FAILURE OF VA’S INFORMATION 

MANAGEMENT

Hearing

before the

Committee on 

Veterans’ Affairs

House of Representatives

one hundred ninth congress

second session

May 25, 2006

Printed for the use of the Committee on Veterans’ Affairs

Serial No. 109-48

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC area (202) 512-1800

Fax: (202) 512-2250 Mail: Stop SSOP, Washington, DC 20402-0001

u.s. government printing office

washington : 2007

28-124.PDF
Committee on Veterans’ Affairs

Steve Buyer, Indiana, Chairman

Michael Bilirakis, Florida Lane Evans, Illinois, Ranking

Terry, Alabama Bob Filner, California

Cliff Stearns, Florida Luis V. Gutierrez, Illinois

dan burton, Indiana Corrine Brown, Florida

Jerry Moran, Kansas Vic Snyder, Arkansas

richard H. baker, Louisiana Michael H. Michaud, Maine

Henry E. Brown, Jr., South Carolina Stephanie Herseth, South 

Jeff Miller, Florida Dakota

John Boozman, Arkansas Ted Strickland, Ohio

Jeb Bradley, New Hampshire Darlene Hooley, Oregon

Ginny Brown-Waite, Florida Silvestre Reyes, Texas

Michael R. Turner, Ohio Shelley Berkley, Nevada

John Campbell, California Tom Udall, New Mexico

 John T. Salazar, Colorado

JAMES M. LARIVIERE, Staff Director

(II)
CONTENTS

May 25, 2006

 Page

1

1

66

4

68

4

70

74

76

78

81

82

83

87

89

91

93

95

6

96

21

101

54

107

Failure of VA’s Information Management ...............................

OPENING STATEMENTS

Hon. Steve Buyer, Chairman ...................................................

Prepared statement of Chairman Buyer ..................................

Hon. Ted Strickland ...................................................................

Prepared statement of Mr. Strickland .....................................

Hon. Bob Filner ..........................................................................

STATEMENTS FOR THE RECORD

Hon. Michael Bilirakis ...............................................................

Hon. Luis V. Gutierrez ..............................................................

Hon. Cliff Stearns ......................................................................

Hon. Corrine Brown of Florida .................................................

Hon. Richard H. Baker ..............................................................

Hon. Michael H. Michaud .........................................................

Hon. Jeff Miller of Florida .........................................................

Hon. Stephanie Herseth ............................................................

Hon. John Boozman ...................................................................

Hon. Tom Udall .........................................................................

Hon. John T. Salazar .................................................................

Hon. Terry Everett .....................................................................

Witnesses

Nicholson, Hon. R. James, Secretary, U.S. Department of

Veterans Affairs .....................................................................

Prepared statement of Secretary Nicholson ............................

Opfer, Hon. George J., Inspector General, U.S. Department of 

Veterans Affairs .....................................................................

Prepared statement of Mr. Opfer .............................................

Pratt, Stuart, President and Chief Executive Officer, Consumer Data Industry Association .........................................

Prepared statement of Mr. Pratt ..............................................

(III)
WITNESSES (CONTINUED)

Hoffman, Dennis, Vice President of Information Security, 

 EMC Corporation .....................................................................

Prepared statement of Mr. Hoffman ..........................................

Litan, Avivah, Vice President and Distinguished Analyst, 

 Gartner, Incorporated .............................................................

Prepared statement of Ms. Litan ...............................................

INFORMATION FOR THE RECORD

Kappelman, Leon A., Ph.D., Professor of Information Systems,

 Director Emritus, Information Systems Research Center,

 Fellow, Texas Center for Digital Knowledge, Associate

 Director, Center for Quality & Productivity, Information

 Technology & Decision Sciences department, College of

 Business Administration, University of North Texas,

statement of .............................................................................

VA’s Statement on the incident of May 3, 2006 ........................

VA’s Notification to Veterans .....................................................

VA’s FAQs on the incident of May 3, 2006 ................................

Secretary Principi’s Memorandum for Under Secretaries, Assistant Secretaries, Deputy Assistant Secretaries, and other

Key Officials, dated March 16, 2004 ......................................

VA’s Memorandum dated April 7, 2004 ....................................

POST-HEARING QUESTIONS FOR THE RECORD

Responses of the U.S. Department of Veterans Affairs to Post-

 Hearing Questions for the Record from Chairman Buyer,

 Hon. Terry Everett, Hon. Jeb Bradley, Hon. Ginny Brown-

 Waite, and Hon. John Campbell ...........................................

Responses of the U.S. Department of Veterans Affairs to Post-

 Hearing Questions for the Record from Hon. Lane Evans,

 Ranking Democratic Member and Hon. Luis V. Gutierrez ...

(IV)

56

113

59

119

125

127

129

131

135

136

142

237
(1)

FAILURE OF VA’S INFORMATION MANAGEMENT

THURSDAY, MAY 25, 2006

U.S. HOUSE OF REPRESENTATIVES, 

COMMITTEE ON VETERANS’ AFFAIRS,

Washington, D.C.

 The Committee met, pursuant to call, at 9:05 a.m., in Room 334, 

Cannon House Office Building, Hon. Steve Buyer [Chairman of the 

Committee] presiding.

 Present: Representatives Buyer, Bilirakis, Stearns, Moran, Brown 

of South Carolina, Miller, Boozman, Brown-Waite, Campbell, Filner, 

Gutierrez, Brown of Florida, Michaud, Herseth, Strickland, Hooley, 

Reyes, Berkley, Udall, and Salazar.

  The Chairman. The House Committee on Veterans’ Affairs dated 

May 25, 2006, will come to order. If somebody will get the door for 

us, please.

 By way of housekeeping, we only have the Secretary for about 45 

minutes, and then there’s a hearing on the Senate side that starts at 

10:00 o’clock. He will be taking Mr. McLean with him. Others of his 

staff will remain, and step forward at the table when the Secretary 

leaves.

 I will give an opening, and then I’m going to yield to Mr. Strickland 

for an opening, and then we are going to immediately go to questions. 

What I would propose is, because we only have him for 45 minutes, 

is that I do a unanimous consent that each member may have three 

minutes to do questions, so we try to give quick latitude to all the 

members. Any objections?

[No response.]

 All right. And hearing no objections, so ordered.

 The purpose of this hearing is to learn more about the recent loss 

of personal data belonging to as many as 26.5 million veterans and 

some spouses experienced by the Department of Veterans Affairs. 

We have a meltdown in VA’s information Management. According to 
2

VA, this meltdown has resulted in a catastrophic failure to safeguard 

sensitive personal data. Last Monday, the Department of Veterans’ 

Affairs released a statement acknowledging that a data analyst took 

home electronic data which he was authorized to access at work, but 

not authorized to bring home. The burglary of his home and the theft 

of his computer resulted in the loss of that data. This serious incident was not communicated to this Committee until Monday, May 

22nd, 19 days after the theft, and one hour prior to its release to the 

public.

 We must answer some pressing questions, which include: how did 

this breach of information Management happen, what will we do to 

protect veterans from identity theft, what policies and regulations 

are in place in the department that should have stopped the mismanagement of information, and what is the VA doing to eliminate the 

vulnerabilities associated with the security of sensitive information? 

And there are many others from my colleagues.

 And let me be clear. We are here today to inform America’s veterans and their families what the government is doing to protect them 

against fraud and ease their efforts to protect themselves. Our veterans and their families must be assured of how you, Mr. Secretary, 

will safeguard the information they place in your hands. Whether or 

not any identity fraud results from the theft of this computer carried 

home by this VA employee, what is clear is that damage has been 

done.

 Speaking as one of those millions of veterans such as even yourself, 

Mr. Secretary, the prospect of fraud, theft, of the awful prospect of 

repairing damaged credit, is bad enough. For that stress to be caused 

by our own Federal Government is deeply disturbing, and I know 

everyone here agrees it is intolerable. There will unfortunately be a 

certain percentage of the 26.5 million veterans that will have to deal 

with identity theft in the normal cause of life. And now some of them 

will blame the VA. So that’s going to be a challenge for you.

 Beyond the very personal dimension: this incident has implications 

regarding the larger picture of control over VA information technology. Over the last seven years we’ve seen compelling evidence of information security problems at the VA, and I refer to the Committee 

hearings which I’ve chaired. On May 11th of 2000, the GAO stated 

that computer security, quote: “..is critical to VA’s ability to safeguard 

its assets, maintain the confidentiality of sensitive information, and 

ensure the reliability of its financial data. The VA IG acknowledged 

the department-wide weaknesses in information security systems 

that continue to make VA’s program and financial data vulnerable to 

error and fraud,” end quote.

 At a September 21, 2000 hearing, GAO stated, quote, “Serious computer security problems persisted throughout the department and 

VHA, because VA had not yet fully implemented an integrated se-
3

curity management program, and VHA had not effectively managed 

computer security at its medical facilities,” end quote.

 At the April 4, 2001 hearing, the IG continued to, I quote, “identify 

significant information security vulnerabilities that place the department’s data systems at risk of unauthorized access and disclosure.” 

The IG testified that, quote, “many of these vulnerabilities exist in 

violation of VA policy,” end quote.

At a March 13, 2002 hearing, the IG repeated findings of the vulnerabilities of VA’s information technology.

 Then almost four years ago today, on May 20th and May 21st, a 

WISHTV 8 I-Team led by Karen Hensel in Indianapolis, Indiana, 

went to Goodwill and bought three computer hard drives. Two of 

those hard drives she learned were never cleansed, and they contained 

hospital patient records from the Roudebush VA Hospital in Indianapolis. The names of veterans, their Social Security numbers, home 

address, phone numbers, pages and pages of government credit card 

numbers, information regarding veterans’ arrest records, whether 

they were receiving drug and alcohol counseling, whether they were 

disabled. There was one of the veterans was blind, disabled, and living alone and was a combat veteran. It discussed his case. One of the 

patients was HIV. A hundred twenty of those computers were sold at 

a surplus sale without ever having been cleansed.

 So we went through all the hearings on that. “Oh, the controls are 

going to be in place, we assure the Committee.”

 At the September 26, 2002 hearing, the IG testimony stated that, 

quote, “Penetration testing completed during the past two years verified that the VA’s information system could be exploited to gain access to sensitive veteran health and benefit information.”

At a March 17, 2004 hearing, the VA testified that, quote, “there 

was a glide path in place for the meeting, the 2004, April 2004 deadline for the beginning of the VETSNET deployment. VETSNET has 

been in development for a decade. I’ve been told that VETSNET will 

not deploy in 2006 and maybe not even now till 2007.”

 As Chairman of the Subcommittee on oversight and investigations, 

and now the Chairman of this Committee, I have led a bipartisan 

effort to centralize VA’s IT infrastructure and control over its IT systems. Last November, this House voted unanimously, 408 to zero, to 

centralize IT management with the department’s chief information 

officer. Both the department and the Senate have sadly resisted such 

centralization of VA’s IT architecture. Even the Independent Budget 

of the VSOs opposed centralization of VA’s IT infrastructure in their 

2007 budget.

 The VA Inspector General in his November 2005 report entitled, 

“major management challenges of fiscal year 2005,” stated that, 

quote, “VA has not been able to effectively address some significant 

information security vulnerabilities and reverse the impact of its his-
4

torically decentralized management approach.”

 The report went on to say that, quote, “While the VA has accelerated efforts to improve Federal information security, more needs 

have to be done to put security improvements in place that effectively 

eliminate the risk and vulnerabilities of unauthorized access and 

misuse of sensitive information,” end quote.

 Look where we are here today, Mr. Secretary. This Committee, 

this Congress, we have asked to empower the CIO to put his arms 

around this one, and that was resisted. We also—I have even asked 

about letting the VA be on parity with other departments with regard 

to political appointments. That has been resisted. And now what we 

have is, we have some management questions. This isn’t just an issue of a low-level employee. There is very serious mismanagement of 

information technology that is at stake.

 So with that context, I believe there is a damaged trust, angered 

veterans and families, and there are systematic flaws. And Mr. Secretary, this is a defining moment of your leadership.

 With that I yields now to Mr. Strickland.

[The statement of Chairman Buyer appears on p. 66]

Mr. Strickland. Mr. Chairman, I would yield to my colleague from 

California, Mr. Filner, and I would ask that my statement be entered 

into the record, please.

  The Chairman. Thank you, Mr. Strickland. All the members may 

have opening statements, and your statements will be submitted for 

the record.

[The statement of Mr. Strickland appears on p. 68]

  The Chairman. Mr. Filner, you are now recognized.

Mr. Filner. Thank you, Mr. Chairman, and thank you for this 

hearing. Thank you for your opening remarks. I associate myself 

completely with them. You laid out a complete record, I think that 

we don’t have to repeat, so I appreciate your strong attitude toward 

this issue.

 We are now presented, as the Chairman said, with a catastrophic 

problem. The VA simply did not protect essential personal information entrusted to its care. Now, and for the next few decades maybe, 

a potential sort of Damocles hangs over the financial well-being of 

over 26 million veterans, unless this data is recovered.

In the last five years, as the Chairman outlined, a host of agencies, 

the VA Inspector General, the GAO, prominent IT consultants have 

reported that VA has many problems with information security. We 

found multiple failures under the Federal Information Security Management Act, and the performance reviews required by that Act. We 

note that three or four information security recommendations to the 

VA by the Government Accountability Office in March 2002 have yet 
5

to be implemented. Outside contractors have noted related problems. 

And how does VA react? With indifference.

 Internal VA recommendations to strengthen the control of information meet with resistance. Even Secretary Principi’s directive to 

centralize information technology at the VA in 2002 was met with 

indifference. It was not implemented.

 In the last few years, this Committee and its Subcommittees have 

chronicled problems related to unclear lines of IT management authority throughout the VA, from information security Officer training 

in the VBA to sensitive information releases on unscrubbed computer 

hard drives at VA medical centers, a host of very expensive major 

computer project failures and delays.

 We rarely see accountability, neither in the IT or the information 

security world at the Veterans Administration. The individual responsible for the release of the unscrubbed hard drives was soon promoted. Again, VA seems to react with indifference to its problems in 

this area.

 As Chairman Buyer pointed out, the problem before us today is not 

unexpected. It has sprung from a culture of indifference, at the Veterans Administration, and has grown strong among the leaders who 

have allowed it to grow. The most important agent in information 

control and security in an organization is its leadership. When they 

are not proactive, Mr. Secretary, bad things happen. And a very bad 

thing has happened that we are looking at today.

Too much time transpired before Congress was notified. Sure, you 

needed to hope that the thing was found, but you could have briefed 

the Chairman and others in this body about that, what happened. 

Too much time transpired before veterans were notified. And when 

you did notify them, you left it to them to go contact their credit bureau, or their banks. You didn’t say, “We will take care of it, we will 

be behind you, we will pay for the problems that you might have.” 

VA’s message was, “Trust us, we will handle it.” Well, we should now 

question if even after this wake-up call, you are up to the task.

Certainly this administration has proclaimed its need to collect information on our citizens. On May 11th, President Bush defended 

those actions by noting that the privacy of ordinary Americans is 

fiercely protected in all of our activities. Well, I think this data debacle before us today clearly demonstrates the folly of the President’s 

attempt to place us at ease regarding the Administration’s ability to 

fiercely protect our privacy. This does not meet my definition of fierce 

protection. I only see indifference.

 Mr. Chairman, I appreciate again this opportunity to look into this 

incredible disaster.

  The Chairman. Thank you, Mr. Filner. And I associate myself with 

Mr. Filner’s comments.

 Testifying now will be Secretary Nicholson. Secretary Nicholson 
6

is accompanied by the Honorable Alan Pittman, the Assistant Secretary of Human Resources and Administration; the Honorable Robert 

J. Henke, Assistant Secretary for Management; Retired Army Major 

General Bob Howard, the Acting Assistant Secretary for Information 

Technology; Pedro Cadinez, Jr., Associate Deputy Assistant Secretary 

for Cyber and Information Security, and the Acting Deputy Assistant 

Secretary for Information Technology; Dennis M. Duffy, Acting Assistant Secretary for Policy, Planning, and Preparedness; Michael 

Mclendon, Deputy Assistant Secretary for Policy; and the Honorable 

Tim Mclean, the Department’s General Counsel.

All the individuals who I have just identified, if you would please 

stand, I’m going to swear all of you in. Would you please raise your 

right hand.

[Witnesses sworn.]

 Mr. Secretary, you are now recognized.

TESTIMONY OF HON. R. JAMES NICHOLSON, SECRETARY, 

U.S. DEPARTMENT OF VETERANS AFFAIRS; ACCOMPANIED BY HON. R. ALLEN PITTMAN, ASSISTANT SECRETARY FOR HUMAN RESOURCES AND ADMINISTRATION; HON. ROBERT J. HENKE, ASSISTANT SECRETARY 

FOR MANAGEMENT; MAJOR GENERAL (RET.) ROBERT 

HOWARD, ACTING ASSISTANT SECRETARY FOR INFORMATION AND TECHNOLOGY; PEDRO CADENAS, JR., ASSOCIATE DEPUTY ASSISTANT SECRETARY FOR CYBER 

AND INFORMATION SECURITY AND ACTING DEPUTY 

ASSISTANT SECRETARY FOR INFORMATION TECHNOLOGY; DENNIS M. DUFFY, ACTING ASSISTANT SECRETARY FOR POLICY, PLANNING AND PREPAREDNESS; 

MICHAEL MCLENDON, DEPUTY ASSISTANT SECRETARY 

FOR POLICY; HON. TIM S. MCCLAIN, GENERAL COUNSEL; AND HON. GEORGE J. OPFER, INSPECTOR GENERAL, U.S. DEPARTMENT OF VETERANS AFFAIRS

  Secretary Nicholson. Mr. Chairman and members of the Committee, thank you for giving me the opportunity to appear before you 

today, to explain a devastating occurrence that has happened in my 

agency. It has come to my attention recently. It was announced to 

all on Monday of this week.

 I am the person ultimately responsible to our veterans, and therefore, the responsibility for this situation rests on me. A VA employee 

who was a data analyst took home electronic data files from the VA. 

He was not authorized to do so, nor were they encrypted. His house 

was burglarized and the data were stolen. This happened on May 

3rd. If that wasn’t bad enough, I wasn’t notified about this event 
7

until May 16th. As a veteran myself, I have to tell you that I am outraged. I am frankly mad as hell. But I must carry on, and lead the 

efforts to get to the bottom of this, and take corrective actions to see 

that it doesn’t happen again.

