while attending a routine meeting at VA, heard that a 
VA employee's home had been burglarized and that VA electronic 
records may have been stolen. Following the meeting, the OIG 
employee gathered additional facts about the incident. On the 
following day, he submitted a written report to alert the 
Office of Investigations of the Office of Inspector General.
    On May 12th, the OIG opened a criminal investigation and 
initiated efforts to locate and interview the employee and 
those others that had information regarding the theft of the 
sensitive data.
    On May 15th, we interviewed the employee. The employee 
advised us that he believed several electronic files containing 
veteran information stored on his personally owned computer 
hardware had been stolen during a burglary. He thought that 
stolen information included the names, birth dates and Social 
Security numbers of approximately 26.5 million veterans.
    On May 16th, we met with the Montgomery County Police 
Department, who had initiated an investigation of the burglary. 
We informed the Montgomery County Police Department of the 
suspected loss of millions of veterans' personal identifiers. 
We learned that the detectives were actively pursuing leads 
developed in a number of recent burglaries in the employee's 
neighborhood.
    On May 17th, we advised the FBI and the Assistant United 
States Attorney of the details of the burglary and the possible 
loss of the data. On the next day, we also faxed a letter 
listing these details to the FBI.
    Since then we have been conducting a joint investigation 
focused on the recovery of the stolen data. To date, we have 
received no indication or information that the data has been 
further compromised.
    In the administrative investigation, our investigation will 
determine if notifications of the incident were made, and if 
those notifications were pursued in an appropriate and timely 
manner. We are developing a chronology of when key staff and 
managers were informed of the incident, what information was 
conveyed to these individuals, and what actions they took.
    As part of the investigation, we will determine if the work 
the employee was performing at home was related to his official 
duties and if he had appropriate authorization to take 
individually identifiable data to his residence. We will also 
determine if the employee complied with relevant policies and 
procedures.
    The recent incident also raises concerns about whether VA 
has adequate policies and procedures in place to protect 
confidential and privileged information maintained in VA 
electronic databases. To address this issue, we have initiated 
a review to determine whether VA has effective policies to 
ensure compliance, whether VA employees are aware of these 
policies, and whether there is an effective mechanism for 
reporting violations and taking appropriate actions.
    The review will identify strengths and weaknesses in VA 
policies. We will make recommendations for improvement to 
ensure the data maintained by VA is protected from unwanted 
intrusion and disclosure.
    In closing, I would like to assure the Committee that this 
matter will remain the highest priority in the OIG until it is 
resolved. I will assure you that all of the resources that we 
have that are needed to complete our reviews in a thorough and 
timely matter will be dedicated to the goal of recovering the 
stolen data and protecting the Nation's veterans.
    Mr. Chairman and Members of the Committee, thank you again 
for the opportunity to appear and to answer any questions.

    Prepared Statement of Hon. George J. Opfer, Inspector General, 
                     Department of Veterans Affairs

                              INTRODUCTION

    Mr. Chairman, Madam Chairman, and Members of the Committees, thank 
you for the opportunity to testify today on the loss of Department of 
Veterans Affairs (VA) sensitive data. I am accompanied by Jon Wooditch, 
Deputy Inspector General, and Mike Staley, Assistant Inspector General 
for Auditing. My statement will focus on the incident involving a VA 
employee who took home sensitive and confidential information, which 
was stolen when the employee's home was burglarized. The Office of 
Inspector General's (OIG) involvement in this matter involves a three-
pronged approach including (1) a criminal investigation, (2) an 
administrative investigation of the handling of this matter once 
reported to the Department, and (3) a review of VA policies and 
procedures for using and protecting privacy data. In addition to 
discussing each of these reviews, I will also provide an overview of 
the OIG reports that have shown the need for continued improvements in 
addressing information security weaknesses in VA, and the status of OIG 
recommendations for corrective action.
    On May 3, 2006, the home of a VA employee was burglarized. 
According to the employee, the information stolen included the names, 
birthdates, and social security numbers of approximately 26.5 million 
veterans that was stored on personally owned computer hardware. The 
employee, a data analyst, was authorized access to sensitive VA 
information in the performance of his duties and responsibilities. He 
said that he routinely took such data home to work on it, and had been 
doing so since 2003.

                         CRIMINAL INVESTIGATION

    On Wednesday, May 10, 2006, our Information Security Officer (ISO), 
while attending a routine meeting at VA Central Office, heard another 
ISO mention that a VA employee's home had been burglarized and that VA 
electronic records may have been stolen. Following the meeting, our ISO 
gathered additional facts about this incident. On the following day, he 
submitted a written report to his supervisor for the purpose of 
alerting our Office of Investigations. On May 12, 2006, a criminal 
investigation was initiated and efforts commenced to identify and 
interview the employee.
    On Monday, May 15, 2006, we interviewed the employee. The employee 
advised us that he believed that several electronic files containing 
veteran information stored on personally owned computer hardware had 
been stolen during the burglary at his home on May 3, 2006. He thought 
the stolen information included the names, birthdates, and social 
security numbers of approximately 26.5 million veterans.
    On May 16, 2006, we met with the Montgomery County Police 
Department who had initiated an investigation of the burglary when 
notified on May 3, 2006. We informed them of the suspected loss of 
millions of veterans' personal identifiers. We learned that detectives 
were actively pursuing leads developed in a number of recent 
residential burglaries in the employee's neighborhood.
    On May 17, 2006, we apprised the Federal Bureau of Investigation 
(FBI) and an Assistant United States Attorney of the details of this 
burglary and possible loss of data. The next day, we also faxed a 
letter listing these details to the FBI. Since then, we have been 
conducting a joint investigation with the FBI and the Montgomery County 
Police Department focused on the recovery of the stolen data. To date, 
there has been no indication that this data has been further 
compromised.

                      ADMINISTRATIVE INVESTIGATION

    We have also initiated an administrative investigation to determine 
if notifications of the incident were made, and if those notifications 
were pursued in an appropriate and timely manner. We are developing a 
chronology of when key staff and managers were informed of the 
incident, what information was conveyed to these individuals, and what 
actions they took. We are also identifying what VA electronic data the 
employee stored at his home, whether the employee had an official need 
for the data, why he took it to his home, and who in his supervisory 
chain approved or had knowledge that he had done so.
    We have interviewed the employee, his supervisors, project 
managers, and co-workers; privacy, information security, and VA law 
enforcement officials; Office of General Counsel attorneys, including 
the General Counsel; and the VA Chief of Staff. We are also reviewing 
electronic mail messages pertinent to the incident; notes and memoranda 
prepared by the employee, General Counsel, and other staff; 
documentation of the employee's access to VA databases; and other 
pertinent documentation.
    According to the employee, he likely had VA electronic data stolen 
during the burglary of his residence, but he was not certain of the 
type and extent of the specific information taken. He said he believed 
it contained approximately 26.5 million veterans' names, social 
security numbers, and dates of birth, extracted from a VA database, and 
possibly other smaller files containing information about individual 
veterans was also taken. We are currently reviewing the computer discs 
he used to take data home to determine what other information may have 
been stolen.
    The employee, a data analyst, had an official need to access the 
records believed to have been stolen. The nature of his work was 
project-focused and involved manipulating large quantities of data to 
address certain policy issues. The employee told us he took the data 
home for work-related purposes. However, none of his supervisors we 
talked to said they were aware that the employee had taken the file 
containing approximately 26.5 million veterans' records to his 
residence.
    As part of our investigation, we will determine if the work the 
employee was performing at home was related to his official duties, and 
if he had appropriate authorization to take individually identifiable 
data to his residence. We will also determine if the employee complied 
with relevant policies and procedures in taking this information home 
and properly protecting it. Our report will identify what breakdowns 
occurred that may have hindered timely notification and follow-up of 
this incident. Based on our investigation, we will make recommendations 
for appropriate action, if warranted.

      REVIEW OF LAWS, REGULATIONS, AND VA POLICIES AND PROCEDURES 
                ON SAFEGUARDING CONFIDENTIAL INFORMATION

    The recent incident raised concerns about whether the VA has 
adequate policies and procedures in place to protect confidential and 
privileged information maintained in VA's electronic databases. Our 
concerns are whether VA policies are adequate to ensure compliance with 
information security laws, the Privacy Act and other confidentiality 
laws and regulations, and to identify and take action when there is a 
violation of law or policy. There are two sets of laws and implementing 
regulations to protect the integrity of confidential data--computer 
security laws and confidentiality statutes. While the intent of both 
sets of laws is the same--the protection of information--the approach 
is different. Computer security laws ensure that the system 
infrastructure on which the data is maintained electronically is 
protected against unauthorized intrusions such as viruses and 
unapproved access. The Privacy Act and other confidentiality laws and 
regulations protect information by limiting access, use, and disclosure 
of records without authorization from the individual about whom the 
record is maintained.
    To address the issues, we initiated a review to determine whether 
VA has effective policies in place to ensure compliance with computer 
security laws, the Privacy Act and other confidentiality laws and 
regulations, whether VA employees are aware of the policies; whether VA 
has adequate procedures in place to monitor compliance with the 
policies; and, whether the policies include an effective mechanism for 
reporting violations and taking appropriate action. Two areas that we 
are addressing in our review are policies relating to the transfer of 
electronic information from an employee's VA computer to his home or 
alternative work site and the impact centralization versus 
decentralization of VA policy has on ensuring that the integrity of VA 
computer systems and the information stored on those systems is 
maintained.
    The review includes identifying and reviewing applicable laws, 
regulations and policies, including Department-wide policies; policies 
issues by the Veterans Health Administration (VHA), the Veterans 
Benefits Administration (VBA), and other VA entities, policies issued 
by local VA facilities; and mandatory training modules. We are also 
reviewing how policies are disseminated to VA employees; whether VA 
employees are aware of the policies, and whether VA procedures for 
identifying, reporting and taking action when data has been improperly 
accessed or improperly used are adequate.
    This review will identify strengths and weaknesses in VA's policies 
implementing the provisions of computer security laws and the Privacy 
Act, and other confidentiality laws. We will also identify strengths 
and weaknesses in ensuring that VA employees are knowledgeable 
regarding their obligation to protect VA computer systems and 
information and that they will be held accountable for violations. We 
will make recommendations for improvement to ensure that data 
maintained by VA is protected from unwarranted intrusion and 
disclosure.

