April 16, 2014

Elyria
Clear
26°F
test

Order to secure data issued before theft

COLUMBUS — State employees had been ordered to remove thousands of Social Security numbers from a new payroll and accounting system two months before a computer backup tape containing the personal data was stolen from an intern, a newspaper reported Saturday.
David White, executive program manager for the massive new computer project called the Ohio Administrative Knowledge System, sent an e-mail to four workers on April 4 telling them to move sensitive files to a secure part of the system, according to The Columbus Dispatch, which obtained a copy of the e-mail through a public records request.
“I want all files that can be identified with SSN data put into a secure directory today,” White wrote.
The theft in June from a state intern’s unlocked car at an apartment complex in suburban Hilliard prompted Gov. Ted Strickland to order a review of how state data is handled. He also ended the practice of employees taking backup devices home for safekeeping.
Ohio Inspector General Tom Charles told The Associated Press on Saturday that his office aims to issue a report on the stolen backup tape by Friday. He wouldn’t comment on whether White’s order to move sensitive data off the main network was ignored.
The intern, Jared Ilovar, hasn’t been accused of wrongdoing.
The device contained sensitive data on 859,852 people, including 64,000 state employees and about 770,000 taxpayers with uncashed state income refund checks. It also held records on at least 258,529 entities, including businesses, vendors, school districts and local governments.
Once an investigation is complete, Strickland will take appropriate disciplinary action to hold responsible anyone who placed personal data at risk, said Keith Dailey, a spokesman for the governor.
Strickland has said there is no evidence that information on the device has been accessed. Extracting the data on the device would require a high degree of knowledge and specialized equipment.
About 58,300 people have enrolled in identity-theft protection services offered through the state since the device went missing. The state’s total cost for ID-protection services and other expenses related to the theft could reach $2 million.