All news
Texas PII Massacre
April 26, 2011
It’s getting scary out there! In an eweek.com article released on April 12, the personally identifiable information (PII) of 3.5 million Texans were accidentally posted to a publicly available server. Not only was the information posted, but it was available on the server for more than a year!
When data was transferred from the Teacher Retirement System of Texas, the Texas Workforce Commission, and the Employees Retirement System of Texas to the comptroller’s office to verify unclaimed property records as required by law, it was sent unencrypted, and the data was not sorted into separate data fields. eWeek reported that the exposed data wasn’t discovered until other folders were being scanned on the same FTP (file transfer protocol) server – which is used for transferring files. That server contains other public information, such as state contracts.
The Texas attorney general and the FBI are investigating this incident. It was noted by the office that once the data was received by the comptroller, internal procedures were not followed, which allowed the information posted on the public server to remain there and not be purged as it should have been.
“Encrypting records before data transfer could have saved the Texas Comptroller's office a lot of headaches and expense," Robert J. Scott, managing partner of intellectual property and technology law firm Scott & Scott, told eWeek.
Following the discovery of the breach, a number of employees in the comptroller’s office were fired, though the agency has not disclosed their identities or the exact number of employees who were affected.
Susan Combs, the Texas state comptroller, released a statement saying, “We take information security very seriously, and this type of exposure will not happen again.”
How can companies mitigate the risk of this type of exposure occurring on their own networks? ARMA International has several suggestions to make on this score, some of which are included in its Generally Accepted Recordkeeping Principles® (www.arma.org/garp). In short, the suggestions encompass a variety of policy and technical solutions:
- Establish firm policies and procedures to ensure information is properly protected against inappropriate exposure.
- Train employees on the policies and procedures so everyone understands their responsibilities.
- Use technology to ensure only personnel with the appropriate level of security / clearance can access sensitive information
- Utilize encryption and other security protocols to protect information at all times.
- Conduct periodic audits and reviews to ensure established procedures are being followed.
Diane Carlisle
NewsWire