   SUMMARY OF OIG REPORTS ADDRESSING INFORMATION SECURITY WEAKNESSES

    We have conducted a number of audits and evaluations on information 
management security and information technology (IT) systems that have 
shown the need for continued improvements in addressing security 
weaknesses. My office has reported VA information security controls as 
a material weakness in its annual Consolidated Financial Statement 
(CFS) audits since before fiscal year (FY) 2001. Our Federal 
Information Security Management Act (FISMA) reviews have identified 
significant information security vulnerabilities since fiscal year 2001 
that place VA at risk of denial of service attacks, disruption of 
mission-critical systems, and unauthorized access to sensitive data. We 
continue to report security weaknesses and vulnerabilities at VA health 
care facilities and VA regional offices where security issues were 
evaluated during our Combined Assessment Program (CAP) reviews.

Consolidated Financial Statement Audits Continue to Report Information 
        Security as a Material Weakness
    Pursuant to the Chief Financial Officers Act of 1990, the VA 
consolidated financial statements are audited annually. We contract 
with an independent public accounting firm to perform this audit. As 
part of the audit, the contractor follows Government Accountability 
Office methodology to assess the effectiveness of computer controls. 
The contractor conducts audits at VA's three information technology 
centers and selected regional offices and medical centers.
    As part of the CFS audit, IT security controls have been reported 
as a material weakness for many years. A material weakness is defined 
as a weakness in internal control of VA systems that could have a 
material effect on the financial statements and not be detected by 
employees in the normal course of their business. We have reported that 
VA's program and financial data are at risk due to serious problems 
related to VA's control and oversight of access to its information 
systems. By not controlling and monitoring employee access, not 
restricting users to only need-to-know data, and not timely terminating 
accounts upon employee departure, VA has not prevented potential risk. 
These weaknesses placed sensitive information, including financial data 
and sensitive veteran medical and benefit information, at risk, 
possibly without detection of inadvertent or deliberate misuse, 
fraudulent use, improper disclosure, or destruction.
    As a result of these weaknesses, we made recommendations that VA 
pursue a more centralized approach, apply appropriate resources, and 
establish a clear chain of command and accountability structure to 
implement and enforce IT internal controls. We also recommended that VA 
improve access control policies and procedures for configuring security 
settings on operating systems, improve administration of user access, 
and detect and resolve potential access violations. Finally, we 
recommended that VA conform access privileges to the user's level of 
responsibility and position.
    VA has implemented some recommendations for specific locations 
identified but has not proactively made corrections VA-wide. For 
example, we found violations of password policies which management 
immediately corrected, but in following years, we found similar 
violations at other facilities. We also found instances of terminated 
or separated employees with access to critical systems identified at 
various locations which management corrected, only to discover similar 
instances elsewhere.

Evaluations of VA's Information Security Program Have Identified 
        Serious Vulnerabilities for Several Years That Remain 
        Uncorrected
    FISMA requires us to annually review the progress of the 
information technology and security program of the Department and 
report the results to the Office of Management and Budget. As part of 
the FISMA review, we conduct scanning and penetration tests of selected 
VA systems to assess controls for monitoring and accessing systems, and 
reviews of physical, personnel, and electronic security. We visit all 
three major IT centers and selected VHA and VBA sites.
    In all four audits of the VA Security Program issued since 2001, we 
reported serious vulnerabilities that remain uncorrected. These reports 
highlight specific vulnerabilities that can be exploited, but the 
recurring themes in these reports are the need for centralization, 
remediation, and accountability in VA information security. Since the 
fiscal year 2001 report, we reported weaknesses in physical security, 
electronic security, wireless security, personnel security, and FISMA 
reporting. Additionally, we have reported significant issues with 
implementation of security initiatives VA-wide. The status of 
unimplemented recommendations was discussed in subsequent audits.
    The fiscal year 2004 audit once again emphasized the need to 
centralize the IT security program, implement security initiatives, and 
close security vulnerabilities. We recognized that the CIO's office 
needed to be fully staffed, and that funding delays and resistance by 
offices to relinquish their own security functions and activities 
delayed implementation of the fully centralized CIO contemplated by our 
prior recommendations. The CIO's comments to the report referenced an 
April 2004 VA General Counsel opinion that held the CIO lacked the 
authority to enforce compliance with the VA information security 
program as one reason he could not address vulnerabilities. We again 
recommended that VA fully implement and fund a centralized VA-wide IT 
security program.
    In total, the fiscal year 2004 report included 16 recommendations: 
(1) centralize IT security programs; (2) implement an effective patch 
management program; (3) address security vulnerabilities of 
unauthorized access and misuse of sensitive information and data 
throughout VA demonstrated during OIG field testing; (4) ensure 
position descriptions contain proper data access classification; (5) 
obtain timely, complete background investigations; and complete the 
following security initiatives on (6) intrusion detection systems, (7) 
infrastructure protection actions, (8) data center contingency 
planning, (9) certification and accreditation of systems, (10) 
upgrading/terminating external connections, (11) improvement of 
configuration management, (12) moving VACO data center, (13) 
improvement of application program/operating system change controls, 
(14) limiting physical access to computer rooms, (15) wireless devices, 
and (16) electronic transmission of sensitive veteran data. As of May 
23, 2006, all recommendations from this report remain open.
    Finally, in fiscal year 2006, after Congress mandated full 
centralization of IT security under the CIO, as we advocated in our 
reports since 2001, VA is now moving out on a truly empowered 
centralized CIO. We have provided our draft fiscal year 2005 audit 
report to the Department and are working with the Department to resolve 
all outstanding recommendations. We have grouped our recommendations 
into two categories--the CIO's authority under centralization and 
longstanding vulnerabilities. With a centralized CIO with direct line 
authority to implement the needed fixes, we believe VA has a unique 
opportunity to successfully address all the vulnerabilities and 
weaknesses discussed in our reports since 2001.
    We believe centralization is essential because standardization is 
the key to fixing VA information security weaknesses. As long as three 
stove-piped administrations and other smaller component organizations 
are free to operate in the IT environment on their own within VA--
accountable not to the CIO but to other line managers who themselves 
are not accountable to the VA CIO--the vulnerabilities cannot be 
effectively resolved.

CAP Reviews Continue To Show Information System Security 
        Vulnerabilities Continue To Exist
    We continue to identify instances where out-based employees send 
veteran medical information to the VA regional office via unencrypted 
e-mail; system access for separated employees is not terminated; 
monitoring remote network access and usage does not routinely occur; 
and off duty users' access to VA computer systems and sensitive 
information is not restricted. We continue to make recommendations to 
improve security and contingency plans, control access to information 
systems, complete background investigations and annual security 
awareness training, and improve physical security controls.
    While individual and regional managers have concurred with these 
CAP recommendations, and our follow-up process confirms actions to 
resolve the specific conditions identified at these sites, we continue 
to find that corrective actions are not applied to all facilities to 
correct conditions nationwide. Consequently, we continue to find these 
systemic conditions at other sites we visit. For example, between FYs 
2000 to 2005 the CAP program identified IT and security deficiencies in 
141 of 181 VHA facilities. We identified IT and security deficiencies 
at 37 of 55 VBA facilities.

                                CLOSING

    In closing, I would like to assure the Committee that this matter 
will remain a very high priority for the OIG until it is resolved. I 
will ensure that all the resources that are needed to complete our 
reviews in a thorough and timely manner will remain dedicated to the 
goal of recovering the stolen data and protecting our Nation's 
veterans.
    Mr. Chairman, Madam Chairman, and Members of the Committees, thank 
you again for this opportunity and I would be pleased to answer any 
questions that you may have.