 My compass for this is the veterans. How do we best take care of 

them now, and mitigate the effects of this on them? These stolen data 

contained identifying information including names and dates of birth 

for up to 26.5 million veterans, and some of their spouses. In addition, that information, plus Social Security numbers, was available 

for some 19.6 million of those veterans. Also included possibly were 

some numerical disability ratings and the diagnostic codes which 

identified the disabilities being compensated.

 It is important to note that the data did not include any of the VA’s 

electronic health records. Neither did it contain explicit financial information, although knowing of a disability rating could enable one to 

compute what the implied terms of compensation payments are.

 On May 3rd, the employee’s home was broken into in what appears 

to local law enforcement to have been a routine breaking and entering; that is, a random burglary, not a targeted one. And the VA data 

were stolen. The employee has been placed on administrative leave 

pending the outcome of an investigation with which he is cooperating.

 As I have said, I am a veteran too, and I am outraged at the loss of 

our veterans’ personal data. And I am outraged at the fact that an 

employee would put us all at risk by taking it home in violation of VA

policies with which he was very familiar. I am also very outraged that 

it was not until May 16th that I was notified of this incident. And I 

am upset about the timing of the department’s overall response once 

the burglary became known. I will not and have not tolerated inaction and poor judgment when it comes to protecting our veterans.

 Appropriate law enforcement agencies, including local police, the 

FBI, and the VA Inspector General’s office, have launched full-scale 

investigations into this matter. Authorities believe it is unlikely the 

perpetrators targeted the items stolen because of any knowledge of 

the data contents. It is possible that the thieves remain unaware of 

the information they possess, or how to make use of it. Because of 

that, we have attempted to describe the equipment stolen, the location from which it was stolen, and other information, in quite general 

terms. We have not and do not want to provide information to the 

thieves that might be more helpful as to the nature of what they 

have. We still hope that this was a common theft, and that no use 

will be made of the VA data.

 From the moment I was informed, the VA began taking all possible 

steps to protect and inform our veterans. However, there were those 

in the law-enforcement community who wanted me to wait longer 

before announcing this theft, so as to pursue leads and keep the bur-
8

glars in the dark. I chose to inform our veterans nevertheless, but 

limiting the details of where and when initially, so as not to tip our 

hand to the robbers. Whether it is one veteran or the numbers we 

are talking about here today, the VA needed to act in a manner that 

maintained a balance between protecting our veterans, and informing the crooks.

 Another very disturbing aspect of this circumstance is that although 

it happened on May 3rd, and the VA employee informed his bosses of 

this fact on that day, I was not made aware, as I said, until May 16th. 

Equally disturbing is that Federal law enforcement and investigating 

agencies were not informed immediately, either. It wasn’t until May 

10th that the VA IG became aware of it. I cannot explain these lapses 

in judgment on the part of my people. It makes me really angry and 

disappointed, and after the IG finishes his investigation as to exactly 

what went on, I plan to take decisive actions.

 The VA now also has begun a relentless examination of our policies 

and procedures to find out how we can prevent something like this 

from happening again. We will stay focused on the problems until 

they are fixed. I have formed a special task force under the deputy 

secretary to examine comprehensively all of our information security 

programs and policies, to bring about a ringing change in the way 

we do business. Ever since 1999, the VA has gotten low marks from 

the IG on its information and a cyber security programs. Last year, 

the GAO flunked the VA on its cyber security system. This has to 

change.

 This situation is exacerbated by the fact that the Assistant Secretary for IT, who had been at the VA that’s the beginning of 2004, has 

just recently resigned. He came to the VA from the private sector, 

Dell Computers, and has now returned to the private sector. We do 

have—and think we have recruited a good replacement, but he is not 

in place at this time.

 Ironically, we, the VA, continue to get very exemplary evaluations 

on electronic medical records systems. And during Hurricane Katrina, the system and our people performed heroically to evacuate 

hundreds of patients and save many lives. We are also off to a strong 

start on our IT reformation to centralize all of our IT applications, 

except for development.

 What this suggests is that we can get this information and cyber security mission done right, also. I am also pleased that just yesterday 

the President announced his intention to nominate a brilliant recently retired Navy Admiral to head up our office of policy and planning, 

where this incident arose from. He should be on board very soon.

 Additionally, we are taking direct and immediate action to address 

and alleviate veterans concerns and to regain their confidence. I have 

taken the following actions so far:

 Directed that all VA employees complete the VA cyber security 
9

awareness training course, and complete the separate general employee privacy awareness course by June 30, 2006.

 I have also directed a memo be issued requiring all VA employees 

to sign annually an employee a statement of awareness that includes 

there are awareness of privacy act, unauthorized disclosing or using, 

directly or indirectly, information obtained as a result of employment 

in the VA, which is of a confidential nature, or which represents a 

matter of trust, or other information so obtained, of such a character 

that its disclosure would—or its use would be contrary to the best 

interest of the VA, or the veterans being served.

 And certify their awareness on the loss of, damage to, or unauthorized use of government property, through carelessness, or negligence, 

or through maliciousness, or intent.

 In addition, the department will immediately be conducting an inventory and review of all current positions requiring access to sensitive VA data. The inventory will determine whether positions in 

fact require access to data. We will then be requiring all employees 

requiring access to sensitive VA data to undergo an updated national 

agency check and inquiries, and/or a minimum background investigation, depending on the level of access required by the responsibilities 

associated with their position. Because it has come to my attention 

also that we know virtually nothing about these people that have access to these enormous amounts of data. For example, this individual 

having the entire veterans’ file, one person who has not to our knowledge had a background check for 32 years.

I have directed the office of information and technology to publish 

by June 30 of this year, as a VA directive, the revisions to the security guidelines for single user remote access developed by the Office 

of Cyber Information Security. This document will set the standards 

for access, use, and information security, including physical security, 

incident reporting, and responsibilities.

VA is working with Congress, the news media, and veterans service organizations and other government agencies, to help ensure 

that those veterans and their families are aware of the situation, and 

of the steps they may take to protect themselves from misuse of their 

personal information. VA is coordinating with other agencies to send 

individual notifications to all 19.6 million individuals whose Social 

Security numbers were stolen, instructing them to be both vigilant in 

order to detect any signs of possible identity theft, and how to protect 

themselves.

In the meantime, veterans can also go to www.firstgov.gov for more 

information on this matter. This is a Federal Government web site 

capable of handling large amounts of Web traffic. Additionally, the 

VA has set up a manned call center that veterans may use to get information about this situation, and learn more about consumer identity protection. That toll-free number is 1-800-333-4636. The call 
10

center operates from 8:00 a.m. to 9:00 p.m. Monday to Saturday, and 

it will as long as it is needed. The call center handles up to 20,000 

calls an hour. Through the end of the day on yesterday, concerned 

veterans had made a total of 105,753 calls to this number.

I want to acknowledge the significant efforts of numerous government agencies in assisting the VA in preparing for this announcement of May 22nd. Agencies at all levels of the Federal Government 

pitched in to ensure that our veterans had information on actions 

they could take to protect their credit. Hundreds of people worked 

around-the-clock last weekend, writing materials to inform the veterans, and setting up call centers and a Web site to ensure maximum 

dissemination of the information. And I want to personally thank 

each of these agencies and the people therein for their selfless efforts 

on behalf of our veterans.

 Three nationwide credit bureaus have established special procedures to handle inquiries and requests for fraud alerts from our veterans. Experian and Trans-Union have placed a front-end message 

on their existing toll-free fraud lines, bypassing the usual phone tree 

of instructions for placing a fraud alert. Equifax has set up a new 

toll-free number for veterans to place fraud alerts.

 The new procedures became operational on Tuesday. The bureaus 

report a spike in phone calls 171 percent of normal, and in requests 

for free credit reports, through the annual free credit report web site. 

The Federal Trade Commission also experienced high call volumes 

about the incident earlier this week. On Monday, the Office of Comptroller of the Currency notified its examiners of the theft. On Tuesday, 

the Office of Comptroller posted an advisory on an internal network 

available to its banks, and instructed examiners to direct their banks 

to the advisory. It explains what happened, and asked the banks to 

exercise extra diligence in processing veterans’ payments. The advisory also reminds the banks of their legal obligations to verify the 

identities of persons seeking to open new accounts, to safeguard customer information against unauthorized access or use, and attaches 

a summary of relevant laws and regulations.

 I briefed the Attorney General and the Chairman of the Federal 

Trade Commission, the co-chairs of the President’s Identity Task 

Force shortly after I became aware of this occurrence, and they have 

been very cooperative as well.

 Task force members have already taken actions to protect the affected veterans, including working with the credit bureaus to help 

ensure that veterans receive the free credit report that they are entitled to under the law.

 Additionally, the task force met on Monday to coordinate the comprehensive Federal response, and to recommend further ways to protect affected veterans, and increased safeguards to prevent the recurrence of these incidents. On Monday, following the announcement 
11

of this incident, I also issued a memorandum to all VA employees. 

The purpose was to remind them of the public trust we hold, and to 

set forth the requirement that all employees complete their annual 

general privacy training and VA cyber security awareness training 

for the current year, by June 30. Following that, all will be required 

to sign a statement of commitment and understanding, which will 

acknowledge consequences for noncompliance.

 Information security is challenging business. And ultimately, it 

depends on the integrity and the work ethics of the workforce.

The Chairman. Mr. Secretary, if you could summarize your conclusion, please.

Secretary Nicholson. I wanted to just, for purposes of one graphic, 

and this was not the equipment that was involved in this so I can 

use—but this is a hard drive. This little piece of equipment that is 

smaller than my wallet has 60 gigabytes. The information that we 

are dealing with here, this entire roll of our veterans and the data 

on it is five gigabytes. So you could put 12 times that on that piece 

of equipment that fits easily into one’s pocket. All of us carry a cell 

phone, a Blackberry, or a personal digital assistant, and they contain 

vast amounts of data.

 I promise you that we will do everything in our power to structure 

a policy and a regulatory regime that make clear what is proper use 

of this data by our employees. We will train employees in these policies, and enforce them. We have already begun discussions regarding 

immediate automatic encryption of all sensitive information. We will 

work with the President’s task force very closely. VA’s mission to 

serve and honor our nation’s veterans is one we take seriously. The 

235,000 dedicated VA employees are deeply saddened by any concern 

or anxiety this incident is causing to our veterans and their families. 

We honor the service of our veterans and what they have done for our 

country, and we are working hard to keep this most unfortunate circumstance from causing them undue pain and anxiety. Thank you.

[The statement of Secretary Nicholson appears on p. 96]

  The Chairman. Thank you, Mr. Secretary.

 To my colleagues, sitting to the Secretary’s right is Mr. George Opfer. He is the VA’s IG, and it was on purpose that he was not sworn 

in.

 I will also you ask unanimous consent that Thelma Drake and Jim 

Walsh be permitted to sit at the dais of the Veterans’ Affairs Committee.

[No response.]

 Hearing no objections, so ordered.

 I want to thank Chairman Walsh for being present today. He 

also wanted to hold his own hearing on this, and given the time con-
12

straints was not able to, and it’s impressive that he is taking equal 

concern on this.

 What we have here, Mr. Secretary, is this Committee working cooperatively with Mr. Walsh and Mr. Chet Edwards on IT. And before 

you took this job, we had been working hard on IT. And when we 

couldn’t get the VA to listen, we worked cooperatively with not only 

setting forth our budget, taking out $400 million to get somebody’s 

attention, but the appropriators also followed suit.

 I am going to yield so other members can ask questions. The only 

thing I would like for you to take away from this, Mr. Secretary, is 

that we intend to have follow-on hearings. I would ask this of you: 

would you consider offering a reward, say, a million-dollar reward for 

information that would lead to the arrest or recovery of this device? 

I want you to think about that. I want you to work with the Department of Justice on whether or not that could be helpful to us. That 

million dollars is nothing compared to what we are about to expend. 

You have already sent us a reprogramming notice for $25 million. So 

I don’t know where this could end. But I want you to consider that.

Secretary Nicholson. We will.

The Chairman. At this point, let me yield to Mr. Bilirakis for two 

minutes.

Mr. Bilirakis. Thanks, Mr. Chairman. Mr. Secretary, welcome, I

guess. Mr. Secretary, in Vietnam you were a true, most courageous 

hero, a true hero. You received many awards. I doubt that the difficulties you found there are as bad as they are with the VA.

 Foundationally this is a problem in the VA. And it is foundational. 

Others will ask questions regarding this particular instance, and I

am as concerned about it as anybody else is. Mr. Chairman, I would 

like to ask unanimous consent that a two-page document, a written 

statement by a Dr. Leon A. Kappelman be made a part of the record.

The Chairman. Hearing no objection, so ordered.

[The information appears on p. 125]

Mr. Bilirakis. And I would like to quote from that, Mr. Secretary, 

very quickly here: “VA has tens of thousands of dedicated, hard-working employees committed to the important mission of serving our nation’s veterans and their families. But there is a dark side to the VA. 

Its bureaucratic culture is unprincipled, profligate, and intransigent. 

I have seen them ignore Congress, GAO, OMB, and one executive appointee after another. Oh, they know how to play the game to get the 

executive in Congress to open the budget floodgates, but VA doesn’t 

really care how the dollars are actually spent, as long as it doesn’t 

interfere with business as usual at the VA. I have personally seen VA

personnel sabotage and subvert hundreds of millions of dollars’ worth 

of IT projects, and read about billions more wasted on other failures. 

I have seen a total disregard for one cyber security effort after an-
13

other. These are only the tip of the iceberg. And why do such things 

happen at the VA? Largely, because these systems and efforts would 

make the utilization of budget and personnel more transparent and 

thereby make accountability possible.”

 Mr. Secretary, without going into the merits of these statements 

and that sort of thing, the gentleman is not here for us to cross-examine or whatever. But I think we all agree that there is a problem, 

a basic bureaucratic type of a problem—at least I hope we all agree. 

And I ask you, if that is the case, and let’s go on the premise that that 

is the case, can’t you do something about it? What is preventing you 

from—I guess this task force reviewing the entire VA and basically 

saying, “Hey, we are going to chop here, we are going to change here, 

we are going to do this, we are going to do that.” Is it civil service? 

Does anything prevent you from doing these things? Are we sort of 

stuck with this kind of an image, on the premise now again that this 

is basically true? And I frankly think that it is, based on my experience of over 24 years on this Committee.

Secretary Nicholson. I would say absolutely—

Mr. Bilirakis. Your mike, I guess, sir.

Secretary Nicholson. No. I mean, I am aware of the history of 

these problems that the Chairman and the Ranking Member have 

recited. There are others. I am trying to ascertain exactly how many 

people telecommute. Yesterday, I was talking to an employee on this 

subject, who was a data expert, who asked somebody to burn some 

records, some health records for him onto a CD that he needed for a 

project. It was done, they were mailed to him very timely, tidy. Wrote 

an e-mail back to them and he said “That was great. It was prompt. 

I ready appreciate it. Where do you work here? At the VA Central 

office? Maybe I’ll run into you and we can have a cup of coffee.”

 And the guy says, “I don’t work here. I work in South Dakota.” And 

so we have people telecommuting all over this country, and we need 

to get our arms around who these people are, and what they are like? 

And they have enormous amounts of data with enormous amounts of 

potential. Not necessarily because they may be up to mischief, but 

they may be like the current case where they are negligent. And this 

is an enormous, troubling situation. But I will say to you that you 

cannot default to it. We have to fix it. And we can.

Mr. Bilirakis. Do you have the authority? Do you have the power 

to fix it?

Secretary Nicholson. Well, if we don’t have it, we will come and 

seek it. But you raise a good point, Mr. Chairman, because there are 

things that are called guidelines, which some employees think do not 

apply because they say “guidelines,” and they don’t say “directives.” 

And that has a history to it as well, about how expeditious you can get 

out a guideline versus the time it takes to do a directive.

 I will say that the thing needs to be reviewed from tip to stern. We 
14

have queued up I think a very strong leader to come in and replace 

the person that has left, as the chief information officer who I told you 

about, who I think did a very good job in forcing us into the transformation that we are now in on centralizing, you know, a portion of IT

for business purposes and so forth. But in the information security 

area, there is a lot needed, and—but it can be done. These things can 

be fixed.

[The statement of Mr. Bilirakis appears on p. 70]

The Chairman. I thank the gentleman. I am going to hit this and 

go right to Mr. Filner. What assurance can you, Mr. Secretary, give 

veterans that if indeed these records end up in the hands of identity thieves, that veterans will not suffer financially or otherwise for 

these illegal attacks on their credit?

Secretary Nicholson. Well, I think before I could give you that 

assurance, I’m going to have to work with, the Congress to—and see 

if it could be funded. If they suffer a loss from this. We are working 

at a fever pitch with several proprietary companies that are in this 

business of trying to help monitor consumers, people’s credit records 

for them, and we are meeting with them, reviewing their proposals. 

With the enormous amount of people involved, there’s going to be 

a substantial cost to that. But that would give—that would give a 

lot of peace of mind to our veterans, if they suffer a loss, the system 

of—then compensating that, which I think is something that is owed 

to a veteran, we’ll have to figure out.

The Chairman. Mr. Filner, you are recognized for two minutes.

Mr. Filner. Thank you, Mr. Chairman. Who is the highest level 

official who didn’t tell you for 13 days about this?

Secretary Nicholson. That knew it during that time before, the 

deputy chief of—the deputy secretary.

 Mr. Filner. Is he going to be fired?

Secretary Nicholson. I’m reviewing all of these issues, Mr. Filner, 

with a view towards what actions that I’m gonna take, and I’m going 

to take—but the IG is continuing to do some work on this, and I want 

to—

Mr. Filner. You know, your responses are incredibly bureaucratic. 

I don’t see, as I have told you, I do not see any passion. I don’t see 

you saying, “I take responsibility.” Well, the most dramatic thing 

you could do to take responsibility is resign. In last years budget, 

you didn’t know there was a war going on, so you couldn’t take care 

of the veterans. Now, your own people do not tell you about the theft 

of the data of 26 million veterans, and you go through all this bureaucratic rigamarole. You issue something to veterans, “Frequently 

Asked Questions,” and you tell them, “if you have any problem, call 

your credit bureau, call your bank.”

 Where is your responsibility in all this? You tell your veterans, “Go 
15

call a number”—which you gave the wrong number, by the way, in 

your testimony. At least it is different than your press release.

So you are not taking any responsibility. Not only financially but 

for this management debacle. And you have said time and again as 

from your press release, there is no medical data here. Is that what 

you have said?

