A year later, victims of state blunder still wary

Mark Niquette

Jun. 15, 2008 (McClatchy-Tribune Regional News delivered by Newstex) -- Stephen Boch remembers being "surprised and disgusted" when he learned that his Social Security number was on a backup computer tape stolen from a state intern's car last June.

One year later, he checks his bank accounts religiously every morning and sometimes at night to make sure nothing is amiss, and he hopes Ohioans are better protected today against such a loss of sensitive personal information.

"I just hope the corrective steps (state officials) have taken are sufficient," said Boch, 57, a former state employee from Bremen who now works in the information-technology field.

One year ago today, Gov. Ted Strickland announced that a backup tape, containing data from the state's new payroll and accounting system on 1.3 million individuals, businesses and other entities, was sent home with an intern for safe-keeping and was stolen from his car outside his Hilliard apartment complex.

Strickland and others say there's no evidence the tape has been used to steal anyone's identity, and although state leaders can't guarantee there won't be problems again, they insist that state computer security and privacy has improved significantly.

Ohio has spent nearly $934,000 on SafeBoot software to encrypt sensitive data for more than 70,000 state laptops, personal computers and other data devices, a process that is expected to be complete by the end of the month.

An additional $850,000 has been spent for Computrace service to track state laptops and other computers and to have the ability to delete sensitive information remotely.

The state plans to hire a chief information security officer. And state security procedures also have been reviewed and revamped -- starting, of course, with not sending computer backup tapes home with interns.

"If there was an 'easy button' for security, we would have pressed it," said chief privacy officer Sol Bermann, referring to the television commercial for Staples stores in which pressing a large red button magically solves complex problems.

The state also paid nearly $2.2 million to provide one year of free identity-theft monitoring for anyone affected.

But Boch and others say the state should offer more than a year of protection, just in case someone still is holding the tape with plans to use it when the coverage expires.

Experts say it's very unlikely the tape could be used -- if it wasn't discarded or ruined by last summer's heat.

Beth Givens, director of the California-based Privacy Rights Clearinghouse, said she considers the Ohio incident to be "particularly egregious" because of how the tape was handled.

But she also gives Strickland and state leaders high marks for going public four days after the theft was reported to police, even though it forced a series of news conferences as more and more information was confirmed to be on the tape.

Strickland said he can't think of anything he would change in how the state responded.

"I don't want to sound self-congratulatory here, but looking back on that, I think from the moment that I found out about it, we responded quickly, we responded in a transparent manner, we did everything that I believe was humanly possible to provide protection to those (affected)," the governor said.

In fact, state leaders say their response to the data theft is being held up as a model outside Ohio. They say the silver lining is that not only are the state's vulnerabilities being addressed, there's better communication now about data security among state agencies.

The Ohio Department of Administrative Services also mobilized after the theft to quickly negotiate identity-theft coverage and notify affected residents, and dozens of workers across state government volunteered to staff a call center for residents' questions.

"It was an opportunity to show what state government could do," Director Hugh Quill said.

As for Jared A. Ilovar, the state intern who was fired for his role in the loss and complained that he was being made a scapegoat, he's still not saying anything publicly about it.

Reached by phone last week, Ilovar declined to be interviewed for this story or to discuss what he has done since the events of last year.

mniquette@dispatch.com

Newstex ID: KRTB-0147-25993444