A Data Theft Solution: Stop Winging It

I just recently heard on the local news that the intern who had the data tapes stolen while in his possession blamed others in management for not telling how to properly store the tapes in transfer. He didn't bring this up until he was consequently fired (along with others) shortly after the theft, basically due to this incident. And it's interesting to me that Governor Strickland did not want to put all of the responsibility on the intern without getting all of the facts.

Well, here are some of the facts: According to an article in The Columbus Dispatch, by Mark Niquette, dated July 19,2007, The Ohio Inspector General, Thomas P. Charles nissued a report stating that a memo instructs personnel that sensitive data, including Social Security Numbers were to be removed to a secure part of the Ohio Administrative Knowledge System and not saved on the network drive from which the backup tape was created. ¹

And I say, apparently, a memo is not enough. This may be a serious indication of a situation where internal politics ran amuck. Unfortunately, when one in management doesn't take charge..nothing gets done. Are there clear and concise job descriptions for the management roles?

As far as the severity of the incident, we must ask ourselves why would someone steal a backup tape unless they wanted to see what was on it? From what I gathered, it wasn't a laptop, therefore the intent was not to get a computer. So the threat of a data compromise is real.

I would also like to know what criteria and mandatory requirements an intern must have in order to be trusted and deemed responsible to handle sensitive data? While it is clear that state officials (management) slipped up on this one by not implementing the standards determined by the memo, the intern must also take responsibility for not securing state property while in transit.

Everyone loses here.

Business colleagues: Stop winging it. Don't leave yourselves and your business open to public questioning of core processes. Write down the processes in a procedural manual and have the intern or other associate responsible for the computer/tapes/etc. sign a form that he or she has read and understands the policy. Go over the document to make sure he or she understands it. If you don't have time develop a manual, hire a technical writing specialist to do so. Otherwise, we will continue to see the "blame game" in action.

¹ Mark Niquette, with additional contribution by Alan Johnson, "Data Goofs Preceded Theft", The Columbus Dispatch, July 19, 2007.