    Chairman Craig. Mr. Opfer, thank you for being here and 
thank you for that testimony.
    Let me turn to Chairman Collins.
    Susan.
    Chairman Collins. Thank you, Mr. Chairman.
    Mr. Secretary, first let me say to you that I do not doubt 
in any way your personal pain and your sense of outrage over 
what has happened. I know you are sincerely upset and that you 
are dedicated to remedying the problems.
    The chronology that you gave us in your testimony is 
absolutely baffling. This was not a minor security breach. It 
involved personal information about 26 million veterans. And it 
is just inconceivable to me that there were such long delays in 
informing you personally and in informing the veterans who were 
affected.
    The concern I have, however, with your testimony, is that 
you seem to be saying that it was just one employee. It was one 
employee who breached the trust of our Nation's veterans. But 
in fact, it is not just one employee. You have a high risk 
vulnerable system that has been identified time and again as 
vulnerable.
    I have a stack of just some of the reports from OMB, from 
the House, from the GAO, from the Inspector General's office. 
Over and over again, it is the same warning, the same 
conclusions, the same recommendations.
    For example, in this 2003 annual audit by the IG, it 
states, ``The security vulnerabilities identified represent an 
unacceptable level of risk.'' And then the IG goes on to make 
many recommendations.
    But here is what is most startling to me. For almost every 
recommendation, there is a notation that says the following: 
``This is a repeat recommendation from the fiscal year 2001 and 
2002 information security audit.''
    Similarly, a report by the IG just last year states,

          Our last four annual audits, as well as this year's, continue 
        to show significant security vulnerabilities. We continue to 
        find that the VA systems remain vulnerable to unauthorized 
        access and misuse of sensitive information and data.

