[ISN] Stolen Metro laptop was being tested for use without full Social Security number

From: InfoSec News (alerts@private)
Date: Wed Jan 02 2008 - 22:41:25 PST


http://www.tennessean.com/apps/pbcs.dll/article?AID=/20071231/NEWS0202/71231107/1001/NEWS

By Sheila Wissner
Staff Writer
12/31/07

One of two stolen laptop computers bearing full Social Security numbers 
of 337,000 Metro voters had been left unsecured as workers tested 
whether it would work using only the last four digits of the number.

The other computer was left unsecured because it was being repaired, 
Metro Elections Administrator Ray Barrett said. Both were taken during a 
Christmas-stretch break-in at the county Election Commission offices on 
Second Avenue South.

The theft of the computers and the information they contain has raised 
fears of identity theft among voters across Davidson County.

People are just beside themselves. They are just livid about this, Metro 
Councilman Michael Craddock said.

It also raises fears among many that other sensitive personal data Metro 
maintains on its residents could be at risk.

The police report on the laptop theft said theres no security guard on 
duty on Saturdays at the Howard School Building complex an important 
Metro office facility that houses not only the county election 
commission but also the county clerks office, which processes automobile 
titles and tags. The report also said no alarms went off during the 
break-in.

Craddock and Mayor Karl Dean want to find out how the theft occurred and 
how to keep it from happening again. They also want to review Metros 
computer security policies to safeguard information other agencies store 
on computers.

Nashville registered voter Keith Newcomb wants the same kind of review.

It raises the question of, how secure is the information in all those 
various databases? he said.

The stolen laptops were to be used as stand-bys, taken by poll workers 
to early voting polling places for use in case the countys main 
computers malfunctioned, Barrett said.

If we didnt have the backup and the main computers went down, the voter 
would have to leave and go back later to vote? once the computers were 
running again, he said.

The election commission, one of several Metro agencies housed at the old 
Howard complex on Second Avenue South, keeps a number of laptops for 
such purposes.

Barrett said he was trying to determine why the two stolen ones were in 
an unsecured area of the office, instead of in the locked room where the 
other laptops were stored.

Thats a question I asked,? Barrett said.

Barrett said the commission was in the process of purging full Social 
Security numbers from laptops when the theft occurred. He said one of 
the stolen laptops was being tested in advance of the Jan. 16 start of 
early voting for the Feb. 5 primary election.

The test was to see whether a new database with just the last four 
digits of the Social Security numbers would function properly. Barrett 
said he didnt know whether the new database had overwritten the full 
Social Security numbers.

Both laptops were password-protected, he said, but added that a smart 
computer user likely could break the password. He said he was 
particularly concerned that someone might be able to get the broken 
laptop running. It contains full Social Security numbers, he said.

Meanwhile, Craddock, who is chairman of the Metro Councils Public Safety 
Committee, and Dean are posing questions about the break-in and security 
at Howard School Office Building to officials with the election 
commission; the General Services Department, which provides for building 
security; and the Information and Technology division.

Among the questions: Whether the laptops were encrypted to make the data 
impossible for a thief to read, whether the building had any security at 
the time of the break-in and whether there was an alarm system in place. 
If the answers are no, they want to know why.

Officials from the three divisions have been asked to attend a 5:30 p.m. 
Thursday public safety committee meeting in council chambers to answer 
questions about the theft and data security.

Police believe the theft occurred Dec. 22 or 23, said police spokesman 
Don Aaron. Building security is provided by Specialized Security 
Consultants Inc. of Mt. Juliet, a subcontractor of Wackenhut, said Bob 
Wieme, president of the Mt. Juliet firm.

There is an ongoing investigation,? Wieme said. He wouldnt comment 
further.

The police report said a security officer noticed about 6 p.m. Dec. 23 
that an interior roll-up door/window to the election commissions offices 
was raised up a little.

The officer thought this was normal in order to accommodate electrical 
wiring.

It wasnt until Dec. 26 that another officer checked further and found 
someone had gotten in by throwing a rock through an outside window.

In addition to the computers, a digital camera and computer router were 
taken as were two radios and several music CDs belonging to employees, 
police and election commission officials said.

Police have no indication any Social Security numbers have been 
fraudulently used, Aaron said.

The Election Commission is sending a letter to all 337,000 voters to 
alert them to the theft.

Copyright 2007, tennessean.com. All rights reserved.


__________________________________________________________________      
Visit InfoSec News
http://www.infosecnews.org/



This archive was generated by hypermail 2.1.3 : Wed Jan 02 2008 - 22:53:05 PST