By Michael Alison Chandler
Washington Post Staff Writer
Thursday, October 15, 2009
A flash drive containing the personal information of more than 103,000 former adult education students in Virginia was misplaced last month, state education officials reported Wednesday.
Officials said they do not to believe the information, which includes names, Social Security numbers and employment and demographic information, has been found or is being misused. But they are urging former students to take steps to prevent identity theft, Education Department spokesman Charles B. Pyle said.
"Protecting the privacy of students is a solemn obligation, and the Virginia Department of Education . . . has policies and secure systems to safeguard data and prevent the loss or misuse of personal information," Superintendent of Public Instruction Patricia I. Wright said in a statement Wednesday. "However, no policy or system is immune from human error."
A Virginia Education Department employee handed off a two-gigabyte flash drive that was not encrypted during a Sept. 21 meeting in Richmond to a representative of Virginia Tech's Center for Assessment, Evaluation and Educational Programming. The information was to be used for federally mandated research.
The flash drive was reported missing the next day. It contained personal information for all students who finished an adult education course in Virginia from April 2007 through June 2009 or who passed a high school equivalency test between January 2001 and June 2009.
Pyle said it is against agency policy to transfer sensitive information without encrypting it.
Virginia Tech spokesman Larry Hincker said the university was "taking appropriate disciplinary actions" with the employee who lost the flash drive.
Hincker said it was "unfortunate" that the Education Department and the university failed to follow standard practice and Education Department policy by transmitting personal data that was not secure.
David H. Holtzman, a Herndon-based security consultant and author of the book "Privacy Lost," said that information on the flash drive potentially could be used to apply for driver's licenses or credit cards or to generate false IDs.
Department officials sent letters this week to the homes of students who could be affected by the lost flash drive, encouraging them to take steps to prevent identity theft, such as monitoring their credit reports. They do not have addresses for all the students, but said those who do not receive letters should call the Education Department at 877-347-5224 during business hours for information.
" . . . I speak for all VDOE employees in expressing regret over the loss of the flash drive. We are united in our determination to assist those potentially impacted by this incident and are committed to mitigating any risk to individuals," Wright said.
Pyle said the Education Department has revised its policy in response to the incident so that sensitive personal information can be transferred only by using a secure Web-based portal, not by flash drive.