It seems to me that you and the leaders in your Department were 
on notice. Were you aware of these repeated audits and reports 
that identified such serious vulnerabilities?
    Secretary Nicholson. Yes, I was, Senator Collins.
    And as I said earlier, that is one of the compelling 
reasons that we have really taken the steps we did to 
centralize our systems, our information system, so that we have 
tighter central control over these. Because it has gotten very 
decentralized, very loose and undisciplined. We have really 
taken some very significant steps, and there is just a change. 
I mean, the reassignment of thousands of people, the 
rebudgeting, the creation of a career field for IT personnel at 
the VA, which had not existed.
    But it is just underway. But it has taken, in response to 
this situation that was very evident, and other deficiencies 
that have existed there which are not germane things like 
business accounting, inventory control reports and so forth, 
that you get out of a centralized IT system that the VA has 
just gotten away from over the last couple of decades.
    Chairman Collins. Mr. Opfer, are you satisfied with the 
response to your office's recommendations?
    Mr. Opfer. Senator Collins, I have recently been appointed 
to the Inspector General since November. Jon Wooditch is the 
Deputy Inspector General, who also served as Acting IG, and has 
much more familiarity with the series of reports over the 
years. I am going to refer to Jon to respond to this.
    Chairman Collins. Mr. Wooditch.
    Mr. Wooditch. Thank you.
    No, we have not been satisfied with the response in the 
past. As you mentioned, we have repeated these recommendations 
year in and year out. The IT system has been considered a 
material weakness in the Department for 5 straight years.se on.
    In the last report that we put out, which was March 2005 of 
fiscal year 2004 activities, we listed 16 recommendations and 
many of those are repeat recommendations.
    I would like to add that in Mr. Opfer's statement for the 
record, we do recognize that Congress took efforts this year to 
centralize IT in the VA. We think that presents a very unique 
opportunity now for VA to address these recommendation.
    Chairman Collins. Thank you, Mr. Chairman.
    Chairman Craig. Thank you, Madame Chair.
    Senator Akaka.
    Senator Akaka. Thank you very much, Mr. Chairman, Madame 
Chair.
    Mr. Secretary, VA seems to believe that it is unlikely that 
the lost data will be used by the thief, and you mentioned that 
in your statement. Is that the judgment of law enforcement 
officials?
    Secretary Nicholson. Senator Akaka, if I gave you that 
impression, I did not mean to, that we think it is unlikely. 
What I was trying to say was that we think it was unlikely that 
the burglary was committed to get after that data.
    Senator Akaka. Mr. Secretary, it is my understanding that 
typically VA will scramble Social Security numbers based upon 
an encryption formula. Access to files that translate scrambled 
Social Security numbers is only possible with special 
authorization. Realizing the sensitivity of this data that was 
burglarized, was this data not scrambled?
    Secretary Nicholson. That is correct, Senator Akaka, it was 
not scrambled. There is a requirement for those who are 
authorized to take data home or to work with data at home that 
it should be encrypted, and this was not.
    Senator Akaka. Can you tell me, Mr. Secretary, what years 
of veterans this data covered? Does it date back to 1970 or 
1960?
    Secretary Nicholson. My understanding of it is that it is 
all veterans that were discharged from the services since 1975, 
plus veterans receiving disability compensation from our 
Department. The reason that we have that data is that there is 
a form that--I do not know if you remember--but when you are 
discharged the Department of Defense issues a form called a DD-
214. And that is the record of your service, time, awards, so 
on.
    And we, the VA, are an addressee on a copy of that for 
everybody that gets discharged. All of these veterans in this 
file are not receiving benefits from the VA, but we have them 
in our data file.
    Senator Akaka. I am asking that just so that veterans out 
there realize if they were discharged before that date, that 
their records were not in this 26.5 million data. Thank you.
    Mr. Opfer, can you reveal anything more about the criminal 
investigation that would comfort the Nation's veterans that the 
employee and the data were not targeted?
    Mr. Opfer. Yes, Senator Akaka, without compromising the 
investigation, I can say that the evidence to date indicates 
that the perpetrators of the burglary were specifically 
targeting computer hardware. There were a number of similar 
burglaries in the area where storage devices and computers, 
hardware, CDs, et cetera, were stolen. And it matches the 
similarity of a number of burglaries, including petty change, 
but very valuable items were left in the house. This fits the 
same pattern that Montgomery County Police have been seeing in 
a number of burglaries in the area.
    Also, our investigators have interviewed the employee a 
number of times and have gone to his house. We recovered a 
number of CDs and other equipment that contained VA sensitive 
data that was left in the house.
    So appearing from the similarity of the burglaries, with 
other regular house burglaries, and the fact that VA data that 
we are able to secure was still there, we do not believe there 
was any information that has been developed by the Montgomery 
County Police, the Office of the Inspector General 
Investigators, or the Federal Bureau of Investigation that 
would indicate that that employee himself was targeted for the 
fact that he was in possession of that VA data.
    Senator Akaka. The Secretary did mention that it appeared 
this burglary was at random. What is your reading on that?
    Mr. Opfer. From our conversations with the police and from 
my own experience, I have been in law enforcement since 1969, 
this fits the pattern that would be, that they would do some 
surveillance of residences to see when people come in and out, 
and if you work a routine. And this employee and his spouse 
were on a very regular routine. It fits the pattern of the 
burglaries in that area.
    So, I would say they kind of identified residents who would 
be vulnerable during certain periods of time and then committed 
those crimes.
    Senator Akaka. Thank you very much, Mr. Chairman.
    Chairman Craig. Danny, thank you very much.
    Senator Murray.
    Senator Murray. Mr. Secretary, I am trying to reconcile the 
numbers here. You are talking about 26.5 million records 
compromised. We have about 25 million veterans who are alive in 
the U.S. today. Six million of them are enrolled in the VA. So 
I want to get something straight. Does the lost data include 
spouses of veterans that would account for those number 
misconceptions?
    Secretary Nicholson. Senator Murray, some of the veterans 
on this list would be deceased, but would not have been 
expunged from the rolls, and that explains most of that.
    There were, however, some spouses.
    Senator Murray. Whose spouse has passed away and they are 
in the database?
    Secretary Nicholson. Yes, I am told.
    Senator Murray. That raises two questions. First of all, 
how are you doing outreach to all of these 26.5 million names, 
particularly--I mean, we have had a lot of press about veterans 
themselves. But I am certain that there are spouses out there 
who have no idea that their name is part of this.
    I would like to know if we are getting outreach to them to 
notify them.
    Secretary Nicholson. Well, we are doing all we can to get 
the message out the way we have, through the use of the media. 
And we are preparing a mailing that will go to everyone.
    Senator Murray. To all 26.5 million names?
    Secretary Nicholson. Yes, because we do not know those that 
have died.
    Senator Murray. And the cost of that?
    Secretary Nicholson. We are working on that. We are trying 
to buy envelopes right now, for example. There is not 
immediately available 26 million envelopes.
    Senator Murray. What account are you taking that from?
    Secretary Nicholson. We have been in and asked for 
reprogramming of some administrative money, and that was $25 
million, which was to cover the mailing plus, the cost of the 
phone centers. The mailing itself, we think, will be in the 
range of $10 million to $11 million.
    Senator Murray. That is significant in a very tight budget, 
so I am certain we will be hearing from you on the need for 
additional funds for the VA?
    Secretary Nicholson. You will be hearing from us, I think 
on different levels, because I think we also have things we 
have to do for our veterans with respect to trying to find a 
monitoring system that is practical for watching over this for 
our veterans to try to alleviate the anxiety that they have 
about it, we have something in place to watch, working with the 
three major credit bureaus.
    Senator Murray. I expect this will cost a great deal. I 
want to make sure that our veterans do not get a double whammy 
of not only losing their records, but then being denied 
services because costs are not covered. I want to make sure we 
are providing the additional dollars to cover this. So I hope 
we can hear from you soon.
    Let me ask you, as well, are you reaching out to VSOs to 
help our veterans?
    Secretary Nicholson. Yes, we are.
    Senator Murray. And give them the training that they need 
to deal with this?
    Secretary Nicholson. We have certainly been in 
communication with them. We have not initiated any training 
with them so far. We are trying to use them and they are 
cooperating to be a communicator.
    Senator Murray. I would suggest we look at some kind of 
training for the VSOs. That is usually who the veterans call 
first. And they, I am positive, do not have some of the 
training they need to do that.
    I would also like to ask how you are dealing with veterans 
who do not have access to the Internet, who do not know how to 
use the technology. Many of our older vets who struggle with 
this kind of information, how are we dealing with them?
    Secretary Nicholson. I think that is a very important 
question. I have been talking about that myself. My father was 
a veteran. He did not know how to boot up a computer.
    So we obviously have the phone banks in the mailing that we 
will be sending out. There will be other information that they 
can use and ways to communicate outside of the computer.
    Senator Murray. Have you ever gotten your credit checked, 
as you suggest, on the VA Web site?
    Secretary Nicholson. I have not, no.
    Senator Murray. It is not easy to do. So I am hoping that 
you are looking at additional staff to be able to answer the 
questions and work their way through that. It is not the 
easiest system, particularly for anybody, but for our vets who 
are personally worried right now, as well.
    Mr. Chairman, I also think we need to be very conscious 
that we are reaching out now to 26.5 million veterans. We have 
about 5 million who are using VA services now. We are 
essentially notifying 20-some million veterans that they are 
eligible for services. There will be the impact. We have a 
responsibility to make sure they get the services they need.
    And I hope we are looking critically at the impact on our 
budget, not only for the outreach, the additional training, 
making sure everybody gets the information they need, but also 
on the impact to our VA budget as more veterans are notified 
that they do have access to services.
    Chairman Craig. Senator, thank you for that concern. It is 
our concern. It is the Committee's concern. Obviously, by 
actions taken, it is the Secretary's concern.
    We will monitor it closely as this progresses to make sure 
that the resources are available to outreach in the appropriate 
fashion.
    You mentioned widows and it is obvious to me, I think and 
others, that there are widows on this list. This morning I was 
doing C-SPAN on this issue and the call-in and I got a call 
from a widow who was obviously very concerned that in some way 
her financial statements and records might have been 
compromised. So that certainly is a legitimacy to this kind of 
list and the size of the list involved.
    Thank you.
    Secretary Nicholson. Could I comment on that, Mr. Chairman?
    Chairman Craig. Please.
    Secretary Nicholson. My technical people just handed me a 
note that says that the only spouses on that file, we think 
right now, were the spouses in a file of people involved with 
mustard gas. And that involves a number of less than 100.
    Senator Murray. Then the discrepancy between the 25 million 
veterans who are alive today and the 26.5 million records that 
you are talking about, that is 1.5 million people and only 100 
are spouses. Who are these people?
    Secretary Nicholson. They are probably deceased, Senator 
Murray, 1800 veterans die every day in our country.
    Senator Murray. OK, and so does somebody else--I mean, I am 
assuming that their records can be used and compromised, as 
well. Are we notifying relatives or anybody else to be aware of 
that? I am not sure how this technically works, but it does 
raise concerns.
    Secretary Nicholson. What we plan to do is to mail that 
entire list in the hopes that if there is an address and a 
survivor at that address, they will get that notice.
    Senator Murray. If it goes to the person, it will be 
returned, I am assuming, so how would their families know?
    Secretary Nicholson. That is a good question. We will have 
to look at that. Your concern being the use of the identity of 
a deceased veteran.
    Senator Murray. Right.
    Secretary Nicholson. That is a good question, and I cannot 
answer it right now. We will have to look at that.
    Chairman Craig. Those are very legitimate questions.
    I think as you are able to unravel this, Mr. Secretary, it 
becomes very important for all of us, and especially for you, 
to understand those kinds of nuances and details, and that that 
information flow go public. I have to think that is very 
important.
    Thank you, Senator.
    Senator Isakson.
    Senator Isakson. Inspector Opfer, do the Inspectors General 
of the various agencies of the Federal Government ever meet 
together?
    Mr. Opfer. Yes, all the Inspectors General of the agencies 
are members of what is called the President's Council on 
Integrity and Efficiency. We meet formally once a month. And 
the chairman of that is the Deputy Director for Management for 
OMB. And one of the Inspectors General is selected as the vice-
chair. Then there are various committees of the PCIE, the 
Investigations Committee, Audit Committee, and Inspections, 
Evaluations, and Legislative.
    Senator Isakson. I have two suggestions. One is it would 
seem to me the Secretary has outlined his disappointment at 
being notified 13 days after the fact, that we should 
immediately install in the various agencies of the Government a 
rule that any breach of secure information and data is to be 
immediately reported to the person in charge. And I am talking 
about the secretary of the agency. I am not talking about the 
Department.
    Something like this should never go unknown by the boss. 
