VA chief blames data analyst for theft

WASHINGTON — Secretary of Veterans Affairs Jim Nicholson told Congress on Thursday he is "mad as hell" about the theft of personal data on more than 26 million veterans and about his department's failure to notify him about it promptly, and he promised strong "corrective action."

Appearing successively before the House Veterans' Affairs Committee and a joint hearing of the Senate veterans and homeland-security committees, Nicholson said he accepts responsibility for the loss of veterans' data resulting from a burglary at a VA employee's home.

But he appeared to fix the bulk of the blame on the data analyst who took the electronic data files home to work on without proper authorization and lost them when his laptop computer and an external hard drive were stolen.

Lawmakers said the problem goes far beyond the transgression of one employee, lambasting Nicholson and other top VA officials for an information-security system that has been repeatedly identified as vulnerable in recent years.

VA officials told the committees that there was no evidence of a focused effort to steal data on veterans. A number of CDs containing sensitive VA data were left in the house after the burglary, VA Inspector General George Opfer testified.

Nicholson said the employee whose home was burglarized has been placed on administrative leave.

Nicholson testified that "I am the person responsible for this situation." If the May 3 theft at the data analyst's Aspen Hill, Md., home was not bad enough, "I was not notified about this event until May 16," Nicholson said in opening remarks.

He said the stolen records contain the names and birth dates of 26.5 million veterans "and some spouses." The data also include the Social Security numbers of 19.6 million of the veterans, he said. In addition, there were "some numerical disability ratings and diagnostic codes that identify their disability." Not included, he said, were any VA electronic health records or "explicit financial information."

The affected veterans were those who have been discharged since 1975, plus veterans receiving VA disability compensation, Nicholson said. He said fewer than 100 spouses were included in a stolen electronic file listing people who had been affected by mustard gas.

Sen. Patty Murray, D-Wash., pointing out that there are about 25 million living veterans in the United States, of whom 6 million are enrolled in the VA, asked about the discrepancy of 1.5 million names in the stolen records.

"Some of the veterans on this list would be deceased but not expunged from the rolls," Nicholson said. But he was at a loss to explain how the VA would identify the dead and contact their relatives to alert them to the possibility that the identities of deceased veterans could be used for nefarious purposes. "We have to look at that," he said.

Murray said the VA needs to do more. There are 700,000 veterans in Washington state, she said, and the VA doesn't know who is affected and how to notify them.

Nicholson said the VA is sending letters to all the 19.6 million people whose Social Security numbers were stolen, urging them to "be vigilant" for signs of identity theft and advising them how to protect themselves. He said a special VA call center also has been set up.

Nicholson said the cost of the mailing and call centers is estimated at $25 million. The mailing alone will cost $10 million to $11 million, he told Murray, who said, "I want to make sure veterans don't get hit with a double whammy of not only losing their records but then being denied services because costs are not being covered."

Washington state Attorney General Rob McKenna, meanwhile, sent a letter to Nicholson on Thursday asking that Washington veterans be provided a copy of the law-enforcement report regarding the data breach.

That will allow them to request a security freeze with the credit bureaus.

Seattle Times reporter Jolayne Houtz and Medill News Service intern Maria Hegstad contributed to this report.