VA reports 10 missing laptops, likely no personal data lost

CIO Roger Baker says most of the lost laptops were not loaded with data and applications. Chris Flynn

The Veterans Affairs Department discovered 10 laptops were missing from its inventory in August, an unusually high number of lost computers, VA's chief information officer said on Friday.

The frequency of incidents surprised CIO Roger Baker, who disclosed the lost laptops during a regularly scheduled call with reporters to discuss VA's mandated monthly reports to Congress on potential data breaches. The department has been under scrutiny during the past few years after several high-profile incidents that resulted in the loss of veterans' personal data. A laptop theft in 2006, for example, jeopardized the private information of more than 26 million veterans.

In May, Baker started holding monthly briefings for the press as part of what he said was an effort to be more transparent about information security at the department.

The recent security breaches, which were reported in August, mostly involved machines that disappeared from VA's inventory or before they were loaded with data and applications, Baker said. Nevertheless, "We'll have to go research to determine whether our security is good enough in those areas" and figure out, "Do we have anything more than a statistically random amount of them missing, or is something more going on?" he said.

In June and July, six machines were reported lost.

Of the laptops in question, seven were encrypted, or rendered unreadable to people who do not possess a password. One machine, which was not encrypted, was used to design prosthetic devices but did not store patient information. "It was used as a teaching tool on dummy test cases," the August report stated.

In another instance, an information technology specialist, who had been installing software on new laptops, left computers in a secure storage room on Aug. 20. When he returned Aug. 24, one was missing. That laptop had not yet been encrypted, the report stated. Contractors now cannot access the room without an escort, and officials installed an alarm system in the office.