Secretary Nicholson. Yes, I said none of the medical records—

Mr. Filner. But you are being very bureaucratic. Isn’t there a diagnostic code on here that indicates a specific injury, disability, or 

medical condition, that is part of the record here?

Secretary Nicholson. For disability recipients, yes.

Mr. Filner. Well, why not state that clearly and bluntly? Every 

specific code relates to a specific health condition, and the disability 

codes are linked to specific individuals by their name and date of 

birth, and they reveal each disabled veteran’s medical problems and 

conditions; correct?

Secretary Nicholson. Yes, I—I think it is—that would be correct, 

yes.

Mr. Filner. So we have medical knowledge floating around here on 

26 million people. You should resign, Mr. Secretary.

Secretary Nicholson. No, sir. It’s—I mean that it happens to be 

those that are getting disability, which is not a small number—

Mr. Filner. How many is that?

Secretary Nicholson. It’s about 2.6 million.

Mr. Filner. Oh, I’m sorry. So only 3 million people suffer from 

that.

The Chairman. Thank you, Mr. Filner.

Mr. Filner. Okay, you should resign one eighth of the time.

The Chairman. Thank you, Mr. Filner.

 Mr. Stearns, you are recognized for two minutes.

Mr. Stearns. Thank you, Mr. Chairman. I would say to Mr. Filner 

that Mr. Nicholson has indicated he takes full responsibility. I mean, 

he said that personally and I understand with his record how upset 

he is.

But Mr. Secretary, have you fired the employee who lost this information, and why not?

Secretary Nicholson. He has been put on administrative leave 

pending further action. There are other people, to go back to Mr. 

Filner’s comment, who are also in my sights as a result of this.

Mr. Stearns. Do you have internal controls? For example, why 

wasn’t this information encrypted? In commercial corporations, they 

encrypt all this information as a standard operating procedure. How 

in the world could a person take this outside and not be encrypted?

Secretary Nicholson. He was—one, he wasn’t authorized take it 

home at all. That we have a standing regulation, standing policy, 

that anyone who he is authorized to take sensitive information out-
16

side of their workstation has to have it encrypted.

Mr. Stearns. Okay, do you have in place an internal security operation, with a security chief, with internal audits, and occasionally 

an outside audit, to confirm that this information is secure, in the 

Veterans Administration? Just yes or no.

Secretary Nicholson. Yes.

Mr. Stearns. What is this going to cost the Veterans Administration? Your first diagnosis of this, what do you think this is going to 

cost and you’re going to need from this Committee?

Secretary Nicholson. That’s a tough call, because it’s going to depend on what, you know, what level we decide you—

Mr. Stearns. You’re talking about 20 million, 5 million, 2 billion?

Secretary Nicholson. No, we’re talking—

Mr. Stearns. I mean, you must have a figure.

Secretary Nicholson. We’re talking—I would say we’re talking 

way north of 100 million.

Mr. Stearns. So you might be talking about half 500 million?

Secretary Nicholson. It could be.

Mr. Stearns. Okay. Thank you, Mr. Chairman.

[The statement of Mr. Stearns appears on p. 76]

Secretary Nicholson. Yes, sir.

The Chairman. Thank you. Mr. Gutierrez?

Mr. Gutierrez. Yes, I yield to Corinne Brown.

Secretary Nicholson. Mr. Chairman, I’m sorry but I’m going have 

to—I’m committed to go to the Senate—

The Chairman. Well, I know. We are going to do Mr. Gutierrez, 

Miller, and then you are gone. So you have four minutes.

Mr. Gutierrez. Thank you very much. I yield to Corinne Brown.

[The statement of Mr. Gutierrez appears on p. 74]

Ms. Brown of Florida. Thank you very much. Mr. Secretary, can 

you see me in my nice pretty red suit? This Monday all of us will be 

facing our veterans in the Memorial celebration. And I do not know 

what we are supposed to say. They are going to paint us with the 

same brush. What assurances will we be able to give about the 26 

million veterans’ records, how have we notified them? How have we 

assured the veterans that we are going to work with them throughout 

the process? And I also want to know, you know, some of our veterans say this could have been an inside job. Have we done lie detector 

tests with everybody involved?

Secretary Nicholson. Well, as I said, Congresswoman, I hate this 

I’m sure more than you do. And I’ll take responsibility for it. It happened to my organization, and I think what we are doing is everything 

we can in the time that we’ve had so far to try to get the word out to 

the vets. We’re gonna send them each a letter, but we can’t send 26 
17

million letters instantaneously. We’ve found out we can’t right now 

even get 26 million envelopes, but we’re underway in getting them. 

And they will each get a letter. You can help inform us with the 1-800 

number, and the Website, the media. Because we want each of them 

to know what to do, and to know that right now there is no reason to 

panic. There’s nothing, there’s no sign that any of this is being used 

at this time.

Ms. Brown of Florida. Mr. Secretary, I asked a question. What assurances do we have? Because this identity theft is a very profitable 

thing. How do you know it wasn’t an inside job?

Secretary Nicholson. Because the local law enforcement authorities that investigated the scene of the crime—that’s the first question 

I asked, by the way—are convinced that it—that it was a real breakin.

[The statement of Corrine Brown of Florida appears on p. 78]

The Chairman. Ms. Brown, I thank you.

Ms. Brown of Florida. Well, are we going to be able to give these 

questions in writing to the Secretary.

The Chairman. Yes. If anybody has questions in writing, please, 

you can submit them and we will get them to the Secretary.

 The last questioner, Mr. Miller, is recognized for two minutes and 

then the Secretary has to leave. Thank you, Ms. Brown.

Mr. Miller. Thank you very much, Mr. Chairman. I did hear the 

Secretary in his opening remarks refer to the fact that there were 

codes that was in this information, so I do think he brought it to this 

Committee’s attention, contrary to my colleague’s question.

 Two things: number one, why would an employee take this information home?

Secretary Nicholson. Congressman Miller, he took it home to work 

with it. He was working on a project where he was trying to streamline a telephonic polling that we do of veterans periodically, and it’s 

done randomly, that they’re called and asked a series of questions, 

which is, you know, benign. We’re trying to find out what’s going 

on in their life, how we’re doing with them, how they’re doing, and 

so forth, and he thought he had a way that he could make this more 

efficient in the selection of the veterans that we were calling, and he 

took this data home to work it.

Mr. Miller. And my second question and as of course, we are all 

concerned about the financial implications to the veterans, but I also 

want to know, you know, the financial institutions, banks, credit 

unions, retailers, anybody that may get caught up in this; who is going to be responsible for the cost that may be incurred for private 

entities out there?

Secretary Nicholson. Well, you know, I suppose the ultimate answer to that question is going to be up to you all that make the laws. 
18

I mean, we’re—it happened because of—it happened because of us.

Mr. Miller. Well, let me ask it this way: what would your recommendation be?

Secretary Nicholson. Well, my recommendation would be that 

we’d be responsible for it. We caused it.

Mr. Miller. Thank you. That is what I wanted to hear.

[The statement of Mr. Miller appears on p. 83]

The Chairman. All right. Mr. Secretary, thank you very much. You 

and Mr. McClain are excused. Thank you.

 I would now like the other witnesses to please come to the table to 

replace the Secretary and the General Counsel. If staff could help 

them. What we may have to do is bring your chairs to the front.

To all of my colleagues, while all this administrative shuffle is occurring, the team that the Secretary is leaving behind is the team that 

is responsible for cyber security and in charge of plans and policy.

 There is a hearing on the Senate side that starts at 10:00 a.m., 

and that is the purpose of the Secretary’s and General Counsel’s exit. 

But what I wanted to insure for all of my colleagues is that as the 

secretary leaves, these are the individuals who are in the responsible 

positions.

 Ms. Berkley?

Ms. Berkley. Thank you, Mr. Chairman. With all due respect, and 

I am sure these are the men and women that do the nuts and bolts on 

this issue, but I was hoping to talk to the Secretary, and have an opportunity to question him. Will he be available to us? It seems that 

something this important, one hour in front of this Committee simply 

is not enough. Oh, I’m sorry, 45 minutes.

The Chairman. 45 minutes. We will entertain that. WWe are going to have follow-on hearings. If the Secretary is necessary we will 

bring the Secretary back before the full Committee. We can do briefings to members. I will seek your counsel.

Ms. Berkley. I would appreciate that. Thank you, Mr. Chairman, 

and I am going to the IR Committee markup.

The Chairman. All right, thank you.

 All right. Mr. Michaud, you are now recognized. The Committee 

will come to order, please. People can take seats and please close the 

door. If somebody can help out and make sure all the nameplates can 

be read by the members, please.

 I’m sorry, Mr. Michaud. I just wanted to say good morning to you.

Mr. Michaud. Good morning, Mr. Chairman.

The Chairman. Good morning. Prerogative of the chair, I would 

ask unanimous consent to rescind the former unanimous consent to 

yield to members for two minutes, and now go back to regular order.

[No response.]
19

 Hearing no objection, so ordered. Mr. Strickland, you are now recognized for five minutes.

Mr. Strickland. Thank you, Mr. Chairman. Mr. Chairman, I also 

am sorry that the Secretary is not here. I wrote down verbatim what 

he said to us, “I am the person ultimately responsible for our veterans, and therefore, the responsibility for what has happened rests 

with me.” I am not sure what it means to take responsibility. I think 

it ought to mean more than just uttering those words. I think it 

should imply some decisive action. And quite frankly, if this was the 

first concern I had about the Secretary, I may be a little more charitable in my response. But quite frankly, I don’t think the Secretary 

is up to this job, and I do hope he takes this opportunity to reconsider 

whether or not he should remain in that position. I quite frankly 

have serious questions about whether or not he should.

 I have a question regarding the fact that many states have enacted 

privacy laws that in some cases certainly supersede the requirements 

that may be currently in place under the VA’s system. Thirty-five 

states have introduced data security legislation. Twenty-two states 

have actually enacted such security laws, one of those states being 

my home state of Ohio. Can someone at the table inform me as to 

whether or not the VA takes seriously the states that may exist at 

the state level, and makes efforts to comply with those state security 

laws, if they are more stringent than those currently embraced by 

the VA?

General Howard. Sir, Bob Howard. I have not seen any evidence 

that we have addressed that for the states. One of the efforts that 

the Office of Information and Technology has been undergoing, you 

know, throughout this incident is trying to determine what guidelines and policies exist. I have not seen that, unless any of my other 

colleagues have.

Mr. Strickland. Can someone give a definitive answer as to whether or not there was a difference in requirements between State and 

Federal law? Or there was a conflict there; would it be likely that the 

VA would attempt to comply with those more stringent state laws, 

within the state?

Mr. Duffy. Congressman, it’s my understanding that Federal law 

supersedes state law. I believe however that the department makes 

every effort to meet state law where it’s consistent with our own rules 

and standards of practice.

Mr. Strickland. Okay, thank you. I am curious as to why an employee would take this kind of material home. I mean perhaps he 

is just a very dedicated employee that is willing to work above and 

beyond what may be required of him at his official worksite. Why 

was he not doing this work during regular work hours? Can someone 

speak to me about the staffing needs that may be inadequate, that 

would result in an employee taking such action, in terms of taking 
20

this kind of data to work on it at home rather than doing it at the 

facility, or at the worksite?

Mr. Duffy. Congressman, I think in this particular instance we 

have an individual who believed that with—on his own time, and 

without the din of daily work; telephones and meetings and the like, 

he would be able to apply his own time and talent to resolving what to 

him was a basic problem of reducing substantially the size of a survey 

instrument that we were attempting to create.

 I would say to you that he fully understood that it was inconsistent 

with departmental policy to take that information home with him, 

that he had no right to remove the materials from his worksite. He 

did it with all of the best intentions, at least that’s my personal opinion. There was no malice a forethought. I don’t believe that there 

was any sinister intent here. He did it because he wanted to be more 

productive and to come back with a problem solved. And in all candor, I think we attempt to promote individual initiative on the part of 

our employee workforce. However in this instance, it was contrary to 

what the rules and regulations require regarding safeguarding sensitive personal identifier data.

Mr. Strickland. Thank you. Just sitting here listening to Secretary estimate the potential cost, I think he said it could be over $100 

million. And if, as the Chairman has suggested, we have the responsibility to make whole any veterans who have been harmed, I can see 

where that number could go much, much higher. Just sitting here 

thinking, the latest I have heard the cost of the Capitol Visitor Center was I think something over $500 million, and the work has been 

going on for years and years, and we know what a massive undertaking that has been. So just kind of putting this in perspective, if the 

lower cost estimates of $100 million hold forth, we can see what an 

incredible cost this is going to be to the taxpayer, to the Federal Government, and ultimately to the VA administration, and that means 

ultimately to the individual veteran, in terms of how they are served. 

So you know, I don’t think this is a little thing, and I don’t imply that 

any of you believe it is a little thing. I think this is just incredibly 

serious. It is going to be very very costly, even if the best case scenario it is that there is no use of this data for, you know, for nefarious 

purposes. It is still in to be incredibly, incredibly costly. And it is just 

such an unfortunate incident.

 Mr. Chairman, I thank you for the hearing. I do hope that we could 

have the Secretary back at some point in the future, and I yield back 

my time.

The Chairman. I thank you, Mr. Strickland. I thank you for your 

leadership. Mr. Strickland and Mr. Bilirakis, Mr. Filner and I want 

to work with both of you because at some point, where do we retain 

this at Committee; where do we do a handoff to the O&I Subcommittee? We want to work with you with regard to our jurisdictions.
21

 I have asked Mr. Opfer to remain with us, as he is not going over to 

the Senate. This is the VA IG.

 And at this point, I am going to yield to Mr. Bilirakis, who has 

asked for his three minutes.

Mr. Bilirakis. Thank you again, Mr. Chairman. Mr. Opfer, who 

do you work for?

Mr. Opfer. Sir, I work for the President and—

The Chairman. Scoot up to a microphone.

Mr. Opfer. Sir, I am a presidential appointee, Senate-confirmed, 

which means I can only be removed by the president.

Mr. Bilirakis. Okay. Very good, that is what I wanted to hear. 

Mr. Opfer, you know, these things happen and they have been happening. The same sort of thing has been happening over a period of 

years. I know we have had secretary after secretary after secretary 

here. And you know, when the media is here, particularly, we speak 

very brusquely and that sort of thing in order to make the media and 

whatnot. But you know, in my opinion, as I indicated during my two 

minutes, two minutes-plus, it is culture. It is a culture at the VA. 

Maybe it is a bureaucratic culture of all the agencies and departments. I don’t know, but certainly at the VA.

 Let me ask you, sir, when were you made aware of the theft of the 

data?

Mr. Opfer. The Office of Inspector General and I particularly were 

never notified by the Department of theft of the data.

Mr. Bilirakis. You never were?

Mr. Opfer. Never were.

Mr. Bilirakis. Never were. How about that? Yeah, how did you 

learn? You read about it in the newspaper?

Mr. Opfer. What happened was on May 10th, the information security officer of the Office of Inspector General was attending a normal monthly meeting in the department. And at that meeting, one of 

the ISOs mentioned that an employee of VA had lost data which was 

stolen from their residence. That information security officer, who is 

not an agent, not an investigator, came back, reported to his supervisor, and the next day it was reported into our office of investigations. 

We had no information other than an employee had lost data that 

was stolen in a burglary in their residence.

Mr. Bilirakis. And what was your reaction—

The Chairman. Can you pull that microphone closer to you. We can 

barely hear you.

Mr. Bilirakis. Yeah. What was your reaction to that?

Mr. Opfer. I was not notified then because the information was 

very sketchy. Our Office of Investigations dispatched agents on Friday, May 12th, to try and locate the information security officer who 

had the information, and also to locate and start the interview process of the employee who had had their residence burglarized.
22

The information security officer that had the information was not 

working. The agents attempted to locate him at his residence and 

left messages there, as well as at work. It wasn’t until Monday, May 

15th, that the Office of Investigations located the subject employee 

that had the burglary, and we conducted the interview.

[The statement of Mr. Opfer appears on p. 101]

Mr. Bilirakis. Wow. Well, there you go. Yeah, I guess the Chairman is suggesting I do this. Misters Duffy and McClendon, why did 

you not notify the IG?

Mr. Duffy. I’ll begin first. Let me begin by noting that the first I 

was notified of it was on Friday morning, May 5th. And my notification was in hallway conversation with the IT specialist who serves as 

both our security and privacy—

Mr. Bilirakis. In a hallway conversation?

Mr. Duffy. Yes, sir. He indicated to me at that time that there 

had been the burglary of one of our data analysts, that some sensitive data and information may have been burglarized. At that time, 

I asked him to do two things: first, attempt to identify and document 

for me all of the data sets and personal identifier elements that may 

have been compromised. The second thing I asked him to do was to 

confirm for me of what the formal process for notification is in the department regarding a matter such as this; that is, where information 

or data has been compromised.

 He agreed to prepare for me a memorandum that would identify 

for me, to the best of his knowledge, the information that might have 

been compromised. With respect to notification, what he told me was 

that the process was to notify the cyber security systems operations 

center, and that they have an incident management process in place 

for responding to these types of issues.

 Later that afternoon, sometime around 3:30 in the afternoon, I

received the first initial memorandum from my IT specialist that 

identified in rather generic terms the data and the information that 

appeared to have been stolen. I talked at that time with Mr. McLendon, who is the deputy assistant secretary for policy. He asked for 

an opportunity to have a member of his staff, who has dramatically 

more familiarity with the data sets, take a look at it, and review and 

validate that information, and indeed he did that.

 Monday morning, the eighth, we had a new, more detailed memorandum on the nature of the information that was contained on the 

hard drive that was stolen.

 On Tuesday the ninth, early afternoon, I had a meeting with the 

department’s chief of staff, Tom Bowman, and informed him at that 

time for there had apparently been a burglary, and that some significant personal data may have been compromised, and indicated 

to him at that time that I thought it important that senior leader-
23

ship get together and identify exactly what our responsibilities were 

regarding notification to the beneficiaries whose information might 

have been compromised.

Mr. Bilirakis. Did you ever take in consideration when you should 

notify the IG?

Mr. Duffy. Sir, with all due respect, my understanding was that 

all that would have been processed through the incident management 

reporting system in cyber security, in the SOC.

The Chairman. Oh, so you are blaming who?

Mr. Duffy. I’m not blaming anybody. What I’m telling you is what 

was in my mind. And what was in my mind was two things: one is 

that we had made formal notification through our IT systems specialist to cyber security, that they have that responsibility. The other 

point that I would make to you is that when I had information in 

hand, it was provided up the chain to those above me regarding the 

fact that the information may have been compromised, and our need 

to take some affirmative action.

