MINNESOTA FOLLOW INFORMATION ABOUT COMPUTERS STOLEN FROM STATE AUDITOR'S OFFICE http://www.twincities.com/mld/pioneerpress/news/local/14811799.htm

Stolen laptops had data for 2,400
3 computers taken from locked room at state auditor's office
BY PATRICK SWEENEY and MARA H. GOTTFRIED
Pioneer Press

Three laptop computers containing private information about 2,400 public employees and citizens who use government programs were reported stolen last week from the offices of Minnesota Auditor Patricia Anderson.

It was the second computer theft from Anderson's office in two months.

The first laptop, stolen in mid-May, contained no private data, Anderson said Tuesday. But the three laptops taken last week included Social Security numbers for about 500 people.

"It's a very bad thing," Anderson said.

But she said she believed the computers were stolen for their own value, rather than for the data they contained.

"Obviously, we take this very seriously," said Tony Sutton, a spokesman for Anderson. "So today and tomorrow, we're going to be sending out letters to the people letting them know their private data was stolen."

The thefts occurred at a time of heightened concern over the security of data stored on laptops. The U.S. Defense Department is notifying up to 28 million veterans, active-duty troops and National Guard members and reservists that their private information is at risk after a laptop was stolen last month from the home of a U.S. Department of Veterans Affairs employee.

"We have nothing to suggest that these computers were taken because of anything that was on the computers," said Sgt. Paul Schnell, police spokesman. "Identity theft issues are more predominant in theft of everyday items — checkbooks, purses, wallets."

The most recent theft at Anderson's office was discovered late Thursday. The three laptops were taken from a fourth-floor office suite at 525 Park St. in St. Paul.
Schnell said police have no suspects in either of the two computer thefts from Anderson's office.

The computers taken last week held mostly public data. But they also included city and county employee records, plus data on recipients of public human service programs, such as welfare and state-subsidized health care, Sutton said. Included were the names and Social Security numbers of 493 people, plus private data — such as dates of birth and the public programs being accessed by another 1,918 people receiving benefits.

The information was included in records that Anderson's staff was sampling for audits. While the computers were password-protected, the data was not encrypted.

Chris Buse, an employee of another state auditing agency — the legislative auditor — begins work today as Minnesota state government's first information security officer. He said he planned to develop a statewide policy on the storage of private information on laptops. In the legislative auditor's office, according to Buse, a policy calls for such information to be held on laptops only temporarily — and then only in encrypted files.

The office suite from which Anderson's computers were stolen is kept locked. Only her staff and employees and vendors serving the building management have access. There were no signs of forced entry, according to Anderson.

She said a new policy will require that all computers, desktops as well as laptops, be secured by cable locks when in the office. "We're going to tie them down," she said.

Counties for which data on employees and benefit recipients are missing are: Anoka, Benton, Cass, Clay, Douglass, Kanabec, Meeker, Mille Lacs, Morrison, Polk, Pope, Sherburne and Stearns.

The computers also included data from the Metropolitan Council, the cities of St. Cloud and Isle, Rockville Township, the Minneapolis Public Housing Authority and a job-training program operated by Stearns and Benton counties.

According to Anderson, members of her staff discovered the laptops missing late Thursday and initially were not certain whether they had been stolen or misplaced. She said she was not in her office Friday, but the theft was reported to top aides Friday.

She said the aides spent much of Friday trying to make sure the laptops were missing, locating their serial numbers and then beginning the inventory of the data they contained. She said members of her staff tried to make a police report Friday and then actually made the report Saturday.

While theft of laptops in St. Paul from offices, homes and cars "is not commonplace, it is also not rare," said Schnell, the police spokesman. Generally speaking, laptops are stolen for the thief's use or to sell, "not so much for what they contain," he said.

Patrick Sweeney covers state government and its effect on Minnesotans. He can be reached at psweeney@pioneerpress.com or 651-228-5253. Mara H. Gottfried can be reached at 651-228-5262 or mgottfried@pioneerpress.com.