The Secretary, to his credit, accepted the blame, the buck 
stops here, and I appreciate his doing that. But I also 
acknowledge how tough it is to find out 13 days after the fact 
what you are going to have to take the blame for.
    So I would suggest that you all talk about what ought to be 
a Governmentwide policy, if there is any other breach. All that 
takes is a policy change.
    The second thing is that if, in fact, other agencies have 
information as accessible as the Secretary has described the 
information at the VA is, then I think the inspectors general 
need to make recommendations to the appropriate agency or 
authority, which is probably the Appropriations Committee of 
the U.S. House and Senate, as to what should immediately be 
done to put blocks and security on that information, so it 
cannot be accessed from the outside nor be portable enough to 
be taken out.
    So I would just recommend you do that. That is important. 
We have inspectors general to hold us accountable, to find 
discrepancies, to point things out that we need to do. We have 
a situation here that clearly demonstrates that a couple of 
changes need to be made.
    Any comments you have?
    Mr. Opfer. Yes, Senator. Just on this issue alone, I have 
been contacted by a number of inspectors general of these 
various agencies themselves, and including some deputy 
secretaries of departments. So when we conclude our review, I 
would be willing to discuss that with them and the individual 
things.
    In the normal process, I am a member of the Investigations 
Committee of the President's Council on Integrity and 
Efficiency and also the Inspection and Evaluation. We would 
make this available and make a presentation on to all of the 
inspectors general, including the officials of OMB at the PCIE 
meeting, as well as giving them the reports and briefing the 
appropriate members of the Appropriation Committee on both 
sides of the Hill and the Oversight Committees.
    Senator Isakson. Mr. Secretary, this is really a comment. 
Having had my identification taken, and having been notified by 
the company that lost it or allowed it to get out, I am aware 
of what happens in the private sector. What happens is they 
provide a means of protection for a period of time in the event 
the theft of the information actually gets in the wrong hands 
and is accessed.
    As you are investigating your cost to deal with the mailing 
and with the czar, or whatever else you do in the Department, I 
would suggest that you consider in the hopefully unlikely 
circumstance that if we find this information is accessed, we 
need to know how to deploy immediate security measures for 
these 26.5 million people and what that cost would be.
    From talking with the Chairman yesterday, that type of 
product is available. And its cost, in the volume like this, is 
not as insurmountable as one might initially think.
    So, I think as we are planning for how to prevent this from 
happening in the future, and we are budgeting for notification, 
there should be some investigation by the VA as to what we are 
going to do if the unlikely event happens and the information 
actually gets used inappropriately.
    So, I would appreciate your thinking about that.
    That is all I have, Mr. Chairman. Thank you, Mr. Chairman.
    Chairman Craig. Johnny, thank you very much.
    Senator Thune.
    Senator Thune. Thank you, Mr. Chairman. I appreciate that 
suggestion, as well as some of the others.
    I think a lot of the questions that have been raised today 
are very good questions, particularly with respect to the short 
term, notifying veterans how the agency, the Department intends 
to do that, as well as it just seems like this was a tremendous 
breakdown in the chain of command when it came to reporting the 
incident, considering the magnitude of this breach. So, I think 
the suggestion that my colleague from Georgia made regarding 
the IG and how that is reported is a good one. And it seems to 
me, at least, there has got to be some change in that area, as 
well.
    I am also concerned, obviously there are a lot of short-
term implications to this and many of those have been raised 
and touched upon. I also am concerned about, as well, the long 
term. As has been noted already, many of the reports that have 
been done in the past by the IGs and other agencies of 
Government, watchdog and audit agencies, have suggested 
weaknesses and flaws in the IT system at the VA.
    What I would like, Mr. Secretary, just to get you to 
comment on, is because one of the things that we have been 
talking about a lot up here is centralization of that function 
at the Department, rather than having these compartmentalized 
different databases out there that contain information on our 
veterans.
    I know that recently here the VA CIO, Mr. McFarland, 
resigned because the VA was not moving fast enough on the IT 
organization. My understanding is, as well, that he was brought 
on board specifically because of his expertise as a former 
executive at Dell Computer, and was supposed to be an agent for 
change for the VA when it comes to reform of the IT programs.
    At least the reports I have read suggest that he became 
frustrated beating his head against the wall of the bureaucracy 
at the VA and that, as a consequence, decided to leave. But I 
think it points to this broader question of IT management 
centralization and the privacy of the 26 million records that 
we are talking about today.
    But could you just talk a little bit about the context of 
his departure and your view about whether or not the VA is 
moving quickly enough when it comes to adopting the federated 
model of IT management centralization?
    Secretary Nicholson. I can, Senator.
    It is hard to say what Bob McFarland is feeling when he is 
not here. I had lunch with him shortly before he left, and I 
think that he feels quite satisfied about what he achieved at 
the VA. The statement about his getting tired of bumping his 
head against the wall, I think he got tired of doing what he 
had to do to break through to get done what we were doing.
    It did not become a totally adopted model that Mr. 
McFarland wanted because there is one exception in there, which 
is the developers of IT. These are the people that work to 
customize the applications of software for research going on at 
different hospitals and so on.
    But short of that, he achieved everything he set out to do. 
So, I think he made a monumental contribution to the VA.
    He wanted to get back and spend more time fishing. He 
thought he probably bumped enough heads and wrangled enough 
people doing what he got done, that maybe it was time for him 
to leave. I tried to talk him out of it.
    The important thing though is what he is leaving behind, 
with respect to what is going on now. It gives us a chance to 
be very hopeful.
    Now you ask me are we moving fast enough? I would say to 
that, no. I do not think anything, frankly, moves in the 
Government fast enough. Because there are both the embedded 
cultural resistances to this in the bureaucracy and there are a 
lot of regulations and laws that inhibit speed.
    But having said that, I will say that something very 
important has happened, and that is that the institutional 
resistance that was there to this big change has gone away. 
Those leaders are now very supportive of this and are working 
honestly and harmoniously in getting this done.
    But it involves the reclassification of thousands of people 
and the upheaval and anxiety that goes with that. As I said, I 
think I said, that it also will result in a new career field in 
the VA for information technology, which would give those 
people a chance to go up in their own field without having been 
piggybacked into IT from some other field that they came from. 
So it is a real advantage to them for that, as well.
    We have a team of really young, bright IT people who have 
the responsibility for this implementation. And they are 
underway.
    Senator Thune. I appreciate that, and Mr. Chairman we have 
had this discussion. I hope that you can continue to push the 
pace. I know there is resistance to change in every agency of 
Government and bureaucracy. It is just human nature as much as 
anything else. But the stakes in this debate are so high and 
the relative speed with which this transition has occurred 
seems to me to suggest that we are not doing enough.
    I am glad to hear you say that the culture is changing, 
because I think that is important, too, to recognize that this 
is where we are going. And once you get over that hurdle, then 
how do we get there in the quickest, most efficient way 
possible.
    But this incident obviously focuses a lot of light on the 
importance of that transition happening, particularly in light 
of many of the reports and suggestions and recommendation that 
have come previously that appear not to have been adhered to.
    So, we are obviously all looking for not only trying to 
determine exactly what caused this breach, but also, more 
importantly now, what we must do to fix it. So I thank you, and 
Mr. Chairman I have another question, but I am out of time and 
I think we have a vote on. So I yield back the balance of my 
time.
    Chairman Craig. We do have a vote underway.
    Gentlemen, I do have a couple more questions. I think 
Senator Collins does. We will ask you, if you would please, we 
will be brief. We should be able to get you out of here within 
the next 15 or 20 minutes. I will run and vote and come back.
    So we will ask the Committee to stand in recess until 
Senator Collins returns and then she can bring it to order.
    Thank you.
    [Recess.]
    Chairman Collins [presiding]. The Committee will come back 
to order.
    Mr. Secretary, I do expect some of our colleagues to 
return, in particular the Chairman. While we are waiting for 
that, I am going to proceed to a couple of additional questions 
that I have for you.
    For the past 7 years, it is my understanding that the VA 
and the Department of Defense have been working to achieve the 
exchange of patient health information electronically. The goal 
is to have an interoperable electronic health record.
    In addition, the Department of Veterans Affairs is working 
with the IRS and with the Social Security Administration on 
compiling and comparing some means test income data to ensure 
that non-service connected veterans receiving VA health care 
have the correct eligibility.
    I bring these two projects up because both involve a 
massive exchange of data, personal data, sensitive data in the 
case of the health care and income data. How much confidence do 
you have that there are appropriate safeguards, encryption, 
limits to access the information that is being compiled through 
these two projects?
    Secretary Nicholson. Senator, I would like to tell you that 
I have a lot of confidence, but I am not going to because I do 
not. I think that we have 7.5 million enrolled patients for 
health care at the VA. Every one of them has an electronic 
health record, which is exemplary, and it is one of the main 
reasons, I think, that we are such a very good integrated 
health care provider. It gives portability and safety.
    But I have worries about the fact that people can access 
this from remote stations and whether or not we have the 
controls in place to limit that access, and what are the 
possibilities for the downloading of it?
    Now I know that we have controls and we have codes and we 
have things that protect that. But I am not going to tell you 
that I think that it is what it should be.
    Chairman Collins. That is something that I hope the 
Department will act very quickly to take a look at.
    As I understand it, so far there has been no indication 
that the stolen data has been used for identity theft or 
financial fraud. And of course, all of us are hoping that that 
pattern will hold. There is a concern, however, that con 
artists could take advantage of this situation without having 
access to this data. I would like to give you a scenario that 
my staff had mentioned to me.
    It would be very easy for a scam artist to call up a 
veteran, refer to this loss of data, pretend to be a VA 
representative and ask for the veteran to verify his or her 
Social Security number and date of birth.
    Are you doing anything through your Web site or the 
Veterans Service Organizations to try to educate veterans on 
identity theft, in general, and that they should be very 
careful about giving out information, and perhaps to inform 
them that the VA is not calling to ascertain this information?
    I just worry that even if this information miraculously is 
not misused by anyone, that there are clever con artists who 
could use the fact of this information's exposure to take 
advantage of our veterans.
    Secretary Nicholson. I think it is a good point and we are 
not doing that, to my knowledge. It sounds like something we 
should be and can and will, yes.
    Chairman Collins. I think that would be very helpful and 
maybe it is something--Mr. Opfer?
    Mr. Opfer. Senator, actually you are right on target. We 
have been made aware of something like that yesterday and have 
reported it to the Department senior management. I think that 
needs to be very aggressively put out to the public. But 
something similar like that was reported and I had us bring it 
to the senior level of management. The Chief of Staff is aware 
of it and the other senior officials in the Department.
    Chairman Collins. So your concern is that may already be 
happening?
    Mr. Opfer. Yes, it would be a usual thing to happen in an 
event like this.
    Chairman Collins. It would. I have done work in this area 
on identity theft and the financial fraud and people will take 
advantage and exploit every vulnerability. It would be ironic 
if the stolen information were never used for this purpose, but 
then con artists use the fact of this incident to compromise 
our veterans.
    Mr. Opfer. A recent example of that was the tragedy in 
Fairfax, Virginia a few weeks ago, with the two police officers 
killed. Right before they were even buried, they were calling 
saying that they were calling on behalf of the police 
associations, generating funds. So as you have a tragedy, 
people are ready to come in.
    In my previous experience, I was the Inspector General at 
the Federal Emergency Management Agency. And every time you had 
a disaster, you had the people, as I referred to them the 
vultures, ready to come down.
    Chairman Collins. There are always the fraudulent charities 
that pop up, people who are willing to exploit any tragedy. I 
think the fact that you already have reports of that suggests 
the VA needs to be proactive.
    It seems to me one thing you might want to do with the 
notification letters is to include a flyer on protecting 
yourself from identity theft. The FTC, for example, has 
developed some very good materials on financial fraud in that 
area. So that is something that I would recommend.
    Mr. Secretary, you mentioned that you are working 
cooperatively with the credit bureaus, which I commend you for. 
In addition to educating veterans that they can receive a free 
copy of their credit report, is the VA looking into other ways 
to connect veterans with their credit reports?