The Chairman. Mr. Bilirakis, may I?

Mr. Bilirakis. Well, my time as long up. Yes, sir, by all means.

The Chairman. Mr. Cadenas, you are sitting right there. What do 

you think about what Mr. Duffy just said?

Mr. Cadenas. Well, sir, because we get a number of reports on a 

regular basis, the SOC, the Security Operations Center, did receive 

this notification. But before it’s escalated, it must be confirmed that 

a—because the original message that came in says “possible compromise.” So part of the process is we contact the information security 

officer to validate if in fact it has been compromised.

 A number of days had lapsed. We started beginning our own investigation, asking additional questions, and the information was not 

forthcoming, as well. Still had no valid confirmation that the information was lost or stolen or anything to that effect. We’re still dealing with the compromise, potential compromise, of information.

 During the course of the process, we asked the information security 

officer to also contact the privacy officer based on the information 

that you identified that was on there. We later found out—I don’t 

know if it was my office or the individual himself, there was a privacy 

office ticket violation opened up on that.

 I found out about this incident on the 16th, as well, and my team, 

they were trying to conduct their due diligence to validate that this 

in fact had happened.

The Chairman. Do you work with the IG? Do you ever report these 

incidents to the IG?

Mr. Cadenas. Well, yes, sir. We have understood rules of engagement. Once it reaches a certain level, any incident reaches a certain 

level, we back off because now it could be a potential criminal investigation, and then we hand off.
24

The Chairman. But the IG has testified that he has never even received this yet. So when does this rise to the level of concern?

Mr. Cadenas. Well, in looking at the entire incident, sir, because 

this does not fall—and I don’t mean to sound like the bureaucracy 

here—but because it does not fall under cyber security, this was not 

a cyber security attack or hack, we tried to follow up with the privacy 

office, and we ran it up the chain. This is a privacy issue.

The Chairman. Okay. It is not your problem, I guess now it is not 

yours. Now it is not the privacy guy. We don’t have the privacy guy 

at the table?

General Howard. It is a bureaucracy, Mr. Chairman, and it is culture—

The Chairman. All right, let me just pause a moment.

General Howard. Mr. Chairman—

The Chairman. Ms. Brown, you are now recognized. Hold on, I

know you want to say something. But Ms. Brown wants her three 

minutes. I need to yield to her.

 Ms. Brown, you are recognized for three minutes.

Ms. Brown of Florida. Well, I hate to break the chain. I am going 

to let you answer your question, and then I will go to mine. Just finish what you were saying.

General Howard. I just wanted to comment that—that there’s the 

constant refrain of “it’s just a large bureaucracy.” It is indeed a large 

and complex structure, but it is not so large that we don’t talk to each 

other. And the truth is that a number of days passed where the information was being reviewed and validated. The burglary took place 

on the third. On the fourth, the employee did not report for work. He 

was told by—as I understand it, the home had been ransacked, and 

he had been told by police to secure his premises and the like. So 

he was not in. He did not come in until the morning of the fifth, on 

that Friday. That’s the day when Mr. McLendon and a senior data 

analyst sat down with the individual and talked specifically about 

the nature of the data that may have been compromised. And it was 

only after a full day of discussions with somebody who quite candidly 

appeared to be fairly distraught about the whole incident.

Ms. Brown of Florida. Well, do you know this is a meltdown? And 

the secretary said he didn’t find out about it until the 16th? When did 

the secretary find out?

General Howard. He indicated the 16th.

Ms. Brown of Florida. It is a complete failure. Since 2001, has 

your office requested changes that would limit anyone’s ability to remove VA data to a personal computer or storage device?

Mr. Cadenas. Yes. Yes, ma’am, the office of—

Ms. Brown of Florida. Yes, what was the result of that action?

Mr. Cadenas. We do not have the authority to enforce any such 

request.
25

The Chairman. Ms. Brown?

Ms. Brown of Florida. Yes, sir?

The Chairman. If you pay really close attention to the response that 

he just gave, what I just learned from last night, and I want to make 

sure I get to all the members, I have a March 16th, 2004 document 

from Tony Principi, when he was the Secretary. And he instructed 

that the chief information officer be the individual that is responsible. 

We need somebody in charge of all this. Then we have the General 

Counsel. He writes an opinion. And in his opinion, he says that the 

CIO does not have that authority. And matter of fact, Mr. Cadenas 

here with cyber security can only do compliance. He does not have 

the authority to demand anybody to do anything. He can only say 

whether somebody has complied or not.

 I yield back.

Ms. Brown of Florida. It is a complete meltdown. The system is 

not working for the veterans.

 To your best knowledge, does anyone other than VA employees take 

home or store veterans’ personal information; names, Social Security, 

date of birth, financial, medical, anywhere in VA? Is there a statute, 

regulation, or policy, that allows that action?

General Howard. Ma’am, we have procedures in place to permit 

telework, virtual connections, you know, through laptops and what 

have you. The only clear guideline that I have personally seen on 

the rules of the game, regarding taking information away from a VA

facility, is contained in the guideline that the secretary mentioned 

during his testimony. And there are two specific items in that guideline: one is to take information such as what we are talking about 

away from a VA’s facility, the individual has to have permission. And 

the second key part of it, it must be encrypted. Clearly, both of those 

elements were not followed. But that guide—it’s in a guideline. It’s 

not a directive.

Ms. Brown of Florida. Oh. God, we need help. This is unbelievable. I am going to yield my time, but I can tell you that this system 

is a failure. I mean, we are not talking to each other, we are not 

communicating. You can’t tell me how many other people have this 

information, that could have this data at home. It is not illegal to do 

it. It is a regulation, it is not—do you hear what he is saying?

[Laughter.]

Mr. Bilirakis. What the gentle lady yield?

Ms. Brown of Florida. Yes.

Mr. Bilirakis. Yeah. The VA Inspector General in his November ‘05 report entitled “Major Management Challenges; Fiscal Year 

2005,” stated that, quotes, “VA has not been able to effectively address its significant information security vulnerabilities and reverse 

the impact of its historically decentralized management approach,” 
26

end quotes. And there you are.

 That is why I keep going back to this culture business, this environment business, because that is where the problem stems from. 

Mistakes are made. I mean, we are all human beings. But continually, continually, and the frustrations of IT, and the lack of security. 

Thank you, Mr. Chairman, thank you for—

Ms. Brown of Florida. I think it has to go back with whose responsibility it is. I think the ultimate responsibility is with us. As a coequal branch of government, we have not done our job.

The Chairman. Well, we passed the CIO Bill, ma’am. When I look 

at this for the members, I would ask unanimous consent that the 

documents which I referred to in my discussions with Corrine Brown 

be submitted for the record. And in particular, the memorandum 

from Secretary Principi dated March 16th, 2004 be entered into the 

record.

[No response.]

 Hearing no objection, so ordered.

[The attachment appears on p. 135]

The Chairman. I would ask that the General Counsel’s memorandum dated April 7th, 2004, be entered into the record.

[No response.]

 Hearing no objection, so ordered.

[The attachment appears on p. 136]

The Chairman. The Secretary Principi, this is what he says:

“Cyber security is everyone’s responsibility, and all employees are 

accountable for protecting VA’s computer and information systems. 

Specifically I have tasked the Assistant Secretary for information 

and technology, the CIO, Bob McFarland, with responsibility to devise and implement a department-wide cyber security program under 

the Federal Information Security Management Act.”

 We passed that act.

“I expect all employees to fully support and cooperate with the implementation of the department’s cyber security policies. It is my intention to ensure that the Assistant Secretary McFarland has all the 

power and authority necessary to carry out the heavy responsibilities 

associated with cyber security in the department. This will include 

certain administrative and supervisory authority over employees directly involved in the implementation of cyber security policy. Appropriate directives, policies, personnel regulations, are being drafted to 

effectuate my intentions.”

 We have the acting CIO in front of us, former Major General Howard. Now the problem is the General Counsel comes along and does 
27

an interpretation and says they CIO does not have these authorities. 

And that is what we now end up, we have got a mess in that bureaucracy.

Ms. Brown of Florida. Mr. Chairman, could I—30 seconds?

The Chairman. Yes ma’am.

Ms. Brown of Florida. Mr. Chairman, we often passed bills, and 

then the agency will come up with regulations that’s just opposite of 

what we pass.

The Chairman. Well, that is why we have been working on this 

Committee in a bipartisan fashion, ma’am, to bore through this, but 

we have a bureaucracy that is recalcitrant. We have individuals sitting at this table.

 Yes, Mr. Duffy, I just saw your reaction. You and I have a complete 

disagreement with regard to centralization versus decentralization. 

You fought us all along. You go, “Oh, this is my business. Stay out 

of my world.”

 Well, now that the problems we have got. We said, “Okay, we are 

going to leave it to you, we are going to leave it to Mr. McLendon,” 

and look what we have got in a decentralization.

Mr. Duffy. Mr. Chairman, with all due respect, I have never taken 

a position on centralization or decentralization of IT. It has nothing—

The Chairman. Thank you for your views, Mr. Duffy.

Mr. Duffy. —it affects me only on the margins. And trust me, I

have not entered that—

The Chairman. Well, that’s one hell of a margin for a veteran.

Mr. Duffy. Well.

The Chairman. I yield to Mr. Miller.

Mr. Miller. Thank you, Mr. Chairman. I have already asked my 

questions. I will yield back my time.

The Chairman. All right. I have been asked to meet with the 

Speaker.

Mr. Bilirakis. [Presiding]. Okay, where are we here? Mr. Boozman?

Mr. Boozman. Yes.

Mr. Bilirakis. Mr. Boozman is recognized for five minutes.

Mr. Boozman. Yeah, I would like to know a little bit about what 

happened. So the place was broken into, and not just the computer 

was stolen, but the whole place was ransacked? I think somebody 

alluded to that earlier.

Mr. McLendon. I’ll be glad to answer that, Mr. Boozman. The employee had left to go home from work. His wife is also a government 

employee. She arrived home to find the home having been broken 

into and ransacked. She called her husband and reached him on the 

cell phone when he was I guess in the parking lot fixing to get in his 

car to drive home. As best I understand it, she arrived home some-
28

where around maybe 3:30, 4:00 o’clock in the afternoon. So they did 

the notification to the police. When he finally kind of got a handle on 

what was going on, he called the office. The secretary got ahold of 

me, and I called him just a few minutes later, probably somewhere 

around 5:30, quarter of six that afternoon.

 He was very distraught, as you can imagine. He was also concerned because his wife had found a break-in, and he was kind of 

after-the-fact concerned that maybe somebody was still in the house. 

He described that the house had been ransacked, that they had gone 

through drawers upstairs, and drawers all over the house, and that 

things like change that we would normally put in a glass jar or something was missing out of drawers. He described kind of the state of 

the house, and how they had broken into a back window. And then he 

said that, you know, that they had taken—he was surprised at things 

that they had passed up in the house, you know, like silver and those 

kind of things, but it appeared that they had grabbed his personal 

laptop and external hard drive when he had—when they had left.

 And it was at that point that just straightforwardly, and I have to 

give the individual credit for this, that he said he believed that there 

was some veterans’ data on his hard drive. And I have to say that 

to this day, that that individual does not understand that there are 

many people who would not have self-reported that information. But 

he did, and he acknowledged on the phone that he knew that he was 

not supposed to have done that, and he just had no explanation as to 

why. And clearly, he was just very distraught at the incident.

 So he was—the police were still there. He said he needed to work 

with them. He had already notified VA security office about the incident. He was not at work the next day because the police had asked 

him to secure his home and be available for questions and whatever.

 Early the morning on Thursday morning—and also I have to say, 

after I talked to the gentleman that afternoon, I contacted the individual in our office who is the most technically knowledgeable about 

the details of the data and systems, to also called the individual to try 

to elicit more information from him. And so then he reported back to 

me, so that early Thursday morning, that individual, Dat Tran and I

sat down with the information security officer for the office of policy 

planning to relate everything we knew up to that point, and to say, 

“Okay, now you tell us what the process is and what additional information that is gonna be required.”

 And he very matter-of-factly laid out what he said he knew the procedures were, just like Dennis acknowledged, about what was gonna 

happen, who he would be generally talking to, and he says if I need 

any more information, or when I do, I will come back and tell you.

Mr. Boozman. So if he hadn’t self-reported it, then we really would 

have had no way of knowing that the data ever left the office, or whatever.
29

Mr. McLendon. No, sir, we wouldn’t have. And I think it’s important to remember that this is not a case in which information was put 

up on the Internet for wide public access. It was, he had taken some 

disk from work that he was using, to use on his external hard drive at 

home, to continue to do work. He’s a Ph.D. analyst—

Mr. Boozman. What are the police saying? I mean this happens all 

the time, you know, sadly, in the sense that places are broken into. 

What is the customary stuff, when you steal electronics—first of all, 

who are they saying are the likely thieves? What kind of profile do 

they have? What do they customarily do with this stuff when they 

get it?

Mr. McLendon. Depends upon—I’ll just say from my personal experience, I have been through this, it could be anywhere from kids 

to more professional individuals who are looking for easy prey and 

things they can quickly turn a dollar on. I don’t believe that the police report or the FBI has completed their investigation yet, so we will 

just have to wait and see what they say.

Mr. Boozman. Thank you.

 Mr. Bilirakis. The gentleman’s time has expired.

Mr. Boozman. Mr. Chairman, also, could I have a statement put in 

the record, please?

Mr. Bilirakis. Oh, yes. That, you see, took place before you came 

in.

Mr. Boozman. Okay, thank you.

[The statement of Mr. Boozman is found on p. 89]

Mr. Bilirakis. Mr. Salazar to inquire.

Mr. Salazar. Thank you, Mr. Chairman. We do appreciate this.

 As I hear more about what happened and the items that were taken during this burglary, it seems like you were talking, Mr. McLendon, that silver was passed up, and other things. It almost seems to 

actually send up a red flag because it seems like the computer was 

targeted.

 We introduced legislation a couple days ago. It is HR-5455, the 

Veteran’s Identity Protection Act, which will actually provide free 

credit reports for veterans who might have been affected by this for a 

period of one year. Could someone in this panel maybe address that? 

And do you think this is something that should be done?

Mr. Henke. Sir, I am not familiar with the particular legislation 

you cite, but obviously our first concern is to protect veterans. And 

as the Secretary has indicated, he would be more than happy to work 

with the Congress to find ways to do that and take those steps that 

are necessary.

Mr. Salazar. Well, what this particular legislation will actually 

do, is provide free credit reports for veterans for a period of a year 

to make sure that in case some of their credit information has been 
30

breached, that it would not necessarily have to come out of their pockets. Of course, you know, the first credit report is free for any time 

that you apply. But after that, you have to pay for it.

 Of course this will cost taxpayers, and VA maybe, an incredible 

amount. I think the price tag is 1.5 billion for the first year. Would 

you be supportive of that?

Mr. McLendon. Let me just make a general comment. I think 

it’s very fair to say that the department certainly takes it seriously. 

There have been a lot of discussions over the last week about exactly 

how could we do something like that, what the mechanics would be, 

what the logistics are associated with doing that, how that would 

occur. And the department is actively looking at how to bring that 

about, those kind of things, right now.

Mr. Salazar. Thank you. Mr. Chairman, there are a lot of people 

here that want to ask questions, so I would like to submit my full 

statement for the record.

Mr. Bilirakis. The chair appreciates that.

[The statement of Mr. Salazar is found on p. 93]

Mr. Bilirakis. Mr. Moran, to inquire.

Mr. Moran. Mr. Chairman, thank you very much. Perhaps what is 

most troublesome to me about this scenario is the failure to communicate to the Secretary in what I would consider a timely fashion. And 

I understand Mr. Filner asked the question earlier about what level 

this information reached, as far as the hierarchy of the Department 

of Veterans Affairs. And you know, I am interested in knowing, you 

know, why the Secretary was not notified immediately. I would at 

least like to think in my own professional life that something dramatic happened that I would be at the top of the list of people who would 

know. And I don’t know whether it is a concern with the attitude, I

should have a concern with the attitude of VA officials as, “This is 

something we don’t want to tell our superiors.” Or it is a distance by 

the Secretary; he is not there, interested, available.

 I cannot imagine that is the case, but there is something—again, 

Mr. Bilirakis’s word, the “culture”—that is troublesome to me, that 

we wouldn’t immediately go to the top leadership, the leader of the 

Department of Veterans’ Affairs with this kind of information. So I

am interested in any thoughts that you all have as to what the problem would be that this would not be seen at the VA as an incident 

that would be immediately reported to the leader of the department. 

I am curious just to know whether in the course of time you have observed other departments, studied what their security measures are, 

how this is prevented. I am interested in knowing if there are other 

departments out there within the Federal Government that are role 

models that the Department of Veterans Affairs should have been 

following. Or other disasters waiting to happen at other cabinet-level 
31

positions, other departments within our Federal Government, that 

we as members of Congress should be aware of.

And finally, a more practical question: my constituents, my veterans are calling, asking, “you think that information about me or my 

spouse are in these records?” Example, a Vietnam veteran discharged 

in 1972 who has now deceased, his spouse, his wife is calling to say, 

“Is there any chance that there is information there about my husband or me?”

 And so if there is information that you can provide as to how we can 

answer the calls we are receiving as to who is included in this 26.5 

million veterans whose records are released.

 I thank the Chairman. Anyone, respond to any or all of those.

General Howard. Sir, you ask a number of questions. I would like 

to recommend we answer all of them for the record. But let me address a couple of them. You mentioned the other government agencies. One government agency that is a role model is Social Security. 

You know, they constantly get very high grades with protection of 

information. I know that for a fact.

 There are others besides VA that don’t get high grades, I know that 

also. It is a very real problem in other government agencies, I don’t 

recall the scores. When you say the Veterans’ Affairs is fairly low, 

you’re exactly right. You know, our grades have not been high. But 

as I say, there are role models. There are definitely things that we 

can do to improve things.

Mr. Moran. What you are telling me is that what has occurred 

at the Department of Veterans’ Affairs may not be an anomaly, but 

something we could to see repeated elsewhere?

General Howard. Sir, with respect to the magnitude it may be an 

anomaly. You know, what’s significant—obviously, the loss of any 

data is a serious problem, but it’s the magnitude of this one that is so 

troublesome. I suppose it could occur in other government agencies, 

but you know, I really can’t comment on that.

