Olympia theft brings US data security risk home

House government oversight committee leaders are rightly outraged that a federal employee in Olympia used a personal laptop to carry out child-support audits and that the computer, which apparently contained huge volumes of personal data, was stolen.

The Olympia break-ins were at the Office of Child Support Enforcement branch, located at 701 Capitol Way S. The agency oversees child-support programs across the country.

Leaders of a U.S. House oversight panel, Rep. Jason Chaffetz, R-Utah, and Rep. Elijah Cummings, D-Maryland, sent a letter to Health and Human Services Secretary Sylvia Burwell demanding answers to know why HHS waited almost two months to notify Congress. The Federal Information Security Management Act requires notice no later than a week for major incidents.

The lawmakers also want to know which databases could have been accessed. The leader of a Senate inquiry also sent a letter.

Names, birth dates, Social Security numbers, addresses and phone numbers for as many as 5 million people might have been on the hard drives, and it’s unclear whether data were encrypted.

Loose handling of sensitive data is a serious problem. It fits the larger pattern of state and federal government agencies, as well as private firms, failing to adequately secure data. Records for more than 4 million people were stolen in a hack at the U.S. Office of Personnel Management last year; a second OPM theft involved personal information for more than 21 million people.

Olympia police arrested two men on charges related to the early February and March break-ins.

As we’ve learned with stunts carried out by congressional investigators over the State Department errors at Benghazi, Libya, the billows of outrage emitted by Congress can turn out to be a smaller fire than advertised.

But the Obama administration is moving far too slowly to divulge what it knows. That’s not acceptable.

This story was originally published April 6, 2016 at 12:30 PM with the headline "Olympia theft brings US data security risk home."