Stolen laptop recovered, Committee lauds VA secretary’s efforts to change culture, improve security

Washington, D.C. — In response to concerns lodged by House Committee on Veterans’ Affairs Chairman Steve Buyer (R-Ind.), the Department of Veterans Affairs (VA) Office of Information and Technology will now have broad authority over the department’s information resources and security. At the committee’s fifth hearing on the recent data theft, VA Secretary R. James Nicholson made this announcement of this fundamental policy change as well as satisfying Buyer’s wish that VA provides detection, protection and insurance to any veteran who becomes a victim of fraud in connection with VA’s data loss.

Secretary James Nicholson made the House Committee on Veterans' Affairs aware of the changes he is making within the VA to improve information security measures. Nicholson announced that the laptop storing the sensitive information of over 26 million veterans and military personnel was recovered and is undergoing forensic investigations to determine whether or not the information was duplicated.

“Secretary Nicholson has at times not been well-served. He inherited a bad situation, but as a military man, he accepted responsibility for this sorry state,” Buyer said. “I commend him for taking bold action to change the culture at VA and for definitively granting his CIO the authority to manage and enforce VA’s information systems.”

The VA secretary spoke forcefully of his determination to “change the culture of the department.” In fact, on Wednesday night before the hearing, Nicholson signed a directive that places authority over all information management functions, including enforcement, with the department’s chief information officer (CIO).

“I have been paying close attention to these hearings,” Nicholson told Buyer. “I have heard your concerns that the CIO has insufficient enforcement authority to insure compliance with the deficiencies noted in the past and to ensure future compliance.” He told the committee that his decision centralizes not just responsibility, but enforcement authority.

Before the hearing began, Nicholson announced that the laptop and data storage device stolen in May have been recovered. The FBI reportedly does not believe the data has been accessed, reducing concerns of compromise, but not the importance of reform.

VA Secretary James Nicholson, Maj. Gen. Robert Howard (Ret), acting assistant secretary for information and technology at the VA and Gordon H. Mansfield, deputy secretary at the VA disclosed a new weekly report that they will maintain to track potential information security breaches, nationally.

“The recovery of the computer does not change the importance of our oversight,” Buyer said. “We will continue to hold the VA responsible and accountable.”

Nicholson also testified about additional losses of personal data in Minneapolis , MN and Indianapolis, IN. The Minneapolis loss occurred when files with veterans’ data were stolen from the trunk of a VA employee’s car. In Indianapolis, a back-up tape containing files on as many as 16,357 legal cases, is thought by the VA to have been a loss rather than a theft. In response to a request from Buyer, the department’s deputy secretary, Gordon Mansfield, disclosed a new VA report that tracks potential compromises, such as these two.

Rep. Stephanie Herseth (D-S.D.) said, “Today’s hearing demonstrates that the Department of Veterans Affairs must work very hard to address flaws in its data security system and make substantive efforts to protect the private information of veterans and military families.  I appreciate VA officials, including the Secretary, pledging to make these significant changes for the benefit of our nation's veterans.”

Also, the annual FISMA audit has consistently given the VA a failing grade; yet, VA employees have been receiving monetary performance bonuses. Chairman Buyer is pleased Secretary Nicholson stated that merit bonuses will now be directly tied to the employee’s compliance with VA information technology procedures and FISMA regulations.

“I appreciate everyone taking time over the past three weeks as we have conducted a roundtable and a series of seven hearings of the committee and its subcommittees to examine the failures of VA’s decentralized management program,” Buyer said. With the secretary’s positive response, we see solid indications that the department is on the right track, but we will continue to exercise oversight.”

Please visit our website at http://veterans.house.gov