Mr. Moran. Any explanation of the nature of the VA that the Secretary would not know this immediately?

Mr. Duffy. Congressman, I’ll make an effort to answer it. And 

that is that in all candor, I don’t believe anybody had a true appreciation originally of the magnitude, the size of the data set that was 

lost. When I first heard that there was a BIRL’s extract, while I 

knew from my own experience that the BIRL’s record is a large data 

set with millions of records, my own thought was, “Well, he probably 

extracted some very small subset of that record.” And once notified, I 

think what we did was we attempted to do due diligence. And that is, 

we first of all attempted to get the facts. And once we had the facts in 

hand, we provided them to the chief of staff, who in turn said, “Well, 

let’s work with the general counsel to assess what our obligations or 

responsibilities are here.”
32

 And it was that process that took some time. Now, should the Secretary—in hindsight, obviously the Secretary should have been notified earlier. But again, I think originally there was no sense of the 

size or magnitude of the data loss.

Mr. Moran. Can you assure us that there was no cover-up involved?

Mr. Duffy. I can certainly assure you of that from my personal 

vantage point and from dealing with the individuals that I have dealt 

with. There absolutely was no effort, no attempt at all. We made 

every effort to do what we thought was the right and prudent thing.

Mr. Bilirakis. The gentleman’s time has expired.

Mr. Moran. Thank you Mr. Chairman.

Mr. Bilirakis. Ms. Hooley to inquire.

Ms. Hooley. Thank you, Mr. Chair. This is really frustrating, and 

there are so many troubling things about this incident. This is one 

of a string of data breaches that have happened in all kinds of other 

industries, and is why I think we need some kind of data security 

legislation, which I have championed in the Financial Services Committee. I have also introduced legislation that would require VA administration to provide veterans six months’ of free credit reporting, 

that there would be authorized funding, and that you would also have 

negotiating powers so that you can get the best price for the monitoring services. There has been a lot of estimates about what this would 

cost. We have gotten estimates anywhere from 25 million to $1.2 billion, so it is a wide range. And hopefully, we can narrow that piece 

down.

 My question is, if this legislation passes, could you implement that 

in a very timely manner to help our veterans? And are you prepared 

to negotiate the best price for credit monitoring services? You can 

answer that now or wait until I am finished.

 And I guess the third question would be, could you start that process right now? Do you have to wait for legislation to pass? Can you 

start the process right now?

 Fourth, right now you are giving I think some good advice, but it 

is very reactive. You’re saying, you know, “Please monitor this, call 

your bank,” you know, all of those things. But why aren’t you more 

proactive? For example, you could say to every veteran, “You could 

put a fraud alert on your credit report” If they put a fraud alert they 

automatically get a free credit report. Right now, even without having their information taken, or stolen, or breached, they can get a free 

credit report every year. I mean, that is the law, currently. And if 

they get one from each credit bureau, they can do one credit bureau, 

and then another credit bureau, and another credit bureau, they can 

get a free report every four months.

 So it seems to me there are some very proactive things you can tell 

all of the veterans that have had their, security breached, you can 
33

give them that proactive information today. And my question is, are 

you doing that; and if not, why not? Then—

Mr. Bilirakis. Wouldn’t you not like to get some answers to those?

Ms. Hooley. Yeah, I am ready to get answers any time they are 

ready to give them to me.

Mr. Bilirakis. Yeah.

Ms. Hooley. And then I have one last question.

Mr. Bilirakis. Good.

General Howard. Some of that information is on one of the Websites that the veterans are referred to.

Ms. Hooley. Some of the information. I know what is on your Website, and it is very reactive, saying “Monitor this,” but it is not proactive, and there are some very specific things they can do that will 

make a difference on whether or not they have their identity stolen, 

which is a huge problem if that happens.

General Howard. That’s what I meant. Some of that—things that 

they can take, what they are authorized, is available.

 With respect to additional items like credit monitoring and things 

like that that Veterans’ Affairs could pay for, I’ll defer to Bob Henke. 

We get into budget issues and authorities to pay for that sort of thing. 

Obviously, we’re prepared to do anything that we need to do, but I’d 

let Bob comment on the financial aspect of it.

Mr. Henke. Ma’am, I went to the Websites that we have set up for 

this particular incident, and it does link you to the opportunity to get 

a free credit report, and for every member to put a 90 day fraud alert 

on their individual accounts, so that information is out there, through 

both the VA Websites and firstgov.gov.

Ms. Hooley. Is that your recommendation? I mean, do you recommend that happen, that they do that?

Mr. Henke. That members—

Ms. Hooley. I mean, it is on there. When they go onto the Website, what are the things that you tell them that they can do, the first 

things they can do?

General Howard. Monitor their information.

Ms. Hooley. Monitor their information. Which is good advice. But 

there are some proactive things they can do immediately. You say, 

you know, Put a fraud alert on. What does that mean if they do that? 

How long does that last? It lasts 90 days. They get a free credit 

report. I mean, I think that is the kind of proactive information you 

should be giving your veterans.

Mr. Miller. Congresswoman, I think it’s fair to say that the Secretary and this task force is indeed looking at a whole host of different 

affirmative steps that the department can take, all the way to perhaps providing credit monitoring. What we need to do is lay out what 

those potential options are, what the costs are that are associated 

with them, and what authorities we have. I think the secretary made 
34

clear that we were going to do everything in our power to mitigate 

whatever adverse impact this may have on the veterans whose data 

was compromised—

 Mr. Bilirakis. The gentle lady’s time has expired. But Mr. Duffy, 

with all due respect, you know, meetings, consultations, “we are looking at it, we are trying to decide what authority we have.” In the 

meantime, a lot of bad things can be happening. I think that’s what 

the gentle lady is saying, sure.

Ms. Hooley. I just want you to take some leadership. That’s what 

I want you to do. I want you to take some leadership.

Mr. Bilirakis. Yeah, well.

Ms. Hooley. Excuse me, Mr. Chair.

Mr. Salazar. Especially for people who don’t have computers.

Mr. Bilirakis. Well, that is another point. There are many veterans out there who don’t have computers. So you can’t just look at that 

one particular way to do it. There are public service announcements 

that all the television stations as broadcasters are required to make 

available.

General Howard. And the department is taking steps now to send 

individualized letters to every veteran that we can indeed identify, to 

notify them personally. You are absolutely right about not everybody 

having a home computer.

Mr. Bilirakis. Well again, as Ms. Hooley said, take some leadership here. Let us not just sit back and, “we will let these bad things 

happen”—then the cow has already left the barn, or whatever the 

proper terminology is.

 Let us see, Mr. Bradley to inquire.

Mr. Bradley. Thank you very much, Chairman Bilirakis. I would 

just like to start out by thanking you, and Mr. Filner, and Chairman 

Buyer, for your leadership in making sure we have this hearing in an 

expeditious fashion.

 Not to beat a dead horse, but my concern I think with some of the 

other more recent questioners is the 27 million people that have potentially had their data stolen, and it may well be used. Let me try to 

encapsulate what I think you have said today in terms of procedures 

that are in place, or about to be in place:

 You are going to write a letter to all 26.5 million, but you don’t have 

envelopes, so we don’t know when that is going to happen. There is a 

Website. The question that Ms. Hooley asked is why is there no fraud 

alert on it? There is a call center with an 800 number. Are there 

enough operators, and is the information clear? There are expedited 

procedures at credit bureaus. How helpful that is, that would be a 

question I would have. Equifax has a toll-free number.

 We don’t know that there are any problems yet, which I guess is 

good news. Secretary Nicholson I think made a pretty clear statement. The VA is responsible. Let us admit the reality. That means 
35

we are responsible, and we are going to have to deal with this, in 

terms of responsibility.

 So, in terms of questions, do you have authority right now under 

your existing authorizations and budget, authority to pay for any 

credit checks, counseling, or any other expenses such as that? And 

number two, do you have statutory authority to make people whole 

if they do have identity theft problems? Or if you don’t have that authority, are you prepared to work with us immediately so that we can 

take the legislative steps necessary to give you that authority?

General Howard. We are clearly prepared to do anything we need 

to do, sir. We do not believe we have the authority to do that right 

now.

Mr. Bradley. Either authorities I asked? You don’t believe you 

have the authority to compensate for counseling, for credit checks, or 

any other expenses that are preventative in nature?

General Howard. I don’t believe so. No.

Mr. Bradley. And if you don’t have that authority, you probably 

don’t have the authority to make people whole in the event that problems do manifest themselves.

General Howard. I don’t believe so, sir. We would need some additional authority.

Mr. Bilirakis. I understand that Mr. McLean left with the Secretary to go over to the Senate. But his assistant is here? Can you 

answer that question, sir? Mr. Thompson, Mr. Jack Thompson?

Mr. Thompson. Yes, sir, I am Jack Thompson.

Mr. Bilirakis. Yeah, why don’t you pick up that mic, and maybe 

you can respond to that.

Mr. Thompson. Yes, sir. We have determined that VA does in fact, 

incident to its authority to administer these benefit programs, have 

the inherent authority to provide, to fund credit checks for individuals. What we lack is clear authority if any individual suffers economic damage as a result of identity theft. Those sorts of losses perhaps could be compensated through an action under the Federal Tort 

Claims Act, based on Federal negligence. But quite frankly, there 

would be a number of legal obstacles in the path of anybody who 

needed to go that route.

Mr. Bilirakis. Well, now, sir, would your department, your office, 

furnish this Committee your opinions regarding what additional authority might be needed so that we can do whatever is necessary I

guess through legislation if you don’t think they have the authority?

Mr. Thompson. Yes, sir—

Mr. Bilirakis. Let us not wait until it happens I guess is what I

am saying.

Mr. Thompson. Yes, Congressman. We would be glad to.

Mr. Bilirakis. Many of furnish that to us as soon as you possibly 

can? Good, all right.
36

 Mr. Bradley, I am sorry to take up your time.

Mr. Bradley. Not a problem. Glad to accommodate you, Mr. Chairman.

So having answered the first question about authority, that you do 

in fact have the authority, it would seem incumbent upon all of you 

to make sure that in the widest possible venues, whether it is the 

letter, the call centers, the Website, public service announcements, 

on and on and on, that you disseminate the information that in fact 

veterans will be compensated for, if they have expenses to do with 

credit counseling checks or any other expenses, on that first authority 

I asked you.

 And I look forward to working on a bipartisan fashion with all the 

members on this Committee on the second authority, which we need 

to do, it would seem to me, as soon as possible.

Mr. Bilirakis. I thank you, Mr. Bradley. I thank you, Mr. Thompson.

 Mr. Udall to inquire.

Mr. Udall. Thank you, Mr. Chairman, and let me say this in listening to all of you and listening to the Secretary, it seems to be like 

a comedy of errors, and I think you can probably understand why so 

many members of this Committee have expressed on both sides of the 

aisle a great deal of displeasure with what has gone on here. We do 

not have to tell you, these are men and women who have served this 

country, and potentially we have put them in a situation violating 

their privacy, and costing them a significant amount of money.

 And Mr. Chairman, I would like to echo what others have said. I

think we have many questions that were unanswered from the Secretary. He is the one in charge of this department. We should bring 

him back here and get those answers. I mean, the thing that he said 

that was shocking to me, to hear this happened on May the third, 

and he did not learn until the 16th of May, and he is the guy running 

the department. Theoretically within the Veterans’ arena, the buck 

stops at his desk, and all of you that work for him, it did not get to his 

desk for 13 days.

And I guess my first question is why is that the case? Why did none 

of you that are here, or anybody else, report to him for 13 days what 

had gone on? We heard from you, Mr. McLendon, we heard that you 

interviewed and had the information. You knew there was a breach 

on the 5th. It would seem to me that that would be the date that 

someone would report to the Secretary that we have had a very serious problem here. Can anybody answer that?

Mr. Filner. Tom, can I just add half a sentence?

Mr. Udall. Yeah, sure. Please, yeah.

Mr. Filner. Mr. McLendon testified earlier that on the fifth you 

called the secretary. I do not know who you meant.

Mr. Udall. Because the Secretary in his testimony here said he did 
37

not learn until May the 16th is what—

Mr. McLendon. I was referring to our administrative secretary in 

our office when I said “the secretary.” She’s the one that first get the 

call. If I could just add from my point of view, is we have a process 

in place that says, and we are trained do this, that you notify your 

security and information privacy officer, and there is a protocol that 

they follow as to what they do. And that’s what we did. And I think 

General Howard would probably say the same—we were both trained 

by the same building—that when you have a protocol and process in 

place, you pass that information along, you do the due diligence that’s 

required, and you give them the information. And you wait for them 

to tell you what it is that they need to move this process forward.

Mr. Udall. But Mr. McLendon, Mr. McLendon—after you did your 

interview, you knew on the fifth that 26 million veterans’ information 

was out there and had been stolen. And you had a process clearly—

you had a process clearly to follow—

Mr. McLendon. No, sir—no sir, we did not know that on the 

fifth—

Mr. Udall. When did you know that, then?

Mr. McLendon. We began doing due diligence when [Stricken from 

the record upon request of the Presiding Chairman] was able—came 

back to work on Friday. And talking to him about what he thinks 

that he had done. And that’s when a memo was prepared on the 

eighth, that as Mr. Duffy shared with you what happened with that, 

that—

Mr. Udall. But when did we know that 26 million veterans had 

information that was in that disk, was in that hard drive that was 

taken? When did we know that?

Mr. McLendon. I don’t think we completely knew that until somewhere around the 16th. And let me—

Mr. Udall. Why did it take so long to figure that out? I mean, 

you had the employee in your office. He told you what he was taking 

home.

Mr. McLendon. Well, by this point the employee had already been 

placed on administrative leave, and—

Mr. Udall. You did not do a thorough interview of him before? 

Before—

Mr. McLendon. Yes, we did a thorough interview. The IG did several interviews with the individual. But you have to sit down and go 

through a fairly painstaking process of looking at all of the records 

that are in a file. And let me just make a comment about Burrels—

Mr. Udall. Well, let me ask you one question here because I wanted to ask the secretary this, but the VA has an internal system to rate 

the sensitivity of veterans’ data, from a one to a nine, with a level nine 

reserved for VIPs like the president of United States, or a member of 

Congress, or a cabinet member. In 2001, the VA stated that only 43 
38

people had VA-wide, were authorized access to those records. Was 

this GS 14 individual specifically authorized access to all sensitivity 

levels, including Cabinet member records, prior to the incident?

Mr. McLendon. Not as far as I know, sir.

Mr. Udall. So there was no authorization.

Mr. McLendon. Sensitivity levels are established in a very strict 

way within VA in terms of access. I would not even have access to 

that information.

Mr. Udall. Thank you, Mr. Chairman.

[The statement of Mr. Udall appears on p. 91]

Mr. Bilirakis. Talking about insensitivity: without objection, the 

name that was uttered by Mr. McLendon will be struck from the record.

Mr. McLendon. Excuse me, Mr. Chairman. I didn’t understand 

that.

Mr. Bilirakis. Well, there was a name mentioned of the employee. 

That will be struck from the record.

Mr. McLendon. Oh, oh, oh, yeah. Okay. Yeah. Yeah, yeah, yeah, 

yeah.

Mr. Bilirakis. Without objection. Ms. Brown-Waite to inquire.

Ms. Brown-Waite. Thank you very much, Mr. Chairman.

Any member of Congress whose district office is helping constituents, including veterans, if one of our employees took this information home and the same thing happened, we would immediately fire 

that employee for putting the constituents at risk. General Howard, 

you referred to the “rules of the game.” The problem is this is not a 

game. It was not a game. You know, the guidelines, that the VA had 

put down were kind of like suggestions. We often 

hear that people believe the Ten Commandments are suggestions. So 

obviously, you all put this down as suggestions.

 The VA has had problems that the IG has reported: information, 

security, material weaknesses, every year since the 1997 audit. This 

is 2006, and this has happened? I am sorry, what are you all doing 

over there?

 Back in our individual districts, the medical care that is being 

given is excellent. But I will tell you, our constituents believe that 

Washington DC is La-la land, and I have sat here from the beginning 

listening to everybody, and I am starting to absolutely agree that this 

is La-la land, because you all are in denial.

 Is the employee on paid administrative leave, or unpaid administrative leave for taking this material which he was not authorized to 

take? Mr. Pittman, can you answer that?

Mr. Pittman. Paid.

Ms. Brown-Waite. Would you please stay by the microphone. He is 

on paid leave? Is there a reason why if he was not authorized to take 
39

this why he was not fired?

Mr. Pittman. Yes, ma’am. From the very beginning we were under 

the instructions that we have to investigate this process to determine 

the severity of the action to be taken, and that’s what we’ve done.

Ms. Brown-Waite. Is the employee a civil service employee, or is he 

a political appointee?

Mr. Pittman. Civil service.

Ms. Brown-Waite. If the Secretary does not know how many employees telecommute, do you?

Mr. Pittman. Yes, ma’am, 1600.

Ms. Brown-Waite. You have 1600 telecommuters?

Mr. Pittman. Yes, ma’am.

Ms. Brown-Waite. From all over the country? Or just here in the 

DC area?

Mr. Pittman. All over the country. We have 40,000 occupation—

employees that are eligible to telecommunicate, but only 1600 take 

advantage of that category.

 Ms. Brown-Waite. And do you know—it has been 22 days since the 

burglary took place—does the department have a copy of the police 

report, or are they relying entirely on the individual’s report of this 

incident? Now obviously, the police report would not be completed 

because an investigation is ongoing. But do you all have a copy of the 

initial report?

Mr. Pittman. I’m told that the answer is yes.

Ms. Brown-Waite. Could you confirm that?

Mr. Duffy. I can confirm that for you.

Ms. Brown-Waite. Okay, so you do have a copy of that.

Mr. Bilirakis. Can we get a copy?

Ms. Brown-Waite. Yes, we would like a copy.

 The other thing is, did the department do a risk assessment on this 

breach?

Mr. Pittman. I cannot answer that question.

Ms. Brown-Waite. So no one here knows if a risk assessment was 

done on this breach?

Mr. Pittman. No ma’am, I don’t.

General Howard. Don’t believe it has.

Ms. Brown-Waite. Well, inasmuch as it happened on the third, the 

Secretary did not find out until the 16th, but the deputy secretary 

found out somewhere in between that time. Don’t you think that it 

was appropriate to do some sort of a risk assessment?

  General Howard. There are actions going on as to what conditions 

do exist, but that’s an ongoing effort to find out how much data is out 

there in an uncontrolled environment. We don’t know the answer to 

that right now.

