Ohio state employee data stolen

NBC4i is reporting:

A disk with personal information on all 64,000 state employees, including their Social Security numbers, was stolen from a state worker’s car last Sunday, Gov. Ted Strickland said Friday.

Strickland said he doesn’t believe worker privacy is in jeopardy because it would take special equipment to access the information.

In a news conference, Strickland said the employee mistakenly left the disk in a vehicle parked outside an apartment when it was supposed to be taken into the worker’s home as part of a protocol in place since 2002. The employee is being investigated. The disk is a backup, he said.

There’s a protocol to keep backups of employee data in employee’s homes? That’s weird. I bet it’s a somewhat common practice though.

From the Dispatch blog:

The storage device – described as the second backup tape — with the sensitive information apparently is taken offsite each night by a rotating staff of state network administrators.

But the state intern who had it Sunday night did not follow proper procedure and left it in his car, where it was stolen after a break-in, Strickland said.

Intern? Jesus.

Strickland said it would require a significant levels of expertise and multiple computer programs to access the personal information of the more than 60,000 state workers.

Yeah it would take Windows, MS Access, Excel, and a text editor- and the ability to use them. Just joking, but what’s the big deal about “multiple computer programs”? That’s not exactly a high bar in itself. I note that the governor is not quoted using the word “encrypted” in either story, so that’s out. Apparently they’re relying on obscurity.

UPDATE: Gov. Strickland has rescinded the “backup data at home with employees” policy. The state has set up a web page, ohio.gov/idprotect, for those whose data was stolen. There’s the customary one year of “free identity theft prevention and protection services”. More at Business First.