Another shoe drops in Ohio data caper

Yet another “other” shoe dropped Monday in Ohio’s continuing Saga of the Stolen Data. Actually, “dropped” isn’t quite the word. The agency in charge quietly set it down in a teensy little e-mail, probably in hopes that it wouldn’t get noticed. The Bureau of Workers’ Compensation revealed that a laptop containing Social Security numbers and other personal data of 439 injured workers was stolen from the home of a BWC auditor.

While that’s small potatoes compared to the data on 225,000 taxpayers and 64,000 state employees on a backup computer tape stolen from a state intern’s car on June 10, it’s another glaring example of sloppy, antiquated and nonsensical Ohio data security practices that have to be corrected – now.

But here’s what is most troubling. The laptop was swiped on May 30. BWC Administrator Marsha Ryan says she wasn’t even told about it until June 15 – not coincidentally, the same day Gov. Ted Strickland revealed that the tape was stolen. Only then did BWC even think to determine whether sensitive data had been on the laptop. And it waited until June 25 to make public the nearly four-week-old laptop theft. Why the delay? And why did Ryan’s subordinates fail to tell their boss until two weeks after they reported the theft to the Ohio Highway Patrol?

Strickland has won kudos for informing the public about the tape theft early, often and in no-nonsense, no-passing-the-buck language. Contrast that with BWC’s handling of the laptop theft. Is it a sign that disarray continues to plague the agency? Ryan said the stolen laptop was “password protected,” which means that the average 15-year-old should have no trouble accessing the workers’ information. “As a public institution, we must be more diligent in protecting the personal information contained on both internal and external digital devices,” she said. Do tell.

To all those other state agencies that have unsecured laptops and discs and flash drives and, who knows, maybe 8-track “Disco’s Greatest Hits” tapes floating around with Ohioans’ personal data on them: Get serious. We need more than lip service here.