Ms. Brown-Waite. The other question is, why isn’t all of this information encrypted?
40

General Howard. It should be. I believe I mentioned earlier, the 

guideline—and you’re correct, ma’am, I should not have referred to it 

as “rules of the game,” you’re exactly right. In that guideline, there 

were two key requirements. One is that the information should not 

have been removed. And two, it should have been encrypted, so—and 

it was not.

Ms. Brown-Waite. What steps is the Department taking to ensure 

that information is quickly encrypted?

Mr. Bilirakis. Would you furnish that information to us in some 

detail, please?

General Howard. You mean the guideline, sir?

Mr. Bilirakis. Well, what steps are being taken—

General Howard. Yes, sir.

Mr. Bilirakis. —responding to the question.

Ms. Brown-Waite. Mr. Chairman, I would also inquire as to why 

these are just guidelines, and that they are not in your regulations?

Mr. Bilirakis. Well, even going further than that, the Inspector 

General’s report that I referred to earlier of November of 2005 indicated that there were some problems potentially, security problems. 

And you know, that was a half a year ago, and this has taken place.

 General Howard, I am not going to get into that with you now, but 

come on, you are a general officer, and there is no way that when you 

were on active duty, that you would allow this to happen, and would 

not have taken care of the problem when you were notified by the 

Inspector General. It is something, again, that goes back into the 

culture kind of thing.

 I am going to recognize Ms. Herseth, and I am going to excuse the 

Inspector General. But Sir, I am very much concerned what can be 

done. Because again, I have said this, what, for the third time, over 

24 years that I have been here, similar things have arisen, and it 

seems like an awful lot of it has come from—you don’t like the word 

“bureaucracy.” I don’t know whether you like the word “culture.” 

But it is culture, and an environment there, and whatnot. And Mr. 

IG, I would hope you can help us solve that. I know we have got civil 

service, those particular problems.

Can you respond very quickly? Do you mind very much, Stephanie? Go ahead, sir.

Mr. Opfer. Mr. Chairman, let me just say from the IG’s perspective what we are doing. Once this came to our attention that we had 

a serious breach of security, I initiated a criminal, investigation and 

an administrative investigation, and tried to gather all the rules and 

policies and procedures in the department.

 There are three prongs to our approach. One is looking at the theft 

of the data. Two which may answer some of the questions that were 

posed by the Committee members—we are looking at the incident: 

what happened when the employee reported it? Who did he report 
41

it in to? What did they do with the information? All the way up to 

the top levels of the department. That is part of our administrative 

investigation.

 I have the Counsel to the Inspector General looking at all the policies and procedures, and we intend to review all those policies and 

procedures, we are looking not only at the policies and procedures for 

the department—are they only geared towards someone in IT, when 

there is hacking into the system, or attacking the system? But also, 

what policies procedures What do we have regarding employees and 

their access to data? And what are the authority? Who is supervising it? Who is reviewing the need to have access to that material? 

We hope to conclude that in our Inspector General review.

Mr. Bilirakis. When do you anticipate that being completed?

Mr. Opfer. We are going to try to—separating the ongoing criminal investigation and working with the Federal Bureau of Investigation and Montgomery County police, and the Department of Justice, 

keeping that separate because as you know, ongoing criminal investigations limit my ability to discuss and provide information.

Mr. Bilirakis. Sure.

Mr. Opfer. I have separate teams working on all of the other ones. 

My goal is to try to have that out in 45 days.

Mr. Bilirakis. Forty-five days. Would you share all that information with this Committee directly?

Mr. Opfer. Yes, sir. Right now, my thought would be that we 

would have a number of recommendations, and a report would be addressed from myself as the Inspector General to the Secretary, and it 

would be provided to the Committee, and the members of the Committee.

Mr. Bilirakis. Would you be able to also share with us suggestions? 

I mean, I don’t know if you agree with me. I keep throwing this word 

“culture” around. I don’t know if you agree with me or not, but I think 

it is there, I think it is a problem, and otherwise a lot of these things 

would not be taking place. Could you share with us maybe your suggestions on how that can be improved?

Mr. Opfer. Yes, I think there is a good opportunity now, with the 

Congress enabling the agency, to centralize the IT function and give 

the authority and the responsibility to one individual to coordinate 

that. That was one of the recommendations for years from the Office 

of the Inspector General.

 Mr. Bilirakis. Okay.

Mr. Opfer. So we continue to be pleased with that—

Mr. Pittman. Will you share that with us within that 45 day period 

of time, too? Any suggestions—

Mr. Opfer. —we expect that in the FSM audits that we will continue to have those material weaknesses until they are corrected within 

the agency.
42

Mr. Bilirakis. Exactly. Exactly. Thank you, sir, and you are excused, and we appreciate very, very much your hanging around.

 Ms. Herseth to inquire.

Ms. Herseth. Well, thank you, Mr. Chairman. I appreciate the 

questions you posed to Mr. Opfer, because I think that review will 

answer some of the questions that had been posed previously and 

that I have as well. But let me make a couple of initial observations, 

and then get to a couple of the questions about the IT system now, 

and how it’s working.

First, I think we do need some clarification from the Secretary, 

because I specifically wrote down during his testimony that he indicated that the VA Inspector General became aware of this on May 

10th. He may have misspoken and meant the information security 

officer, or perhaps he was under the impression that this information 

had been communicated to the IG, which it hasn’t, but we need some 

clarification on the issue.

 Also, it’s my understanding based on your testimony and the questions posed in your responses that the reason that the VA has not 

formally notified the IG even as of this date is because it is not a cyber 

security issue in your opinion, it is a privacy issue; and therefore, it 

is being handled by an office, a division not currently represented 

today.

 Secondly, I shared Ms. Brown-Waite’s concern that we have to address this issue of something being a guideline versus a directive, 

as it relates to any employee in the VA being permitted to take this 

information outside the workplace, getting the permission, having 

encryption, because I think someone made a note in particular that 

that is a guideline, not a directive.

So let me ask two questions. The first is very straightforward. If 

one of my constituents who is concerned that his or her information 

is among the 26.5 million records within what was stolen and he or 

she calls the 800-number, will the person answering that number be 

able to tell him or her whether or not his or her records were among 

the 26.5 million records were stolen?

Mr. McLendon. To do that would be to provide this people access 

to the Burles system and other databases, for which they may not be 

authorized to be accessed. So the short answer to your question is no, 

they would not have access to that.

Ms. Herseth. So they won’t know until they receive the letter of 

notification from the VA?

Mr. McLendon. That’s why we are sending the letters. And let me 

also add, people keep talking about 25 million records. 19 of those—

million of those records have Social Security numbers. 6 million do 

not have any identifying Social Security numbers.

Ms. Herseth. Okay.

Mr. McLendon. And of the 19 million we believe that there are a 
43

number of those veterans are deceased, because when we look at the 

birth dates of a number of them. So there is effort going underway to 

try to understand of that 19 million—

Ms. Herseth. I appreciate that. I appreciate that. So what the information that one of my constituents would get by calling 800 number is just the recommendation to monitor their credit?

Mr. McLendon. Yes, they are getting direction on what they need 

to do.

Ms. Herseth. Okay. And we do not have a time frame yet as to 

when those letters would go out, or did you mention that earlier and 

I missed it?

General Howard. No, I don’t think—yeah, I don’t—

Ms. Herseth. Because you still have to analyze all of this data? 

Okay. Let me move to—

General Howard. To elaborate, though—

Ms. Herseth. I am going to let you elaborate. I just want to make 

sure I get to this third question. And if there is time, the Chairman 

permitting, please elaborate. I mean, there is so much information 

that we do want here. We are just under these time constraints.

Five, six years ago, I was practicing law at a very large firm here 

in Washington, a firm that has a global presence, number of offices 

across the country. I could not save a document, any client identification numbers on a disk. We didn’t even have hard drives in our desk. 

But what we did have if we were going to do any work outside of the 

office was a secure ID that changed, as you know, every few seconds 

so that when you are home, or on your laptop, that you have that ID

number that you type in that is only available—you know what I am 

talking about.

General Howard. Yes, ma’am.

Ms. Herseth. Do you have that? Is that a process that you are 

utilizing, that you are integrating over time? I just don’t understand 

why any employee would be able to save anything onto a desk or an 

external hard drive, and maybe that is part of where we are heading 

with a centralized IT system, but it just seems that a five or six years 

ago, and I note it is a difference between a private sector and a public 

sector and different resources, but are we moving in that direction, to 

have a system like that in place?

General Howard. We definitely need to improve on the procedures 

that you just described. The specific drive that this information was 

stored on, the folder is protected. In fact, I physically tried to get into 

it myself, and I could not do it. Dennis, you can probably comment 

on—

Ms. Herseth. Okay, I appreciate knowing that there is a firewall 

or two that the thieves would have to get through here. But do you 

have—

General Howard. Ma’am, not the information that was on his 
44

drive. I am talking about where he originally took it. The drive that 

was stolen, as far as we know the information was not encrypted.

Ms. Herseth. All right, okay. Okay, thank you for the clarification. Of the 1600 telecommuters, are they access saying the system 

remotely in the way that I just described? With a secure ID, into the 

centralized system?

Mr. Pittman. No, ma’am. The only thing that they are doing is 

they are accessing the computer by logging onto the system via a 

security access password.

Ms. Herseth. Okay. I have more questions, but I will submit them 

for the record. Thank you, Mr. Chairman.

[The statement of Ms. Herseth appears on p. 87]

Mr. Bilirakis. Thank you, gentle lady. Mr. Michaud.

Mr. Michaud. Thank you very much, Mr. Chairman. I also want to 

thank you for having this hearing.

 Most of the questions have been asked, but I just want to follow up 

on a few of them. As we read and heard the IG state, that this condition has been going on for a number of years as far as the security 

deficiencies and in his testimony, he says in the 141 of the 181 VHA 

facilities, they identified security deficiencies, as well as in 37 of the 

55 VBA facilities. You heard the Chairman talk earlier about former 

secretary Principi giving the directive, then the legal counsel saying 

they did not have the authority to do that.

 Whether they have the authority or not, I guess this question would 

be for Mr. Duffy, wasn’t that a good idea, what the IG had talked 

about, on these deficiencies? Regardless of whether, they had the 

authority or not? If it is a good idea, why not implement it?

Mr. Duffy. Absolutely, Congressman. And we thought we were indeed implementing them. In this particular instance, it was an individual who violated policies and procedures, who clearly understood 

that what he was doing was inconsistent with established policies 

and procedures, someone who had in recent months completed cyber 

security awareness training and privacy act training. So there are 

indeed policies and procedures in place. There is heightened awareness through standard annual training for all employees who are involved in this kind of work. In this instance, we had an individual 

who simply chose to use poor judgment and violated those policies 

and procedures.

Mr. Michaud. As you heard the Secretary mention earlier this 

morning, someone has to be responsible if something happens in this 

situation as far as identity theft; has there been—and clearly this is 

a severe case—has VA heard of identity theft in past from veterans? 

And if so, how many of those cases that are out there on a yearly 

basis?

Mr. McLendon. Not personally aware of any, Congressman.
45

Mr. Michaud. Okay, thank you. My next question, we heard a lot 

from different individuals here on, you know, what did you know, 

when did you know it, and could you give the details? Actually, I

haven’t heard Mr. McLendon, when actually did you know it? What 

did you know, when did you know it, and can you give, some details 

of that timing?

Mr. McLendon. Well, I knew before 6:00 o’clock on Wednesday that 

there had been a break-in at the individual’s home, that he had reported that he had lost his personal computer and an external drive. 

At that time, the way he communicated, it also sounded like he had 

lost a little external USB drive, that we would call a memory stick, 

and some CDs. He was quite upset at the time, so that’s one of the 

reasons why I called the guy who’s our technical expert on data and 

systems to see if he could talk more in a technical terminology to try 

to pull out of him a little bit more.

 So we knew on Thursday that something indeed had happened. 

We did not know the scope of it, or any of the details of it. And so 

when we began meeting with him on Friday morning, and then our 

information security manager met with him, we began to get I would 

say a broader outline, but yet not the details out exactly what was on 

those disks.

 It’s fair to say that it wasn’t until Monday that those of us who had 

been talking together and talking with him could kind of look at each 

other and say, “Okay, we believe we’ve got kind of the initial look at 

what we think may be there.” And that’s when a memo was prepared 

that, as Mr. Duffy explained, where it went and what had happened 

after that. Then the information security officer had further discussions with him. I don’t believe that we all understood the details, in 

terms of 25 million records, some of these other things, until we understood that his disk had not been stolen and his memory stick was 

not gone. There was some confusion about that right after he started 

talking about it, which is understandable.

And then we started painstakingly going through those of files to 

understand what files there were, what data variables there were, 

related to each one of those files. That’s what led to again preparing 

a memo on the 16th, which went to the general counsel on the 17th, 

which laid that out.

Sometimes it takes a finite period of time to do the due diligence 

to find out exactly what is on those files and where could they have 

possibly come from.

Mr. Michaud. Thank you. Thank you, Mr. Chairman.

[The statement of Mr. Michaud appears on p. 82]

The Chairman. [Presiding] Has everyone asked all the questions?

Mr. Filner. If I could just follow up for a couple minutes?

The Chairman. Sure, Mr. Filner.
46

Mr. Filner. Thank you, Mr. Chairman. Just to follow up on Mr. 

Michaud’s questions, in the time line you provided to us, you said 

there was a memo on May 5th that says “possibly lost veterans’ data.” 

We don’t have a copy of that, but what did you think, then, that was 

lost?

Mr. McLendon. That may have been an original memo that the 

information security officer prepared. I don’t have that in front of me. 

I’ll have to go get that but I—

Mr. Filner. I was just wondering what you knew at that moment.

Mr. McLendon. Well, what we knew at the afternoon of the fifth 

was that there had been a break-in at the individual’s home, that 

he had self-reported that his personal laptop and personal external 

drive had been stolen, that he believed that he had loaded some veterans’ data, if I remember the words right, onto that. But he didn’t 

know for sure, and couldn’t say in any detail what may or may not 

have been on there.

Mr. Filner. Mr. Duffy, is that your understanding of that, this 

memo that you provided Mr. Bowman? I’m just reading from your 

time line.

Mr. Duffy. Yeah, let me back up a little bit. And I apologize because there is just a little bit of confusion regarding memos. There 

was an original memo prepared by the IT specialist, our security and 

privacy officer, late in the afternoon of May 5th.

The Chairman. His name?

Mr. Duffy. I’m sorry, his name? Mr. Mark Whitney. Mr Whitney 

prepared, at my instruction, a memo that attempted to lay out what 

he understood to be the data sets and elements. And indeed, I think 

he did a pretty good job. Mr. McLendon and I, upon reviewing it, Mr. 

Mclendon asked for the opportunity to review and validate the information. Again, while Mr. Whitney is our IT support person, he does 

not necessarily have detailed understanding or information on the 

data sets or data elements. So Mr McLendon and Mr. Tran indeed 

did that, modified slightly the May 5th memo. It was finalized over 

the weekend and provided to me on May 8th. The unfortunate thing 

is that the date of the memo was never changed. So we’ve got two 

May 5th memos; one more expansive than the other, simply clarifying the nature of the extracts, the type of programming language that 

they were contained in, and further detail than the previous memo. 

So it was that memo that was—an original memo on the fifth, modified on the eighth, provided to the chief of staff on the—discussed 

with the chief of staff on the ninth, and given to him on the tenth.

Mr. Filner. And the chief of staff is directly under the secretary?

Mr. Duffy. Yes, sir.

Mr. Filner. But everybody took the weekend off on the sixth and 

seventh, it looks like. Normal weekend in your life, 25 million things 

gone, what the hell?
47

Mr. McLendon. Congressman, I can assure you that there has 

been a deep sense of urgency about—concern about this issue, and 

working on this issue.

Mr. Filner. Except that Friday you did something and then you 

waited till Monday to do it more, you know, Saturday and Sunday, 

nothing done, according to what—I am just going by what you provided us.

Mr. McLendon. Well, that was just the date that was put on it was 

Monday, that was the first working day back.

Mr. Filner. You can detect the frustration and the outrage in all 

of our voices. And again, I mean I don’t think you took it seriously 

enough at the beginning, this chief of staff and the deputy secretary 

knew a week before they decided to tell the Secretary. In addition, 

even given all that, the so-called outreach to our veterans, you know, 

you say, “Well, if you have a Website, look us up. Notify your bank, 

notify your credit bureau. Don’t tell us, we don’t need to know if you 

guys have a breach of security.”

 I mean, there is no outreach in the letter that is going to go out. As 

somebody said, you don’t even have 26 million envelopes. I mean this 

is ridiculous. I mean, I think you all should be fired. To take this as 

un-seriously as you have, to take the amount of time that you took, 

and then still, even at this late date, you don’t have a system where 

anybody even knows that their name was there. There is no outreach 

for people who—the normal person who may not know how to get 

your Website. Nothing is being done on television, radio.

 I mean, you are just waiting, you know, to get this information—

these guys are scared to death. And you sit there—you don’t seem to 

want to understand that. And you give these bureaucratic answers 

that don’t mean anything to the people we are trying to serve here. 

As one of the Congresspeople said, if this happened in our staffs, I

mean, they would be fired right away. And I think the Secretary, as 

the last act before he resigns, ought to fire the whole bunch of you.

The Chairman. I think what would be helpful to us is Mr. Duffy, 

if you could submit to the Committee, I would like the draft—I don’t 

know if we ought to call it the draft—the original memo from Mr. 

Whitney—

Mr. McLendon. The May 5th?

The Chairman. The original memo, I want to see what that one 

says. I want to then see whatever changes that were made.

Mr. McLendon. Right.

The Chairman. I want to compare the two documents.

Mr. McLendon. Reflected on the eighth. Happy to.

The Chairman. Yes. And then that ends up to the Secretary’s Chief 

of Staff on May 10th. At some point, the Chief of Staff notifies the 

deputy secretary, but almost another six days go by before anybody 

even alerts the Secretary. You know, what we have here is a chro-
48

nology, but the Secretary, because it has got a lot of other personal 

identifying information in it, has asked us not to have this put in the 

record. But I think what we are going to need to do here is, with my 

indulgence, is let me take and ask these witnesses to put a time line 

on the record in their testimony. Is that all right, my colleagues?

 So Mr. Duffy, let’s just begin with you. I know you did this a little 

bit earlier, but let us go ahead and take your time line from the first 

moment that your department had knowledge and Mr. McLendon, I

want you to add in. And then we are going to turn to the other witnesses with regard to the time line as they know it.