    Secretary Nicholson. We are, Senator Collins. We also have 
been looking at some proposals from private sector, proprietary 
companies that are in this business. And our goal would be to 
see if we could create some kind of an overlay over the veteran 
community that could allay some of their fear and anxiety about 
this, knowing that there is somebody watching it and there is 
sort of a continual alert about them.
    It would work with these three major reporting bureaus. 
There are people in that business and we are looking at it. The 
cost of it is something we are not yet sure of, but I am pretty 
confident that given the volume that we have, that we are 
dealing with here, that we could get a pretty good deal, which 
would still be a substantial amount of money. But I think it is 
something that our veterans deserve.
    Chairman Collins. I agree and I am pleased you are pursuing 
that.
    Mr. Secretary, I want to go back to my initial statement to 
you when I said that I found the chronology that you gave in 
your testimony to be baffling. I think you find it to be 
baffling also. And I understand how frustrated and angry you 
must be that it took some 13 days before you were notified of 
such a serious breach.
    What is your theory on that? How do you think it was 
possible for there to be such long delays in bringing this 
incident to your attention? As I said, it was not minor. It did 
not involve just a few records. It is just so obviously urgent 
and serious that it is so hard for me to understand the failure 
of those in the Department to inform you.
    Secretary Nicholson. It is an appropriate question. It is 
difficult for me to answer because some of the people along the 
line are some of the most competent, dedicated people I have 
ever worked with anywhere. It is hard to answer, frankly.
    So I am only speculating. We have discussed it. They feel 
terrible. They have offered resignations. They were trying to 
deal with it themselves and get their arms around it and handle 
it. It is not clear.
    Chairman Collins. Thank you.
    Mr. Chairman.
    Chairman Craig [presiding]. I have one last question and 
before I do that, if you are leaving us.
    Chairman Collins. I do not have anything else. Thank you.
    Chairman Craig. Again, thank you for working with us for 
this joint hearing. I think it is obvious the problem that are 
now appearing in VA, and as we started this hearing, the 
question remains are these same problems system wide? The work 
you are doing in your Committee is critical and important. And 
we will monitor this and work with you to make sure that--you 
never say never, but we ought to have systems in place where 
that argument can at least be placed.
    Thank you very much, Susan.
    Chairman Collins. Thank you, Mr. Chairman. And again, thank 
you for taking the initiative on this very serious problem. I 
have enjoyed working with you on this hearing.
    Chairman Craig. Thank you very much, Madame Chair.
    Mr. Opfer, the Inspector General Act requires you to keep 
the Secretary and Congress fully and currently informed about 
any serious problem regarding VA's operation. In this case, it 
appears that the Secretary was not notified of the massive data 
security breach until 6 days after the IG Office was alerted to 
the incident, and Members of the Congress were not notified for 
several days after that.
    Again, this question has been asked, but for the record, 
given the magnitude of the data security breach, do you believe 
the IG's Office acted with sufficient haste in reporting the 
incident to the Secretary and ultimately to the Congress?
    Mr. Opfer. Yes, I do. Mr. Chairman, let me go through the 
chronology again.
    The IG Office was never notified of the security breach. It 
was a normal monthly meeting when an Information Security 
Officer from the IG was attending. It was not talked about. It 
was mentioned that an employee had some data stolen from a 
burglary at his residence. No information was given to that 
employee of the significance of it.
    He followed up on his own to try to find out what 
information he could. That was on the information of May 10th. 
There was no information given to the IG.
    He wrote it up and gave it to our Office of Investigations 
that went to the Department on Friday, May 12th to try to 
locate this Information Security Officer. The officer was not 
at work. The agents did not just wait. They tried to contact 
him at home. He was on leave. They were not able to contact 
that Information Security Officer that had the information 
until Monday the 15th. That is when they interviewed him, gave 
the preliminary information. We had no knowledge of anything 
other than an employee had some data stolen from the home, the 
residence.
    It was not until we interviewed the employee on the 15th 
that we realized that we had a significant problem developing 
there. That interview went for hours upon hours of interviewing 
the employee. That is where the information came to the IG.
    With the story what he was saying he had access to this 
type of information, that first thing you need to do is ask, is 
it credible? Would an employee have that much access to that 
type of sensitive information? And would he be able to take it 
to his residence?
    The second part was then to look if there were other issues 
with that employee? The investigators went through the 
background, doing name checks, record checks, reviewing his 
official personnel folder, looking at any issues that we may 
have had in the IG's Office, trying to determine, contacting 
their local police. Was there a burglary? Was it reported? Was 
it similar to others? Or was this a staged burglary? Were there 
issues with the employee? His family, with the police?
    It was not until the morning of the 16th of May that they 
spoke to the police. But they had to get to the detective that 
was doing this to see what we had. It was then immediately that 
the agents told the detective of the seriousness of what we 
were looking at, of the possible breach of millions of personal 
identification information.
    On the 16th, they came to me in the morning to brief me. I 
immediately, before he even finished the briefing, got on the 
phone to the Chief of Staff who was with Tim McClain, the 
Counsel, and explained to him what we had. We had a serious 
problem. The information only was coming to us from the 
interview of the agents with the employee.
    On the 16th, in the morning, this was about 9:30, when I 
spoke to the Chief of Staff, he told me that he was aware of an 
incident but did not realize the magnitude of the incident. It 
was after they had the 11 o'clock meeting, that I again spoke 
to the Chief of Staff and told him that I requested that he 
brief the Secretary on the severity of this.
    The Secretary was out of town attending the funeral service 
of former Congressman Sonny Montgomery. The Chief of Staff told 
me the Secretary would be back at 7 o'clock that night and he 
would brief him on it. The next morning, every day from then 
on, I had constant contact.
    So when it came to my attention, the Secretary was notified 
immediately from the Chief of Staff on the 16th.
    On the 17th, we again were confirming and working with the 
Montgomery County Police through the 15th, 16th and 17th. On 
the 17th, this is one day now from when we are verifying that 
we had a serious problem which was verified to us on the 16th, 
not only from the employee's interview, but verified that he 
did have access to this material, we notified the Federal 
Bureau of Investigation both from field office to field office, 
as well as the Acting Assistant Director for Criminal Division. 
So notifications were made in a very serious and coordinated 
effort.
    I had to balance a decision of whether or not to release 
that information. During all of these periods of conversations 
that I was having with senior level officials within the 
Department, I was advising them of my statutory responsibility 
both to Congress and both to notify the appropriate Federal law 
enforcement agencies, which we did within a day.
    The decision not to go public was one, and I kept using the 
phrase we are on borrowed time. As the IG's Office was 
ratcheting this up, as we were going out doing interviews, more 
people were going to become aware of what we are looking at. 
And I was concerned it was going to be released.
    Right from the beginning, on the 17th, I had conversations 
with the Chief of Staff that somehow along the line I was going 
to start these notifications. But the Chief of Staff agreed 
that we needed to be proactive and the Department was being 
proactive to reach out to try to look at what lessons they 
could get from the Federal Trade Commission, the Commerce 
Department, to establish the 800 number, the Web site and all 
these initiatives that went in.
    I had to balance where along the line does that come to 
with what we had as investigative leads which were quickly 
evaporating. We were very aggressively investigating every 
investigative lead that we had. And during that whole period of 
time, I was saying I am coming to the point I cannot justify 
legally or morally not making those notifications relative to 
investigative leads because they just were not there as we were 
knocking them off.
    On Thursday evening, I had a conference call with the 
Secretary, the Chief of Staff and the Counsel, and I do not 
know if anyone else was present. We talked about this. I talked 
about my position that we came to the point now, from the 
Inspector General's position, we should go public. It was time 
to make the notifications.
    We talked about do we balance that with the panic that we 
could cause for the veterans?
    I still said this did not outweigh my obligation and I 
would not delay that notification any longer. I felt from an 
investigative standpoint we have gotten to the point we were 
exhausting all of the leads that were available.
    It was agreed that the next morning I would receive a copy 
of a draft statement making the announcement. My staff 
contacted the appropriate Members of the Committee staff. I was 
prepared to make that notification on Friday.
    And I would like to ask Jon Wooditch then to talk about 
what happened Friday afternoon to try to convince us then to 
hold off.
    Mr. Wooditch. I was contacted by the VA General Counsel, 
who asked us to talk to the Director at the Federal Trade 
Commission because they were not quite ready with the Web sites 
and the hot lines and all of the other tools that they were 
going to use to satisfy the veterans calling in. It seemed to 
be a legitimate request. If we went out prematurely and we were 
not ready to deal with all of the calls that we were going to 
get, it could cause panic.
    So, I agreed to talk to the FTC Director and she convinced 
me that they would work feverishly over the weekend and have it 
done by Monday. Monday it was completed and the Secretary did, 
in fact, make the announcement on Monday.
    Mr. Opfer. I would also add on Sunday, that Sunday, I had 
two telephone conversations with the Associate Attorney General 
asking me if my position was still that. And I said I was 
concerned that we could not wait any longer. And I needed to 
verify, he was going to a meeting at the White House to verify 
that the FTC and all of these operations were going to be in 
place for Monday. He called me back later. He wanted to know, 
from my perspective as lead investigator for the OIG, and we 
discussed that he would reach out to the FBI to see if they had 
any additional leads. I said I was not aware of any, but I 
would reach out again to my supervisor and the agents working 
to see if there were any leads left that would justify 
withholding going public at that point.
    So, I do believe it was done in a timely manner.
    Chairman Craig. I mean, I find that fascinating. I am not 
here to challenge your judgment. I think I have, we probably 
have a better picture of what did and did not happen.
    I would hope that you all collectively look at what you did 
and how you did it with the hindsight you now have. It appears 
to me to be a fascinating case study. I do not know whether I 
am overreacting or under reacting. I do not know whether you 
overreacted or under reacted as it relates to the knowledge you 
had and how you handled the knowledge.
    I know one thing, that it was not until May 22 that I found 
out about it. And I do not believe I or this Chairman can be 
called public. We are not the public.
    Mr. Opfer. I was not talking about that. I was also talking 
about notifying Congress. It was whether or not, even again on 
Sunday I was requested by the Justice Department if I would 
reconsider my position.
    Chairman Craig. And yet, at the same time, I appreciate 
having the tools in place to handle response to an announcement 
of this magnitude. I can hardly question that because obviously 
you were getting a great concern and there is a lot of--as the 
information flows out, there is a growing concern amongst 
veterans as to whether they, in fact, have been compromised or 
not.
    That is part of why we are here today. But it is also why 
we are here to review, and in some instances to criticize.
    I hope that both of you recognize the importance of a 
constructive dialogue that gets us, as I said, not ever having 
this happen again. I do not believe in nevers. They just do not 
exist. But certainly we have had a record of problems here, not 
of this magnitude, and clearly one now that I trust will move 
forward on.
    Certainly this Committee, and I know that Susan's Committee 
will do the same thing. And as we look beyond VA to other 
agencies of Government to make sure that similar protocol and 
certainly similar policy is put in place. And my guess is with 
the legislation that is out there, legislation that will become 
law passed by Congress in relatively short order as it relates 
to these kinds of things.
    Susan, do you have any additional things you want to say?
    Chairman Collins. No, thank you.
    Chairman Craig. Again, gentlemen, thank you very, very much 
for being here this morning and being as cooperative as you now 
are. We appreciate that a great deal as we work our way through 
this. It is a joint effort.
    And Mr. Secretary, I appreciate your responses and 
obviously taking the responsibility that a person in your 
position must take to deal with these kinds of issues.
    But again, you have a cooperating Committee here that wants 
to make sure we deal with this in the appropriate fashion and, 
where necessary, to provide the resources, if necessary, to 
make sure that this goes away as quickly as possible and that 
no veteran is injured.
    Gentlemen, thank you both. Thank you all very much.
    The Committee record will remain open. Several of my 
colleagues have asked to submit questions in writing and, of 
course, we will allow that to happen. We will keep the record 
open for at least 2 weeks.
    Thank you.
    Voice: Will you take a statement from an affected veteran?
    Chairman Craig. I will be happy to visit with you 
afterwards and anything you want to submit to us, we will be 
happy to put in the record.
    Thank you very much.
    The Committee will stand adjourned.
    [Whereupon, at 12:41 p.m., the Committee was adjourned.]


