WASHINGTON D.C. REPORT SAYS USDA LACKED CONTROLS TO PROTECT STOLEN DATA ON COMPUTERS USDA lacked controls to protect stolen data: report | U.S. | Reuters:

USDA lacked controls to protect stolen data: report

WASHINGTON (Reuters) - The U.S. Agriculture Department lacked controls to protect personal information on stolen computers and often failed to notify individuals whose information had been compromised, the department's inspector general said on Tuesday.

The office of inspector general said in a report that it reviewed records from the Farm Service Agency, Natural Resources Conservation Service, Rural Development and Information Technology Services and found 95 computers were stolen between October 1, 2005, and May 31, 2006.

"These agencies lacked policies and procedures to adequately notify proper authorities and affected parties when thefts of computer equipment occurred," Assistant Inspector General Robert Young said in the report.

The findings showed there were limited controls in place to ensure that employees did not download Privacy Act/Sensitive information on their computers.

It also found USDA's Office of Chief Information Officer relied on the individual agency's own due diligence in tracking and reporting computer equipment that had been stolen, as well as determining whether it contained sensitive information.

In a letter to Congress last summer, USDA estimated eight cases of Privacy Act/Sensitive information that had been compromised since 2003. The inspector general found an additional nine cases in its limited eight-month review.

Most of the data pertained to department employees and USDA customers and included addresses, Social Security numbers and other personal information.

The report proposed the four USDA agencies use better encryption in their computers and develop a procedure to notify affected parties when computers are stolen.

It also recommended the Office of Chief Information Officer implement department-wide guidance regarding tracking and reporting requirements for computer equipment that is stolen or lost.

USDA said in a letter attached to the report that it agreed to the recommendations and was taking steps to make the necessary changes.