Keith’s note: One NASA Watch reader writes: “I too received a letter warning of my PII being comprimised by the stolen laptop but there are two things that I find odd. 1) As was the case in the image of the letter posted on NASAWatch, the return address is a NASA emblem with the address of the retained security contractor’s Portland address (since when can a contractor use an offical US gov emblem?); and 2) why does a NASA laptop have my PII considering I left the Agency in May 2009?“
Another reader writes: “I too received “the letter” about the stolen laptop and I retired from GSFC in mid-2003 – ten years ago! And it is my responsibility to take the necessary steps to protect myself?! Why after ten years would my PI be anywhere but at OPM let alone on someone’s (NASA) unencrypted laptop?! Please keep their feet to the fire on this one Keith; NASA needs to be as well-steamed as I am.”
NASA Personally Identifiable Information (PII) Update 20 Nov 2012
“The data analysis on the entire file has not yet been completed, but if data beyond SSN, date of birth and birthplace is found for individuals, we will send them another letter. Affected individuals identified to date include people who have applied for access to NASA information or facilities for which a background investigated is required.”
NASA Internal Memo: Immediate Restriction on Laptops Leaving Ames
“Effective immediately, NO NASA LAPTOP may be taken off the Ames Research Center campus unless Whole Disk Encryption is enabled. I am fully aware that this is a more restrictive than the November 14, 2012 directive from the Agency Chief Information Office and Administrator, however, since that email, Ames has had two laptops stolen that we are now handling.”
– NASA IT Blunder Update, earlier post
– Yet Another NASA IT Blunder, earlier post

Biologist, Explorers Club Fellow, ex-NASA Space Biologist and Payload integrator, Editor of NASAWatch.com and Astrobiology.com, Lapsed climber, Explorer, Synaesthete, Former Challenger Center board member 🖖🏻

10 replies on “Questions Remain About Information on Stolen NASA Laptop”

  1. I’d be interested in knowing what the final cost of informing letters, containing tactics, and devising/implementing corrective procedures ends up being for this one incident.  Better still, how much does NASA spend in a year “fixing” these sorts of never-should-have-happened problems.

    Steve

      1. Keith,

        Are you **actually** expecting a coherent answer from either the PAO or the CIO? I think I’d spray my keyboard & slide off my chair if either happened.

        Dumb & Dumberer seems to fit.

  2.  From the Ames memo: Employees who disregard this policy or disable whole disk encryption may be subject to disciplinary action.

    “May be”?

    Get ready for everyone to ignore this rule again.

  3. I have yet to see any evidence that any of the PII on the lost laptop has been used for identity theft or fraud, or that whoever stole the laptop was even able to access the information. So far, other than the loss of the computer itself, it is just a “potential” problem.  The NASA response is an expensive and rather mechanistic rule that is supposed to infallibly protect the agency against poor judgement. Obviously it can’t. Anyone might inadvertently save a sensitive file on a USB drive and lose it, or email information off site. If people don’t use good judgement about confidential information it can be compromised, and if they do use good judgement there is very seldom any good reason to take it offsite in the first place and trivial to encrypt the files or data partition if they do. 

    1. Anyone might inadvertently save a sensitive file on a USB drive and lose it, or email information off site.

      No.

      My company only allows two brands of secure/encrypted USB drives to be connected to PCs. 

      We also have a firewall filter in place that does not allow this type of information to be emailed outside the corporate firewall.

      It comes down to the discipline and will to fix the problem, which are characteristics NASA has lacked for many years.

  4. With respect to disciplinary actions, I am still not aware of what, if any, actions have been taken against the individual responsible for this travesty.  His/her dishonesty, carelessness, irresponsiblity, and thoroughly unprofessional behavior have embarrassed the Agency, cost the Federal Government, and more than inconvenienced thousands of people — with what consequence?  (Yes, I got “the letter” too!)

  5.  Accountability is next to non existent at the agency and it stems from small hings such as this. NASA contractors will be the only ones to pay if anyone at all.

    I think anyone found violating this after these notices should be terminated immediately. No may be, but or other excuses.

    This culture of unaccountability will only lead to more failure at the agency. SLS is a glaring example.

  6. I don’t understand how a laptop with a waiver from the requirement for Data at Rest encryption had any PII information.   The waiver requires the employee to sign and certify that the system does not use or process this type of information.     We must start holding people accountable and enforce the policies that are in place.   We also have to stop allowing the users to call the shots about how computers are managed and tracked.   NASA coddles their employees too much.

Comments are closed.