 Well, let me pause. I am going to seek counsel. You can do this a 

thousand ways. We can either do it day by day and take the testimony of them on what they knew, or we can do witnesses. Mr. Filner, 

what do you want to do? All right, we will turn to Mr. Duffy. Hold 

on.

Mr. Bradley. Mr. Chairman, could I ask a quick question where I

was not able to follow up on my time frame?

The Chairman. Absolutely.

Mr. Bradley. If you recall—and thank you very much, Mr. Chairman—if you recall my questions from before about the authority to 

reimburse veterans for credit counseling and credit checks, you indicated that you had that authority. That’s correct, okay. The bulk of 

the phone calls and e-mails that my office has gotten have expressed 

a concern over the fact that it may cost fifty to sixty dollars to actually do that kind of a credit check right now. So if you have authority to do that, are you prepared to propose to us, today, that you will 

actually establish some mechanism for veterans who have to have 

expenses out of pocket to do a credit check, of a mechanism for them 

to be reimbursed for these expenses?

General Howard. Sir, in discussions this morning before we came 

over here, that is the intent of the Secretary, but he was concerned 

about to ensure that we have the authority. There are financial impacts that need to be addressed. It is actively being discussed.

Mr. Bradley. So it is being discussed, you have the authority. 

When can we expect a decision on how you are going to implement 

that kind of reimbursement?

General Howard. Sir, that I’m not sure.

Mr. Bradley. If I can ask the indulgence of the Chair. Mr. Chairman, in terms of the immediate impact on the 26.5 million veterans, 

which I think all of us, under your leadership and under Mr. Filner’s 

leadership on a bipartisan basis, want to make sure that we have 

done everything that we possibly can to insure the safety and sanctity of their records. The most expeditious manner that these gentlemen can make that kind of reimbursement possible, to me would 

seem to be one of the most important first step that we can do for the 

26.5 million veterans that are affected, to say nothing of all of these 
49

security measures that have to go into place, but for those people that 

are worried, on an individual basis, and I would urge that we attack 

that head-on with obviously their assistance.

 And I thank you for that.

The Chairman. All right. Here is what we will do. To preserve 

time, I am going to ask you to prepare a chronology, time lines, I want 

each of you to prepare that, excepting personnel, unless you have 

something to add that we don’t know about.

Mr. Pittman. No, sir.

The Chairman. Okay, thank you. So with the rest of the witnesses, 

I need to know the chronology: what did you know, when did you 

know it, and how it got passed along, okay? So provide that, then, to 

the Committee. That is the best way, I think, to do this. Can you get 

that to us in about 10 days?

General Howard. Yes, sir.

Mr. Baker. Yes, sir.

Mr. Duffy. Yes, sir.

The Chairman. All right, thank you.

 With regard to the data analyst, who is his immediate supervisor?

Mr. McLendon. His immediate supervisor is Mr. Mike Moore.

 The Chairman. Mike Moore. And then who is his boss?

Mr. McLendon. Me.

The Chairman. You. I apologize, I was gone. The project which 

they are working on was what?

Mr. McLendon. [Stricken upon request of the Chairman]—The 

individual is—

Mr. Bilirakis. Strike the name.

The Chairman. Pardon?

Mr. Bilirakis. Strike the name.

The Chairman. We are going to strike the name of the data analyst 

from the record.

Mr. McLendon. The analyst is a programmer, statistician, he supports a number of different projects in the office that are ongoing. He 

was doing work looking at a national survey of veterans project. He 

was also doing some matching to support other projects he was supporting in terms of activities that other people in the office were doing 

during that time.

The Chairman. Are you aware of any of your employees taking data 

home with them to do, quote, “homework?”

Mr. McLendon. Not to my personal knowledge. But I would say 

this to be quite candid: we in government today facilitate, encourage, 

and reward people for working from home. We give them computers 

to do that, we give them access to do that. Each agency allows them 

to—has their own policies about how they do that and when they do 

that. But it is not our policy to encourage people to take work home, 

or to take data home.
50

The Chairman. How many employees does the VA have that work 

from home and access your data bank?

General Howard. Two different numbers, Sir. Work from home is, 

what was it, 1600?

Mr. Pittman. Those that are the telework employees are 1600. Then 

there is another group of virtual employees, which he’ll address.

The Chairman. And encryption is used?

Mr. Pittman. It is not.

General Howard. Sir, if they access—

The Chairman. I apologize. I was just told that has already been 

asked and answered. In the negative, shockingly. Do you, Mr. 

McLendon, know whether or not the data analyst’s supervisor approved of the practice for this individual to take this type of data out 

of the office?

Mr. McLendon. No one would have approved that.

The Chairman. Okay. But you encourage people to do homework?

Mr. McLendon. Don’t encourage people to do homework. What 

I am saying is that when people are allowed to telework from home 

you have to be extremely careful about what people do, and what 

they use. And it is not my policy or anyone I know of, has a policy 

that allows people to take serialized, controlled information of people 

home, or veterans home, to do work. That’s a no-no in the analytical 

business. You just don’t do that.

The Chairman. Let me ask General Howard, if I go back to this 

directive from the Secretary Principi, had the CIO been charged with 

this responsibility over security as the Secretary wanted, you think 

this would have happened?

General Howard. There is a memo that I saw signed by Bob McFarland. I don’t recall exactly what it said. One of the—and I do 

know that one of the difficulties that they were trying to sort out is 

just what exactly the authority was. There was a lot of discussion 

about the word, “ensure,” that’s in Secretary Principi’s directive—I

think that’s the one that it’s in, sir—and if I’m not mistaken, was a 

keyword that the general counsel addressed.

 The bottom line—again, I don’t remember the exact details of the 

memo from the General Counsel, but it is obvious to me that the CIO

has authority to set policy, to set the guidelines, but then it’s up to 

the individual who supervises, administration heads, and assistant 

secretaries, to implement those policies.

The Chairman. But see, had this been enacted, then you had the 

enforcement power. Now, you can’t enforce cyber security. You can’t 

do anything, all you can do is do compliance; correct?

Mr. Cadenas. That is correct, sir, check for compliance.

The Chairman. And so under a decentralized model, for which Mr. 

McLendon, Mr. Duffy—well, strike Mr. Duffy—for which Mr. McLendon I know has argued, that enforcement, that is where it goes, it is 
51

decentralized.

So let me just say this gentleman, one of the first things I learned 

in the Army: when you take command, you want to know who the 

key control custodian is, because you just signed personal responsibility for all that property. Under a decentralized model, you have 

too many keys.

General Howard. Sir, I will say that the federated model that has 

been adopted, as you know, will give us a better capability. It won’t 

give us the ultimate capability—

The Chairman. Yes, that’s right. You are going to get a half-baked 

loaf.

General Howard. —but it will help to some degree to get a better 

handle on it.

The Chairman. So let me ask this. You are the acting CIO, and I

am going to turn to cyber security. I have done hearings with you 

before, and those hearings dealt with the hackers from the outside, 

“Oh, we spent all this money,” but you also came, and with the IG

and GAO, you talked about all the unauthorized use of employees, 

you talked about that.

 So to go beyond just compliance—or if you are going to say, “Steve, 

no, my job is only to do cyber security. That from the outside, somebody else should do that,” give us your best counsel, the two of you, 

right now with regard to authorities and enforcement. You are a 

general officer. Does dissemination work very well in the Army?

General Howard. Very well, sir.

The Chairman. Dissemination?

General Howard. We also—

The Chairman. Somebody has got to be in charge with distinct lines 

and chains of command, right?

General Howard. Sir, there’s no question about that.

The Chairman. All right.

General Howard. And one thing that we do have, as you know, 

sir, in the Army, is very clear regulations. As I mentioned earlier, 

we’ve looked for the clear policies and directives, and with respect to 

what the individual actually did, the only place I can see that is in a 

guideline. It’s not a directive or a regulation that you would think it 

should be. It is being turned into a regulation, or a directive. The VA

uses the term, “directive.” That is being accomplished without any 

more waiting.

 But it’s too late for that. I mean, the incident occurred, and it was 

not clear that this was a violation of a directive, because it wasn’t a 

directive at the time. But what you described, it has to be straightened out. Clear directives do need to be put into place. As I said 

earlier, the federated model is helping a great—we’ve only been into 

it for a short time, as you know, but it’s already helping to shed light 

on some activities that are going on that need to be tightened up.
52

The Chairman. General, if you were to have adopted the federated 

model you let the individual stovepipes to do their own development, 

you don’t own development under the federated model.

General Howard. That’s right, sir.

The Chairman. That is where the problem has been occurring. In 

software development. Wasting millions and millions of dollars. That 

is why we have come in and zeroed out programs. We are extremely 

upset. It is why we on a bipartisan basis have asked for you, your 

position to be empowered.

 So you are correct. You can look at this and go, “Well, directives 

weren’t violated.” This is bigger than a small, little employee—

General Howard. They weren’t violated, because they didn’t exist.

The Chairman. Well, this Committee is not going to permit an Abu 

Graib, whereby you prosecute the little people, and others don’t have 

problems. We are going to work with you. We are going to work with 

you, on policies, and practices, and procedures, and empowerment. 

And we are going to also—we may use this to get a stronger hand 

around the development side of the house.

General Howard. Sir, can I comment on the term, “enforcement?” 

I don’t think you will ever get away from the fact that individuals in 

charge of organizations are clearly in—responsible for implementing 

the policies, and enforcing the policies. We have a greater role in 

determining if violations may have occurred, inspections, that sort 

of thing. But I don’t think we should ever remove the enforcement 

responsibility from those actually in charge of administrations and 

staff sections. We didn’t operate that way in the Army, either. The 

commander was in charge.

The Chairman. Mr. Cadenas, what do you have to add to this?

Mr. Cadenas. All I can say, sir, is in the three years, six months 

that I’ve been here at the VA, it’s been a little frustrating and challenging for us, and the team. We’re looking forward to good things 

with the federated, as I said last time when I was up here, because 

now those systems will go under the leadership of of the CIO, and because he now owns those systems and I work directly for him, I don’t 

need any authority to execute.

 There—you know, we try the best we can. The reason why you see 

so many guidelines is because where we can’t get policies or directives 

pushed through, then we go down to the next level, and then the next 

level, to where we are successful in getting guidelines out there.

The Chairman. Under this federated model, will you receive the 

necessary delegated authority from the Secretary to do your job so an 

incident like this will never occur again?

Mr. Cadenas. Sir, to be honest I won’t need his authority because 

I directly report to the CIO’s office. And under the federated model, 

the CIO is in charge of all the operations and maintenance systems, 
53

to where he can tell me, “I got a problem out there, go fix it now with 

your team,” or ensure or enforce compliance or execution.

The Chairman. But on the development side of the house?

Mr. Cadenas. No, sir. Not on the development.

The Chairman. Yes, that is my point.

Mr. Cadenas. But we’re working—

The Chairman. That is what I want to make clear to all the members. On the development side of the house—we can go with the 

federated model, but this will continue.

 All right, does anyone have any follow-up questions?

[No response.]

 All right, we are going to continue our hearing at a later date. I

thank you for your testimony. This panel is now excused.

Mr. Filner. Mr. Buyer, I just want to thank you for your knowledge and your commitment to follow through. We will follow your 

lead. I appreciate it very much.

The Chairman. The second panel will please come forward.

 The second panel is three representatives from the private sector 

to shed light on the implications of the failure of the Department of 

Veterans’ Affairs to control information management. Going from 

left to right, we have Mr. Stuart Pratt, President and Chief Executive 

Officer of Consumer Data Industry Association. Next, we have Mr. 

Dennis Hoffman, Vice President for Information Security for EMC 

Corporation. And finally, we have—

Ms. Litan. Avivah Litan.

The Chairman. You say it’s pronounced—

Ms. Litan. Avivah Litan.

The Chairman. Pull it close, really close.

Ms. Litan. Oh, sorry. Avivah Litan.

The Chairman. Avivah Litan?

Ms. Litan. Litan.

The Chairman. Thank you. Vice President and Business Director 

for Gartner Incorporated. I would also like to mention that we have 

Joel Winston, associate director of the FTC’s privacy and identity 

protection division, and Betsy Broder, assistant director of the same 

division, in the audience today. Both are members of the Identity 

Theft Task Force, and have been listening to the testimony. They 

will be available for any questions that any members may have following the hearing.

 We look forward to hearing from our panelists on how we can ensure the safeguarding of sensitive information to re-earn the trust of 

veterans and their families.

STATEMENTS OF STUART K. PRATT, PRESIDENT AND 

CHIEF EXECUTIVE OFFICER, CONSUMER DATA INDUSTRY ASSOCIATION; DENNIS HOFFMAN, VICE PRESIDENT 
54

OF INFORMATION SECURITY, EMC CORPORATION; AND 

AVIVAH LITAN, VICE PRESIDENT AND DISTINGUISHED 

ANALYST, GARTNER, INCORPORATED

STATEMENT OF STUART PRATT

The Chairman. Mr. Pratt, you may begin.

Mr. Pratt. Mr. Chairman, thank you for this opportunity to appear before you, and thank you also—

The Chairman. Thank you. To all the witnesses, if you have written statements—do all of you have written statements?

Mr. Pratt. Yes, sir.

The Chairman. They all acknowledge in the affirmative. It will be 

submitted for the record. And if you would, please summarize.

Mr. Pratt. Thank you, Mr. Chairman.

 This past weekend, CDIA was contacted by the Federal Trade 

Commission regarding this breach. We are thankful for the FTC’s 

outreach to us which allowed CDIA to liaison with our national credit 

reporting company members, who had to plan for likely heavy call 

volumes on their toll-free numbers, and hit rates on their Websites.

 Based on this contact, our members technology teams were ordered 

in preparation for the announcement on Monday, May 23rd. And as 

part of this very late stage coordination, our members also voluntarily either adjusted current toll-free number menus to include special 

referents for affected veterans, or implemented entirely new toll-free 

numbers which can be used by veterans to request the placement of a 

fraud alert on their credit reports.

 Once a fraud alert is placed, a veteran is then by law entitled to a 

copy of his or her credit report, free of charge. Our members report 

that subsequent to the announcement by the Veterans’ Administration and ensuing media coverage, the call volumes have been running 

at approximately 170 percent over normal volumes.

 If we had a criticism of this process, it is simply the fact that our 

members were not consulted sooner by the Veterans’ Administration. 

We appreciate however the fact that the FTC did contact us, and they 

were embargoed in terms of when they could get in touch with us to 

begin coordination.

 Even over the weekend, the FTC was not permitted to release the 

name of the agency: and thus our members could not execute plans to 

customize toll-free number service until after 11:00 a.m. on Monday, 

May 23rd. We believe government agencies should be obligated to 

coordinate with their members well in advance where they intend 

to publish advice, which includes our members contact information. 

This is simply the right step to take so that our members can verify 

the accuracy of the information and ensure that our systems are prepared for the increase in contact volume. Ultimately, this obligation 
55

helps us all serve those who are affected.

 Your staff has expressed interest in hearing what steps we would 

recommend that a veteran take in response to the announcement, 

and our views on the key steps are really no different than those 

which the FTC has already compiled. We believe consistency in a 

message is very important at this stage, and that all veterans are 

empowered to take the steps that are appropriate to the level of risk 

they perceive. And these include of course placing a fraud alert.

 We would only add emphasis to the FTC’s point that veterans need 

only call one national credit reporting company to place a fraud alert, 

since our members exchange fraud alert requests. Further, upon 

placement of fraud alerts, veterans are entitled to a free copy of a 

credit report and will receive instructions on how to order this. Some 

veterans may be confused about whether or not they need to annualcreditreport.com to obtain this free report, and the answer is they do 

not. They will receive specific instructions once their fraud alert has 

been placed that will allow them to access that credit report as well.

 As demonstrated by this breach—

Mr. Filner. May I just ask you a question? Sorry to interrupt 

you.

Mr. Pratt. Yes.

Mr. Filner. Could the VA do that for every veteran right now? 

Would you recommend that? Why are we relying on the people who 

are suffering? Why don’t we take a proactive step?

Mr. Pratt. It is a balance sheet question, Congressman, so let me 

give you both sides—

Mr. Filner. It could be done though, right?

Mr. Pratt. The law does permit a third party to make that request 

on behalf of the individual. Yes, sir.

Mr. Filner. And what are the minuses?

Mr. Pratt. I am sorry, sir?

Mr. Filner. You said there are pros and cons.

Mr. Pratt. The only con is that a fraud alert stops transactions, 

slows transactions down, and you may find there are veterans in the 

middle of refinancing a home, obtaining credit, and they may not appreciate the fact that it was inserted right in the middle of that process. It is a balance sheet question that we all have to wrestle with, 

Congressman. I think that is as good as I can do.

The Chairman. You may proceed.

Mr. Pratt. Thank you, sir.

 As demonstrated by this breach, data security and the need to notify consumers, including the nation’s veterans, where significant 

risk of harm exists, it is essential. The following statement delivered 

before other Committees is still our position today:

 The discussion of safeguarding sensitive personal information and 

notifying consumers when there is a substantial risk of identity theft, 
56

has expanded beyond the borders of financial institutions. It is our 

view that a rational and effective national standard should be enacted, both for information security and consumer notification, as it 

applies to sensitive personal information, regardless of whether the 

person is a financial institution.

 At this Committee knows, there are a number of House and Senate Committees that are focused on developing uniform national 

standards. We believe enactment of national standards will ensure 

that sensitive personal information is protected by all who possess it, 

including Federal and State government agencies. New nationwide 

safeguards regulations, offered by the Federal Trade Commission 

will compel all to deploy physical and technical safeguards strategies for this type of information. As we head into the Memorial Day 

weekend, we must redouble our efforts to pass strong and effective 

national law that will require all to secure sensitive personal information properly, and to notify consumers when there is a significant 

risk of identity theft. We should do no less for our veterans, who have 

served us all. Thank you.

[The statement of Mr. Pratt appears on p. 107]

  The Chairman. Next is Mr. Hoffman.

STATEMENT OF DENNIS HOFFMAN

Mr. Hoffman. Mr. Chairman, members of the Committee, thank 

you for the opportunity to testify before the Committee on Veterans’ 

Affairs. My name is Dennis Hoffman. I am the Vice President of 

Information Security for EMC Corporation. For those of you who 

aren’t familiar with the EMC Corporation, we are the world’s largest provider of storage and information management solutions. Our 

Fortune 1000 customers include the top 30 commercial banks, the top 

40 insurance companies, 19 of the top 20 pharmaceutical companies, 

all of the top aerospace and defense organizations, and 14 of the top 

15 health care medical facilities, and many others.