                            A P P E N D I X

                              ----------                              


  Prepared Statement of Hon. Norm Coleman, U.S. Senator from Minnesota

    We are witnessing a disturbing trend in the Federal 
Government recently in which problems have been identified, 
warnings and recommendations have been issued and then no 
action takes place. The news delivered Tuesday that up to 26.5 
million veterans, the very people we have asked to sacrifice so 
much for this Nation, were now vulnerable to identity theft 
because a VA employee was able to just walk out of the building 
with highly sensitive information is appalling.
    Equally outrageous is that after a third-rate burglary took 
place and put veterans at risk on May 3rd , we learned 
yesterday that Secretary Nicholson was not notified of the 
breach for 13 days, and the FBI was not notified for 14 days. 
And if that weren't enough, since 2001 the VA Inspector General 
has reported security vulnerabilities relating to the operating 
system, passwords, a lack of strong detection alerts, and the 
need for better access controls.
    Mr. Secretary, while it was unfortunate you were not 
informed earlier of the burglary, identity theft is not a new 
problem and the blunt assessment the VA was given from its 
Inspector General should have immediately been addressed. It is 
also unfortunate and troubling that while the VA employee who 
was robbed informed the VA of what happened that same day, it 
took the VA 19 days, almost 3 weeks, to inform Veterans that 
they may be at-risk to identity theft.
    Additionally, identity theft and fraud is a national 
problem that has affected more than 10 million Americans and 
this case raises the question of what the Federal Government is 
doing to protect all sensitive information so it does not fall 
into the wrong hands. The Federal Government is responsible for 
maintaining and protecting sensitive information that Americans 
are required to provide for a wide array of reasons, including 
paying taxes, receiving medical and disability benefits, and 
obtaining retirement compensation.
    In order to determine the extent of the vulnerabilities in 
information security across the Federal Government, yesterday I 
sent a letter to the Government Accountability Office 
requesting a governmentwide review of the current policies and 
practices in place meant to protect the sensitive identity 
information of Americans, and whether these policies may allow 
for a similar type of security breach at other Federal 
agencies.
    The bottom line is that American citizens deserve to know 
if their sensitive information is safe.
                              ----------                              


     Prepared Statement of the Center for Democracy and Technology

    The Center for Democracy and Technology is deeply troubled 
by the revelation that the Department of Veterans Affairs 
carelessly allowed the personal data of millions of men and 
women who've served this country to fall into the hands of a 
simple burglar. Yet, it is our view that this breach is not the 
failure of one employee or even one agency. It is symptomatic 
of a larger failure of data management across the Federal 
Government.
    Until we bring the aging laws and policies that protect our 
personal information up to date with modern technology, these 
catastrophic data ``spills'' will only get worse.
    Attorney General Alberto Gonzalez responded to the breach--
the latest in a series of private and public sector privacy 
gaffes--by vowing to closely monitor for any signs of identity 
theft and to aggressively pursue offenders. This is an 
appropriate and necessary response, now that the data has been 
compromised, but it doesn't come close to providing the 
comprehensive protection for personal information expected when 
the Privacy Act was passed in 1974.
    A growing body of research, supported by years of 
Government Accountability Office reports, makes clear that it 
is time to bolster the protections in that law and dramatically 
improve enforcement.
    In 2003, GAO made clear that ``the government cannot 
adequately assure the public that all legislated individual 
privacy rights are being protected.'' This report and others 
made clear that the problem is not with an individual agency 
but rather an endemic lack of leadership from the White House 
and its Office of Management and Budget over Privacy Act 
enforcement. In the absence of strong Administration leadership 
individual agencies have been left to fend for themselves in 
bringing their information practices in line with the Privacy 
Act.
    CDT's discussions with agency privacy officers support the 
GAO findings. One chief privacy officer for a key agency told 
us that half of the agency's Privacy Act systems of records--
the databases most likely to have sensitive information on 
Americans--were simply missing.
    To address these serious concerns, GAO correctly recommends 
that agencies be given better guidance and follow best 
practices. The Office of Management and Budget's Privacy Act 
guidance was written in 1975 and has never been comprehensively 
updated. Technology has evolved enough in the past 3 years, let 
alone the past 30, to warrant a thorough rewrite of that 
guidance. Such a rewrite alone would send a clear message to 
agency heads and privacy officers that they will be held 
responsible for the sensitive data in their care.
    Although renewed leadership on Privacy Act compliance would 
be an important first step, it's also the case that the law 
itself is in need of renovation, given the technological 
revolution that has taken place in the decades since its 
passage. Congress must patch the holes in the aging laws 
intended to protect the personal information that Americans 
entrust to the government before more massive data breaches 
occur.
    Because of the rash of high-profile data breaches in the 
private sector, Congress has focused its legislative efforts on 
establishing data breach rules for the private sector and has 
not given the same attention to the serious privacy and 
security problems in government agencies that collect and 
maintain databases of personal data on Americans. Indeed, only 
one of the data-breach bills under consideration even begins to 
address the Federal Government's use of personal information. 
The measure, S. 1789, The Personal Data Privacy and Security 
Act'' sponsored by Senators Arlen Specter (R-Pa.) and Patrick 
Leahy (D-Vt.) would, among other things, require greater 
oversight over the government's use of personal data and would 
limit the government's ability to augment its data with 
additional information purchased from private-sector companies 
like ChoicePoint. Today, many government agencies are using 
this commercial data in ways that violate the spirit of the 
Privacy Act, but not the letter of the law. These practices 
have encouraged an atmosphere that suggests that the law is not 
as relevant as it was at the time that it was passed.
    Enacting those provisions would be a valuable step toward 
safeguarding our personal data, but Congress should go further 
and enact comprehensive legislation to bring Privacy Act into 
the 21st century. The law, written during the age of the 
mainframe computer, must be updated to respond to new 
technologies. Today, a smart phone can hold as much data as 
computers that occupied an entire room in 1974. Congress can 
start by updating the basic definitions of the Act and limiting 
the routine exemptions on the data.
    As early as 1977, a Congressional commission found that the 
Act's central definition--``systems of records''--was already 
outdated. Particularly on the Internet, where multiple 
databases can be linked, searched, copied and reconfigured, the 
concept simply does not work. Moreover, privacy advocates and 
policymakers have long complained that the ``routine use'' 
exemption is being used in ways going far beyond its original 
intent. That definition also needs to be reconsidered.
    Congress may also want to review the effectiveness and 
applicability of sections of the Taxpayer Browsing Protection 
Act of 1997, which was passed after abuses by IRS employees, 
including improper removal of taxpayer records from the agency, 
were revealed.
    Americans entrust the Federal Government with significant 
amounts of our personal information in order to deliver 
benefits and services. Updating privacy oversight, policy and 
law in this area is the first necessary step to ensuring that 
this information is not simply left vulnerable to common 
thieves.

