Government must protect sensitive data of its citizens

THE ISSUE A home burglary has left as many as 26.5 million veterans vulnerable to identity theft.

FOR years the Department of Veterans Affairs has been warned about its slack security of information in a high-tech age, but it was a low-tech breach -- a common burglary -- that placed 26.5 million veterans at risk for identity theft.

The department's carelessness leaves vulnerable as many as 33,000 Hawaii veterans whose names, birthdays and Social Security numbers were contained in a laptop and external drive stolen from the Maryland home of a VA employee three weeks ago.

VA officials say there is no evidence the information has been used illegally since the break-in, but there is no way they can ensure that the private information won't end up in the hands of swindlers in the months and years to come.

Unlike in credit card or bank fraud, where accounts can be closed or changed, basic personal data can't be replaced. Veterans will have to monitor credit scores, credit cards and bank statements continually and indefinitely, and though the department has given veterans instructions on how to avoid problems, its culpability requires the VA to do more than just that.

Since 2001, the department's inspector general has advised the VA to restrict access and install safeguards to keep hackers and others from gaining information. The employee whose home was burglarized was not authorized to take data from his workplace, but the VA had no controls in place to prevent that.

Now that the horse is out of the barn, the VA says it will tighten its procedures, allow access only to employees who need the data to do their jobs and do background checks on them, but its actions come too late.

The VA delayed informing veterans and the Justice Department about the stolen data because it did not believe the burglars had specifically sought the laptop and didn't know the value of the information. Their embarrassment notwithstanding, officials should have erred on the side of caution.

With an estimated 10 million cases, identify theft has become a huge problem for Americans, as President Bush acknowledged earlier this month when he formed a task force to examine the issue. But as the group was meeting for the first time Monday, the VA was announcing that the government itself had failed to protect its own records.

As federal and other government authorities continue to collect a vast amount of private information, it has a duty to protect that data. With names, birthdays and Social Security numbers, anyone -- from terrorists to illegal immigrants -- can assume an identity difficult to detect as bogus.