Blue Lance InfoSec Blog

Another State Department Employee Pleads Guilty to Snooping

Karal Busch, a 28 year old Maryland resident and employee of the State Department has pleaded guilty to illegally accessing U.S. passport records of President Barack Obama, in addition to records of Secretary of State Hillary Clinton and Senator John McCain.  The initial breach occurred in March of 2008, during the presidential campaign.  Busch was one of many to be targeted for prosecution for similar crimes, and is the sixth to plead guilty to charges.  After Busch’s group’s breach, the State Department found that there had been an even larger breach of information in their Passport Information Electronic Records System (PIERS).

Busch worked for the State Department as a citizens’ services specialist in the Office of Children’s Issues from June 2003 through July 2006.  For a period of time, Busch logged onto the PIERS database and viewed the passport applications of over 65 celebrities and their families, actors, professional athletes, models, musicians, and other individuals identified in the press, said the Department of Justice press release.  She had no work-related reasons to access the files in question.

Busch is scheduled to be sentenced December 15^th, 2009.  Her cohorts, some of whom have already been sentenced, received punitive measures such as probation, and fines or community service.

New Study Finds Insider Incidents Primarily Accidental - But Still Costly

A new study of 400 organizations by IDC and RSA finds that more than half (52%) of organizations characterized insider incidents and predominantly accidental.  However, the annual loss from insider incidents is approaching $800,000 per organization in the United States alone.

Among the types of internal threats measured, the report finds that organizations experience nearly one incident per month from each type of threat.

Some of the other highlights include:

• Inappropriate, out of date privileges and access rights have the largest financial impact to organizations.
• 40% of surveyed organizations list contractors and temporary employees as the highest risk.
• Technical staff and IT administrators are seen a potential threats due to their access to multiple sensitive systems.

For more information, download the study.

Personal Information Exposed on Boston University ROTC Server

A file transfer program was installed where it shouldn’t have been: on a server in the Army Reserve Officers’ Training Corps at Boston University.  The program made visible in the public domain thousands of affiliated individuals’ personal information, including social security numbers and some birth dates. 

The breach was identified on July 28th, at which time university officials say the affected computer was taken offline.  The U.S. Army Cadet Command is collaborating with university officials to notify all 6,675 affected people.  Only 406 of them were affiliated with Boston University; officials believe the rest of the individuals’ records came from ROTC offices throughout the country.

An investigation conducted shows that the information has been visible since last September, when an ROTC member mistakenly installed the software without approval from the university.  The breach wasn’t discovered by the university, but by someone searching the web for something else.

Health Organizations Must Notify Patients of Security Breaches, Even if not Bound by HIPAA

Yesterday, the FTC ruled that web based businesses will be required to notify consumers in the case of a security breach involving electronic health information.  The ruling applies to businesses that offer third-party applications for personal health records and vendors of personal health records.

The new rule is part of the American Recovery and Reinvestment Act of 2009, and was put into place by Congress.  The businesses that will be affected by this rule offer services that are not already subject to HIPAA privacy and security requirements.  A study will be conducted by the Department of Health and Human Services on potential security, privacy, and breach notification requirements for entities not governed by HIPAA regulations, with a report forthcoming by February 2010.  Meanwhile, the FTC ruled that these businesses notify consumers of any breach of the security of their health information.  In addition, any service providers of these businesses that encounter a data breach must notify their client, who will then in turn notify the consumers.

The ruling details content of the breach notification, method of notification, and time constraints.  Should a breach occur involving 500 or more records, it is required that the media be notified as well as the FTC.

Former United Way Employee Indicted for Deleting Donor Files

Former United Way of Miami-Dade (UWMD) computer specialist Luis Robert Altamarino was indicted Tuesday for a network attack which included deleting files from United Way's servers including donor contact information.  In addition, Altamarino also allegedly disabled the UWMD voicemail system, preventing access to the system by callers and employees.

Altamarino was employed by UWMD from July to December 2007, but still apparently had access to the network a year after his employment had been terminated. 

More information is available from the press release.

9 Workers Terminated for Snooping Through Personal Records on the Job

Nine British workers in the public sector have been terminated for illegally accessing the Customer Information System (CIS) database.  The records accessed were primarily those of friends of the workers, as well as celebrity records.   The CIS is the core database of the British government's National Identity Scheme.

The accused are among 34 council workers who illegally accessed the Customer Information System database, which holds the biographical data of the population that will underpin the government's multi-billion-pound ID card program.

The CIS database, run by the British Department for Work and Pensions, stores up to 9,800 records on over 90 million people.  These records include sensitive data, such as ethnicity, relationship history, Pending fraud investigations, and whether the individual has special needs.

This breach is one of many perpetrated by insiders in various UK government divisions.  Check out more breaches here.

Charges Brought Against Would-be Information Thieves at Jackson Memorial Hospital

Ruben Rodriguez of South Florida allegedly conspired to steal personally identifiable information of patients of Jackson Memorial Hospital (JMH) and sell that information to at least one practicing lawyer in South Florida.  Rodriguez appeared in federal court July 30^th, and was released on $200,000 bond.

The six count indictment states that Rodriguez solicited Rebecca Garcia, and ultrasound technician for the hospital, to access, obtain, and transfer the information for him in exchange for monthly payments of an undisclosed amount.  Rodriguez would then pass the information on to the lawyer, whose name was not mentioned in the press release, to be used to illegally solicit JMH patients, hoping to represent them in legal proceedings.  The lawyer would pay Rodriguez to provide this information in amounts dictated in part by lawsuits and settlements won from clients found through the patient records.

Rodriguez faces up to 5 years in prison for conspiracy and fraud in connection to computers, 10 years for wrongful disclosure of individually identifiable health information, and a mandatory 2 year consecutive imprisonment for aggravated identity theft offenses.  Garcia, who has already plead guilty, faces a maximum of 10 years imprisonment.