 I have personally spent a great deal of time with our customers 

over the past year discussing issues like the one this Committee is 

investigating, and today I can report to you all that the veterans’ administration is not alone in wrestling with what is clearly becoming a 

very pervasive issue, which the industry calls “data leakage.”

 While the identity theft problem continues to make headlines, due 

largely to regulation causing it to be made public, it may well be the 

tip of the iceberg. Relative to all confidential information that organizations and corporations have, personally identifiable information 

is actually a minority problem. It is however the one that is making 

front-page news, and is the one that of course you are investigating. 

My point is that there is a lot more confidential information in the 
57

world, and it is all subject to the kinds of problems that you talked 

about here.

 So I think it is fair to ask why do these problems exist? They exist 

largely, from a technical perspective—as you have heard today, this 

is certainly not simply a technical problem. But on the technology 

side, they exist due to something called perimeter-centric thinking.

 In the sense that from the days of medieval Europe, the notion of 

security has been largely to dig moats, build walls, erect castles, erect 

towers inside the castles, and believe that what is inside the tower 

ought to be safe. That is largely the way that we have gone about 

doing information security, from a technical perspective. The irony 

is that the vast majority of products which make up the information 

security marketplace today don’t protect information. They protect 

assets that are supposed to protect information.

 I can almost guarantee you that the laptop we have been discussing 

all morning had antivirus software on it. That is the single largestselling security product in the marketplace today. And of course, it 

has nothing whatsoever to do with protecting the data on the laptop. 

Moreover, what this has led to is it has led us to conclude, or ignore 

the simple fact that information lives, has a life cycle. And during 

that lifecycle, it moves. And when it moves, it tends to walk right out 

of the castle. And therein lies the big issue.

 It is not simply a laptop. It could be a USB device. There have 

been many publicized cases of backup tapes falling off of UPS trucks. 

When data leaves security parameters, it becomes exposed if we 

haven’t done something to secure the information itself. And so what 

we are seeing in talking to a lot of our customers is a very significant 

shift in thinking to something we would call information-centric security, ironically enough, where we actually begin with the notion of 

securing the information, and then applying security to all of the assets through which the information has to pass.

 That means four basic things: we have to understand our data and 

our people as organizations, because at the end of the day, we don’t 

have information until data reaches a person. So we must be able to 

model both of those and control those. We need to secure the information infrastructure that manages and stores the information. We 

need to protect the data comprehensively. To date, we have been very 

focused on the availability of information, and not nearly as focused 

on its confidentiality and integrity. And it takes all three to truly 

secure information. Lastly, we need to assure policy compliance.

 There are no silver bullets. This is a systemic problem, and it requires a systemic solution, which you have been investigating all 

morning, particularly around policy and process and people. And 

in particular, I would like to warn that a knee-jerk reaction to encryption as the silver bullet will likely miss the point, to the extent 

that encryption is only one technology, and it is only as good as the 
58

business problem it solves. If the encryption keys are not managed 

appropriately there are even more problems because the data has effectively been deleted when it was encrypted. If they keys cannot be 

shared, collaboration is slowed down.

 Encrypting data makes it opaque. It makes it impossible to actually know what is inside it. So a recent regulation in the UK—or was 

it a regulation that existed previously, was recently enacted, to make 

certain that all enterprises in the United Kingdom turn over their 

encryption keys to the government so the government can at least 

look at what the data is.

 There are many problems, and there is no single silver bullet solution. There are however some very significant critical enablers, and 

you can put these all under the very general heading of “you can’t 

secure what you can’t manage.” You cannot secure information that 

cannot be managed. These fall under the heading of things like infrastructure consolidation. When data is spread everywhere it becomes 

extremely difficult to stop leaks. 

Content management is a technology that has existed for years to 

actually manage loose content in files. On top of that, digital rights 

management technology allows you to do things like encrypt specific 

files, prohibit whether they can be re-e-mailed, sent, printed, or copied to a USB device.

Data classification is enormous in the sense that data classification 

helps us to understand whether the data in question on a storage device is actually the Veterans’ Administration logo, or some confidential document, or Social Security number. At a certain level within 

the IT organization, those two pieces of data are absolutely indeterminate; you don’t know.

And then finally, identity management. Securing data, ironically, 

begins with securing and understanding the people, which again you 

have been exploring all morning. I have found in speaking with most 

of our customers that are at the forefront of this issue that there is a 

relatively simple formula they are all trying to drive toward. 

 First, maximize access control. These are issues like authentication, the secure ID comment that was made. How do you know that 

the person doing the work is actually the person? Strong authentication and authorization are key.

 Segmented infrastructure. If you actually understand the difference between your public Website logo and a confidential document, 

you might not want to put them on the same network, the same storage devices, or the same workstations. And lastly, classified data, 

simply being able to tell the difference between the two.

So maximize access control is the first step in the formula that a 

lot of our leading customers are applying. Secondly, minimize data 

movement. Where possible, they are trying to eradicate these use 

of backup tapes, the theory being if I don’t put the tape on the truck 
59

and it doesn’t leave my data center, then I am less likely to be compromised by it.

 Issues like the guidelines we have been discussing this morning 

are meant to do just that: keep data from leaving the security perimeter. But as was pointed out by the Veterans’ Administration, it is 

very difficult to legislate against an individual deciding to go against 

the policy.

 Thirdly, selectively encrypt whatever remains. So if we maximize 

the access control and minimize the movement of data, what remains 

should be encrypted.

 And then lastly, log and monitor everything, so that we can piece 

together what has happened, both in real-time and after the fact.

 Thank you.

[The statement of Mr. Hoffman appears on p. 113]

  The Chairman. Thank you very much. Ms. Litan?

STATEMENT OF AVIVAH LITAN

Ms. Litan. Yes, I am Avivah Litan, can you hear me now? Can you 

hear me now? I am Avivah Litan, I am a vice president at Gartner, 

and I follow identity theft and security. And thank you for inviting 

Gartner here to testify about the issue. Certainly I don’t envy you at 

all. It is a big, huge task to get this out of control.

 But ladies and gentlemen, you have to assume that the cat is out of 

the bag. At least 10 percent of US adult Social Security numbers, and 

all of these veteran records, could be in criminal hands. In fact, I just 

heard this morning that sale of Social Security numbers are way up 

on criminal sites, and I would have to verify that with another source, 

but we have to assume that that has happened.

 Secondly, I think that it is impractical to ask veterans to take control of a problem that they cannot see. So there has been a lot of talk 

about free credit report monitoring. Sure, that is better than nothing, but there are so many crimes that can be committed by stealing 

data that you won’t ever see with credit report monitoring. So it is 

not practical to ask any individual, especially a veteran, to have to 

take charge of this problem when they didn’t create it, and they have 

no control over it, and they have no visibility into how their data is 

being misused.

 So what can we do? Well, there are two practical steps that I think 

we can take if there is a will to execute. And of course these may 

sound, you know, beyond execution. But number one, stop relying on 

Social Security numbers as the ultimate provider of identity proof. 

When you have all these data elements compromised, you just can’t 

rely on them anymore. That is the facts. So we shouldn’t be worried 

in all this data gets in criminal hands; we need to just assume it is, 
60

and stop relying on it.

 Instead, there are things called identity scoring systems that use 

his Social Security number, along with many other variables to determine an individual’s identity. These systems are already used 

by some of the best lenders and credit card issuers in the country, 

because they don’t want to make a loan or issue a credit card to an 

identity thief, because they will lose money.

 Those same systems should be used throughout, by other sectors 

including the government sector, the Veterans’ Administration, the 

Motor Vehicle Administration, before dispersing benefits or issuing 

credentials, in order to protect the innocent from identity theft. You 

can just imagine, someone is going to get hold of this veteran data, 

change the address of a check, and then some criminal is going to get 

the benefit and then the veteran is going to have to go spend months 

trying to undo this. A credit report monitor would not tell the veteran 

anything about this.

 By stealing a Social Security number, you can get into these free 

credit reports and sign up for them, and the crook has better access to 

the credit report than the veteran does, because they can answer the 

questions that are asked when you register.

 So be realistic about this. Just assume Social Security numbers 

are not reliable anymore.

 Number two, we do need to protect the sensitive data we have left 

and continue to generate, whether it is health records, financial information, telephone records, or anything else. To do so, there are 

several cost-effective technologies that enterprises and government 

agencies can deploy to protect data; including data encryption and 

host intrusion prevention. Of course I am not going to bore you with 

all the details of these technologies, but you should know that they 

have become much more cost-effective and easier to implement over 

the last two years. So these excuses among different companies out 

undue complexity and high implementation costs are really no longer 

valid, and they shouldn’t be tolerated.

 But as you have discussed today, you already know that many data 

compromises cannot be stopped with technical controls. In fact, they 

weren’t caused by lack of technical controls. If you look at what happened in ChoicePoint, their failure was the result of not extending 

information security into the registration and verification process of 

their clients.

 Other compromises such as incidences and Bank of America and 

Wachovia were caused by authorized insiders illegally taking fraudulent action. And of course the compromise of veterans’ data at the 

VA was in part an example of a poor business practice that allowed 

an employee to bring home 26 million records. And you know, as you 

have said, it is not this employee’s fault completely. It is the process 

that allowed him to take home all those records.
61

And in fact, fixing the business process is much harder than implementing technology. But still, security technology is important. We 

looked at three scenarios that are documented in our testimony that 

has been submitted to the Committee. We talked about data encryption, host intrusion prevention systems, and more vigorous and continuous security audits. So just those three, if you implement those 

three systems and processes, you can spend about six dollars just on 

data encryption per customer account, up to $16 per account, just on 

100,000 records.

 So if you are looking at 26 million records at the VA, they could 

do this kind of technology I’m guessing for far less than a dollar per 

veteran. And you compare that to the cost of a breach, and we have 

totaled that up to be about at least $90 per customer account, and 

that doesn’t even include government fines and big lawsuits. So you 

compare a dollar or fifty cents to $90, it is a no-brainer that our data 

should be protected, a regardless of compliance or regulations.

 So hopefully, everyone will be embarrassed enough to take action, 

but nobody so far—it seems to be very slow.

[The statement of Ms. Litan appears on p. 119]

The Chairman. Thank you very much for your testimony. I am 

going to limit each of us to two minutes. Then we can complete this, 

and then we can go on. Mr. Filner, you are recognized. You pass? 

Mr. Michaud?

Mr. Michaud. No, I just wanted to thank the panelists. It was very 

informative, and we really appreciate your time coming here. And 

thank you again, Mr. Chairman.

The Chairman. Thank you. Mr. Udall?

Mr. Udall. Did most of you hear the earlier testimony?

Ms. Litan. Yeah.

Mr. Udall. And you heard the number thrown around, 100 million, 500 million, in terms of losses and things? Do you have any 

comment on that? I mean, do you, in terms of what you heard here, 

what kind of damage might be done?

Ms. Litan. In terms of the damages caused, the total aggregate, I

really think that nobody has a clue. But you can’t assume that the 

average cost of an identity theft, if it is a new account, it is about 

1500. The FTC probably has better data on that than us. But if it 

is $1500 times 26 million, that would be probably the average worstcase.

Mr. Pratt. I don’t have anything—

The Chairman. Excuse me?

Mr. Pratt. I don’t have anything to add. I think that using the 

FTC numbers as a baseline is a good approach if you are just trying 

to estimate general risk.

Mr. Udall. Yeah. And Mr. Hoffman, you have anything on this?
62

Mr. Hoffman. Yeah, nothing major to add except that it could be 

zero. We don’t know—obviously, there is an enormous potential liability. Significant trust damage has been done, but it is very possible that somebody just tried to rip off a laptop, and didn’t know 

anything about it, you know, and immediately just erased and sold it, 

or ripped the hard drive out of it and resold it. You don’t know. But 

the number can be enormous.

Mr. Udall. Do any of you have any critique on the way the Veterans’ Administration was operating, in terms of the testimony you 

have heard here?

Mr. Hoffman. I would say that there is—they represented to you 

what in my experience is an absolute poster child for what is going on 

in corporations and organizations, public and private. This is a system problem that requires people, and process, and technology, and 

they had issues at multiple phases of that. You know, the analogy is 

you can build a very safe car, and you can’t somehow and necessitate 

a very safe driver in that car. And ultimately, security becomes a set 

of trade-offs around this. So I would just tell you that they are not 

alone, and unfortunately, they are not unique.

 What does seem to differentiate them from many of the companies 

I have dealt with is the massive dispersion of the IT infrastructure, 

and the control of that infrastructure. Again, it is extremely hard to 

secure something you can’t manage. And when it is that distributed, 

it becomes really hard to control.

Mr. Pratt. I would only add that if I recall, one of the witnesses 

talked about an individual who had dual responsibilities: IT and then 

security. That may not be the accurate description, but good data 

management starts with a chief privacy officer, a chief information 

security officer, a set of highly trained individuals who have very specific skills in both the knowledge of the—the technical knowledge of 

data security. Encryption isn’t the only solution, for example. It is 

a much wider array of strategy. But if you don’t have the infrastructure that answers right up through—in the corporate world, it would 

be right up through the Committees of the board that would have 

oversight for that—you really don’t have the proper infrastructure to 

even begin to make the decisions to address the dispersion, to oversee 

the proper management of the data.

Mr. Hoffman. That is exactly right. We have been working very 

much with a large mutual fund company in Boston who had a very 

similar event two or three weeks ago: losing a laptop with information on it. There is no ambiguity about who is responsible for that. 

The response is lightning fast, because there is a chief information 

security officer reporting either to a chief information officer, or a 

chief risk officer. And they are empowered and accountable, and it 

goes right up to the board to answer the problem.

Mr. Pratt. And in the private sector, it is risk-based, all of these 
63

decisions are risk-based decisions the corporations are working into 

their infrastructure.

The Chairman. In this case, the risk base is the American taxpayer.

Ms. Litan. I would also like to point out that private sector is governed in many cases by the Payment Card Industry standard, that 

has a definite chain of command, and penalties if there is no compliance. Here, I don’t see any distinct rules that they are subject to and 

any reason that they have to get fined. So there is no stick.

 I get a lot of calls from companies that are complying with PCI, and 

they are damn worried about fines from Visa and MasterCard, and 

that is what motivates them. I don’t see the same kind of motivation 

at the VA.

The Chairman. Well, nobody has any enforcement. Gartner consulting, are you still on contract with the VA, do you know?

Ms. Litan. Yes, we are.

The Chairman. Okay. Since this incident has occurred, has anybody from the VA contacted you, Gartner consulting?

Ms. Litan. Personally, I haven’t been contacted. I think—and I

can’t really speak for the company because there are a lot of points of 

contact, so—but I think the main contact was on this hearing.

The Chairman. EMC, do you have a contract with the VA?

Mr. Hoffman. We have sold stuff, yes, we have sold products.

The Chairman. Sold on hardware.

Mr. Hoffman. Yeah. And some software. And we have been in 

some significant conversation over the last few days on how we can 

help with this.

The Chairman. Before some of these incidents had occurred, you 

know, I have got Secretary Cadenas still here, we had a hearing because in our disability fraud cases we individuals on the inside doing 

things they shouldn’t be doing, and that’s of he really worked on, 

compliance.-- He works with the IG. So those things happen.

 I had a conversation with an individual CIO of one of the Fortune 

20, and I asked a basic question, “So could any employee pull down 

the entire personnel record, or the customer list of your company, 

and take it home?” You know, he laughed at me. No, I’m serious, 

he laughed at me like that was the most ridiculous question he had 

ever heard, because there is no way possible they would ever let that 

occur.

 What is your response to that? Tell me what is happening out 

there in the private sector? Why did he laugh at that question?

Mr. Hoffman. Fortune 20 financial services firm?

The Chairman. No, a Fortune 20 in the world. Sales, and sales.

Mr. Hoffman. What industry?

The Chairman. I am not going to tell you.

[Laughter.]
64

Mr. Hoffman. The reason I ask is because we see a significant 

deviation in industry vertical to industry vertical. Typically, defense 

and intelligence get this, know what they are supposed to be doing 

around protection of confidential information. Financial services, 

particularly the large banks, get this. Healthcare organizations are 

beginning to, but there is a very steep falloff in the understanding 

and awareness of information security, issues, technology, organization structure. But if you are speaking to somebody in one of those 

higher-end verticals when it comes to security—

The Chairman. It is.

Mr. Hoffman. —it is laughable, because they have dealt with, you 

know—they know that they are personally liable. These are information companies. To lose the information is to lose the company. In 

banks, they trade in information, that is their business. And they are 

very aggressive about making certain things like that can’t happen.

The Chairman. Well, we already know the advice and counsel to us 

from Gartner Consulting with Gartner’s centralized approach at this, 

and it was not taken seriously at the VA. The bureaucracy sort of 

cheered. They felt like they won. We had one of the best in our country as a CIO of VA. He didn’t have to take that job. He went in and 

took that job, very challenging. There were a lot of career employees 

that had been there for a long time, they don’t want to change: “Why 

should we do that? This model has always worked that way.” And 

you can always come up with a list, very articulate, they sound very 

sensible, very reasoned.

 But the challenge for our, quote, “government,” for all departments 

is to get our arms around this. And both of you may criticize us. You 

called this “maximum dispersion.” I guess we call it “decentralization.” I like your term you have used here. And what we did here 

on a bipartisan basis was to get our arms around this, we needed to 

empower the CIO, and get hold of the architecture, and begin to then 

work in the systems. That was our approach.

 And we tried to be good listeners to what is going on in the private 

sector. It has been really challenging, in the 14 years that I have 

done this, to get government to say it is okay to utilize some business 

practices and principles. It shouldn’t be a radical concept, but it is 

really challenging, and you know that because you are consultants to, 

quote, “government.” But we provide their budgets every year, and 

monies come, and they spend monies, and they don’t, quote, “have to 

change.” And it is very, very challenging.

 I am glad that the acting CIO stayed here, General Howard, I appreciate that, and Secretary Cadenas, and Secretary Duffy, that you 

have remained here to listen to this testimony. And I would welcome 

you to contact them for their expertise and counsel as we proceed.

 Thank you very much, you have helped your country.
65

 This hearing is now concluded.

[Whereupon, at 12:15 p.m., the Committee was adjourned.]

 
(66)

APPENDIX
67
68
69
70
71
72
73
74
75
76
77
78

Statement for the Record of Hon. Corrine Brown of Florida
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241