        Prepared Statement of the Department of Veterans Affairs

    The Department of Veterans Affairs (VA) has recently 
learned that an employee, a data analyst, took home electronic 
data from VA, which he was not authorized to do. This behavior 
was in violation of our policies. This data contained 
identifying information including names, social security 
numbers, and dates of birth for up to 26.5 million veterans and 
some spouses, as well as some disability ratings. Importantly, 
the affected data did not include any of VA's electronic health 
records nor any financial information. The employee's home was 
burglarized and this data was stolen. The employee has been 
placed on administrative leave pending the outcome of an 
investigation.
    Appropriate law enforcement agencies, including the FBI and 
the VA Inspector General's office, have launched full-scale 
investigations into this matter. Authorities believe it is 
unlikely the perpetrators targeted the items because of any 
knowledge of the data contents. It is possible that they remain 
unaware of the information which they possess or of how to make 
use of it. However, out of an abundance of caution, VA is 
taking all possible steps to protect and inform our veterans.
    VA is working with Members of Congress, the news media, 
veterans service organizations, and other government agencies 
to help ensure that those veterans and their families are aware 
of the situation and of the steps they may take to protect 
themselves from misuse of their personal information. VA will 
send out individual notification letters to veterans to every 
extent possible. Veterans can also go to www.firstgov.gov to 
get more information on this matter. This website is being set 
to handle increased web traffic. Additionally, working with 
other government agencies, VA has set up a manned call center 
that veterans may call to get information about this situation 
and learn more about consumer identity protections. That toll 
free number is 1-800-FED INFO (333-4636). The call center will 
be open beginning today, and will operate from 8 a.m. to 9 p.m. 
(EDT), Monday-Saturday as long as it is needed. The call center 
will be able to handle up to 20,000 calls per hour (260,000 
calls per day).
    Secretary of Veterans Affairs R. James Nicholson has 
briefed the Attorney General and the Chairman of the Federal 
Trade Commission, co-chairs of the President's Identity Theft 
Task Force. Task Force members have already taken actions to 
protect the affected veterans, including working with the 
credit bureaus to help ensure that veterans receive the free 
credit report they are entitled to under the law. Additionally, 
the Task Force will meet today to coordinate the comprehensive 
Federal response, recommend further ways to protect affected 
veterans, and increase safeguards to prevent the reoccurrence 
of such incidents. VA's mission to serve and honor our Nation's 
veterans is one we take very seriously and the 235,000 VA 
employees are deeply saddened by any concern or anxiety this 
incident may cause our veterans and their families. We 
appreciate the service our veterans have given their country 
and we are working diligently to protect them from any harm as 
a result of this incident.
                                ------                                

                     VA's Notification to Veterans

    Dear Veteran: The Department of Veterans Affairs (VA) has recently 
learned that an employee took home electronic data from VA, which he 
was not authorized to do and was in violation of established policies. 
The employee's home was burglarized and this data was stolen. The data 
contained identifying information including names, social security 
numbers, and dates of birth for up to 26.5 million veterans and some 
spouses, as well as some disability ratings. As a result of this 
incident, information identifiable with you was potentially exposed to 
others. It is important to note that the affected data did not include 
any of VA's electronic health records or any financial information.
    Appropriate law enforcement agencies, including the FBI and the VA 
Inspector General's office, have launched full-scale investigations 
into this matter. Authorities believe it is unlikely the perpetrators 
targeted the items because of any knowledge of the data contents. It is 
possible that they remain unaware of the information which they possess 
or of how to make use of it.
    Out of an abundance of caution, however, VA is taking all possible 
steps to protect and inform our veterans. While you do not need to take 
any action unless you are aware of suspicious activity regarding your 
personal information, there are many steps you may take to protect 
against possible identity theft and we wanted you to be aware of these. 
Specific information is included in the attached question and answer 
sheet. For additional information, VA has teamed up the Federal Trade 
Commission and has a website (www.firstgov.gov) with information on 
this matter or you may call 1-800-FED-INFO (1-800-333-4636). The call 
center will operate from 8 a.m. to 9 p.m. (EDT), Monday-Saturday, as 
long as it is needed.
    We apologize for any inconvenience or concern this situation may 
cause, but we at VA believe it is important for you to be fully 
informed of any potential risk resulting from this incident. Again, we 
want to reassure you we have no evidence that your protected data has 
been misused. We will keep you apprised of any further developments. 
The men and women of VA take our obligation to honor and serve 
America's veterans very seriously and we are committed to seeing this 
never happens again. Sincerely, R. James Nicholson Secretary of 
Veterans Affairs.
            Sincerely,
                                        R. James Nicholson,
                                     Secretary of Veterans Affairs.
                               __________

                         For Immediate Release

                              May 22, 2006

         FREQUENTLY ASKED QUESTIONS ON VA'S LETTER TO VETERANS

    Question 1. I'm a veteran, how can I tell if my information was 
compromised?
    Response. At this point there is no evidence that any missing data 
has been used illegally. However, the Department of Veterans Affairs is 
asking all veterans to be extra vigilant and to carefully monitor bank 
statements, credit card statements and any statements relating to 
recent financial transactions. If you notice unusual or suspicious 
activity, you should report it immediately to the financial institution 
involved and contact the Federal Trade Commission for further guidance.
    Question 2. What is the earliest date at which suspicious activity 
might have occurred due to this data breach?
    Response. The information was stolen from an employee of the 
Department of Veterans Affairs during the month of May, 2006. If the 
data has been misused or otherwise used to commit fraud or identity 
theft crimes, it is likely that veterans may notice suspicious activity 
during the month of May.
    Question 3. I haven't noticed any suspicious activity in my 
financial statements, but what can I do to protect myself and prevent 
being victimized by credit card fraud or identity theft?
    Response. The Department of Veterans Affairs strongly recommends 
that veterans closely monitor their financial statements and visit the 
Department of Veterans Affairs special website on this, 
www.firstgov.gov or call 1-800-FED-INFO (1-800-333-4636).
    Question 4. Should I reach out to my financial institutions or will 
the Department of Veterans Affairs do this for me?
    Response. The Department of Veterans Affairs does not believe that 
it is necessary to contact financial institutions or cancel credit 
cards and bank accounts, unless you detect suspicious activity.
    Question 5. Where should I report suspicious or unusual activity?
    Response. The Federal Trade Commission recommends the following 
four steps if you detect suspicious activity:
    Step 1.--Contact the fraud department of one of the three major 
credit bureaus: Equifax: 1-800-525-6285, www.equifax.com, P.O. Box 
740241, Atlanta, GA 30374-0241; Experian: 1-888-EXPERIAN (397-3742) 
www.experian.com, P.O. Box 9532, Allen, Texas 75013; TransUnion: 1-800-
680-7289, www.transunion.com, Fraud Victim Assistance Division, P.O. 
Box 6790, Fullerton, CA 92834-6790.
    Step 2.--Close any accounts that have been tampered with or opened 
fraudulently.
    Step 3.--File a police report with your local police or the police 
in the community where the identity theft took place.
    Step 4.--File a complaint with the Federal Trade Commission by 
using the FTC's Identity Theft Hotline by telephone: 1-877-438-4338, 
online at www.consumer.gov/idtheft, or by mail at Identity Theft 
Clearinghouse, Federal Trade Commission, 600 Pennsylvania Avenue, NW., 
Washington DC 20580.
    Question 6. I know the Department of Veterans Affairs maintains my 
health records electronically; was this information also compromised?
    Response. No electronic medical records were compromised. The data 
lost is primarily limited to an individual's name, date of birth, 
social security number, in some cases their spouse's information, as 
well as some disability ratings. However, this information could still 
be of potential use to identity thieves and we recommend that all 
veterans be extra vigilant in monitoring for signs of potential 
identity theft or misuse of this information.
    Question 7. What is the Department of Veterans Affairs doing to 
insure that this does not happen again?
    Response. The Department of Veterans Affairs is working with the 
President's Identity Theft Task Force, the Department of Justice and 
the Federal Trade Commission to investigate this data breach and to 
develop safeguards against similar incidents. The Department of 
Veterans Affairs has directed all VA employees complete the ``VA Cyber 
Security Awareness Training Course'' and complete the separate 
``General Employee Privacy Awareness Course'' by June 30, 2006. In 
addition, the Department of Veterans Affairs will immediately be 
conducting an inventory and review of all current positions requiring 
access to sensitive VA data and require all employees requiring access 
to sensitive VA data to undergo an updated National Agency Check and 
Inquiries (NACI) and/or a Minimum Background Investigation (MBI) 
depending on the level of access required by the responsibilities 
associated with their position. Appropriate law enforcement agencies, 
including the Federal Bureau of Investigation and the Inspector General 
of the Department of Veterans Affairs, have launched full-scale 
investigations into this matter.
    Question 8. Where can I get further, up-to-date information?
    Response. The Department of Veterans Affairs has set up a special 
website and a toll-free telephone number for veterans which features 
up-to-date news and information. Please visit www.firstgov.gov or call 
1-800-FED-INFO (333-4636).
    (a) CDT is a non-profit, public interest organization dedicated to 
preserving and promoting privacy, civil liberties and other democratic 
values on the Internet and new communications technology. Since its 
founding in 1994, CDT has tracked government information technology 
privacy and security policy to ensure that it has been kept up to date. 
This has included reports and testimony on the Privacy Act, the privacy 
provisions of the E-Government Act and the Federal Information Security 
Management Act.
    (b) GAO, Privacy Act: OMB Leadership Needed to Improve Agency 
Compliance, GAO-03-304 (Washington, DC; June 30, 2003).
    (c) CDT has championed the return of the Chief Privacy Counselor, 
or similar position, to OMB. At the end of the Clinton Administration, 
Chief Privacy Counselor Peter Swire produced regular guidance to 
agencies that, while not comprehensive, at least moved many agencies 
toward positive progress on important privacy matters.
    (d) OMB, ``Privacy Act Implementation: Guidelines and 
Responsibilities,'' Federal Register, Volume 40, Number 132, Part III, 
pp. 28948-28978 (Washington, DC.: July 9, 1975). There has been 
irregular guidance such as that issued on May 22, 2006 (the day of the 
public announcement of the breach).
    (e) Privacy Protection Study Commission, Personal Privacy in an 
Information Society, July 1977. An electronic version is available at 
http://www.epic.org/privacy/ppsc1977report/fPL 105-35.