Photo credit: www.govexec.com
Whistleblowers Receive Award for Exposing Data Security Issues at Veterans Affairs
On October 10th, the Office of Special Counsel (OSC) recognized three whistleblowers from the Department of Veterans Affairs (VA) with the Public Servant award for their courageous actions that brought to light significant lapses in the protection of personally identifiable information (PII) within the department’s data systems.
The awarded individuals include former senior program manager Peter Rizzo, program analyst Kristen Ruell, and another VA employee who wishes to remain anonymous. Their disclosures revealed improper storage practices regarding personal information in VA’s electronic system, which is utilized for managing correspondence and assisting veterans with inquiries about services offered by the department.
Special Counsel Hampton Dellinger remarked, “The investigation spurred by their disclosure uncovered thousands of instances in which personal information was not properly protected and was accessible to VA employees across the agency regardless of the employees’ need to know. This case illustrates how OSC’s disclosure process is a vital mechanism that ensures executive agencies meet their obligations and strengthens the public’s trust in its government.”
The OSC’s subsequent investigation unveiled that sensitive information, including dates of birth, social security numbers, addresses, and phone numbers, could be viewed by any user within the system. Unfortunately, the scope of unauthorized access could not be determined due to a lack of recorded data following a recent transition to a new data management tool.
In response to the revelations, the VA has initiated measures to tighten access controls within the system and has classified all open and closed cases as “sensitive” to enhance data security.
In a report to the president published in September, OSC noted the whistleblowers criticized the protracted timeline of the VA’s investigation into their claims. Additionally, there was disagreement over OSC’s findings, particularly regarding the agency’s alleged failure to include pertinent information from the internal system in responses to Freedom of Information Act and Privacy Act requests, as well as the improper use of such information by VA police in investigations of suspected criminal activities.
Despite the points of contention, Dellinger conveyed his expectation for the VA to persist in monitoring and auditing the use of personal data within the system. He also urged the department’s inspector general to closely oversee the VA’s compliance with relevant laws designed to protect this sensitive information.
Source
www.govexec.com