How much do you think you are paying in tax?

One might think that the theft of medical and financial information in the age of the internet is a result of some super smart computer hacker banging away at his keyboard in a dark room. It does happen, but on many occasions the perpetrator of the crime is a common thief. Agencies, institutions, facilities, and offices are using laptops more frequently. They often let their employees take these laptops out of secure environments and into the employees' cars and homes. Allowing staff to take equipment and data off site without proper precautions increases the potential for theft significantly.

Just recently a government laptop was stolen containing the medical records of 2,500 patients involved in a National Institute of Health study. Andrew Arai, a laboratory chief who runs the research program on cardiac magnetic resonance imaging, had the laptop in the trunk of his car after work, where it was stolen.

On last Christmas Eve in Nashville Tennessee two laptops were stolen form the Metro Election Commission by thieves who just broke a window to access the office. The laptops contained the names and social security numbers of all registered Davidson County voters. The two laptops and hard drives were eventually recovered. The Metropolitan Government of Nashville and Davidson County responded, possibly to late, by offering 1 year of free identity protection service:

Dear Davidson County Voter:
Following the Davidson County Election Commission’s notification to you that the theft of a laptop resulted in a breach of security of your personal information, the Metropolitan Government of Nashville contracted with Debix Identity Protection Network. The contract with Debix allows you to register for a full year of its identity protection service at no cost to you. If you are interested in this service, you must register by April 16, 2008.

Both thefts mentioned above could have easily been prevented by simple measures. The most obvious is assuring that a building is secure and guarded properly. Gaining access to equipment and data by just simply breaking a window is pathetic. The other most important, easy, and free measure is simply encrypting the data stored on the computer using widely available encryption software. Encryption adds an extra level of security assuring that if hardware is stolen the data that it contains will most likely not be accessible.

There are few things we can personally do to make sure our personal data stays secure, but more often than not we are forced to allow others to access it. At that point the information is out of our hands and in the trust of strangers.

Who can we really trust? Have we lost control of our personal, financial, and medical data?