[Congressional Record Volume 152, Number 72 (Thursday, June 8, 2006)]
[Senate]
[Page S5670]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

      By Mr. REID (for Mr. Rockefeller (for himself, Mr. Jeffords, Mr. 
        Baucus, Mr. Leahy, and Ms. Stabenow)):
  S. 3486. A bill to protect the privacy of veterans, spouses of 
veterans, and other persons affected by the security breach at the 
Department of Veterans Affairs on May 3, 2006, and for other purposes; 
to the Committee on Banking, Housing, and Urban Affairs.
  (At the request of Mr. Reid, the following statement was ordered to 
be printed in the Record.)
 Mr. ROCKEFELLER. Mr. President, today's headline is sad and 
stunning. The VA Secretary now reports that 2.2 million active-duty 
military personnel were also exposed in the massive security breach at 
VA on May 3. This means that 1.1 million active-duty military 
personnel, 430,000 National Guard members and 645,000 reservists are 
exposed to potential identity theft. The brave men and women, who are 
serving and protecting our country, are not being protected by their 
own government.
  This is deeply disturbing and we owe each servicemember and veteran 
real support to protect their financial information.
  I have revised my legislation, S. 3176, the Veterans' Privacy 
Protection Act, to expand coverage to our military personnel. I am 
proud to have the cosponsorship of Senators Jeffords and Baucus.
  Every American has the justifiable expectation that the Federal 
Government will protect their private personal information--information 
that they are required to provide to Federal agencies. It is a basic 
and fundamental responsibility of government to make sure that this 
sensitive data is handled appropriately, accessed only by authorized 
personal, and used only for intended purposes.
  On May 22, the Department of Veterans Affairs, VA, announced that 
computer disks containing as many as 26.5 million veterans' personal 
information were stolen from an employee who had taken the information 
home. I, along with many of my colleagues, am outraged at this enormous 
lapse in security. The VA has an obligation to make sure that veterans 
and military personnel are not harmed because of the agency's failure 
to protect sensitive personal data.
  This information includes social security numbers and dates of birth, 
the underpinnings of almost all of our financial information. In the 
wrong hands, this information can be used to steal a person's identity 
causing substantial harm. All of us have constituents who have been 
victims of identity theft. When a person's identity is stolen, it can 
have devastating financial consequences for that person and that 
family. Even if the financial harm is minimal, it often takes years to 
clear your name. Plus, veterans and military families must live with 
the uncertainty about the financial records.
  I understand that the VA, FBI and local law enforcement are working 
on the investigation, but Congress must also conduct a thorough 
investigation into how this security breach occurred. I want to know 
why the VA waited almost three weeks for its first announcement. I want 
to know why it took another two weeks to compare files and realize that 
2.2 million military personnel were also exposed.
  In my opinion, it is inexcusable that veterans and military were not 
notified immediately that their personal information had been stolen 
and were not given any guidance as to the steps they should take to 
protect themselves from identity theft. I understand the VA inspector 
general has cited the agency for poor security policies and procedures. 
Congress must also begin a comprehensive review of the agency's 
security protocols and policies and force the agency to adopt stricter 
security measures to make sure that the personal data our veterans are 
required to provide the agency is not ever again at risk.
  It is for this reason that I am reintroducing the Veterans' and 
Military Privacy Protection Act today. Although all Federal agencies 
need comprehensive data privacy policies, this is a targeted bill to 
address the security breach at the VA on an urgent basis.
  Congress has required the Federal Trade Commission to address 
identity theft and its consequences. The agency has taken an aggressive 
approach in combating this devastating crime. My bill would require the 
Federal Trade Commission to develop a hotline explicitly for veterans 
and military personnel to provide the information, counseling, and help 
necessary to allow each person to protect himself from the loss of 
personal data.
  At this point, our legislative response must cover all 28.7 million 
veterans and servicemembers that the VA believes may have had their 
personal information compromise. My bill would make it easier for them 
to request a long-term credit alert for their records so credit 
agencies are aware that their personal information could be being used 
by others. It is my understanding that a security freeze on an 
individual's record can have a modest cost, and VA has the obligation 
to cover the costs of this enormous security breach.
  Finally, my bill requires the General Accountability Office to 
evaluate the VA response to this incident and to analyze the agency's 
security protocols. I believe that an independent investigation could 
generate a number of recommendations to improve the security of 
personal information not just in the VA but in all Federal agencies.
  The VA has exposed millions of veterans and military to identity 
theft and potential financial problems. It is inconceivable to me how 
any Federal agency could have let this happen, and how the 
investigation and followup could be so haphazard. We all have heard the 
stories during the past year regarding massive breaches of private and 
confidential data by private entities. The Federal Government acted 
quickly to respond to these breaches and now it must act just as 
quickly if not more so to address its own failings. My bill is a 
critical step in providing the necessary assistance that millions of 
veterans and servicemembers may require, and I urge my colleagues to 
act on it with the urgency this situation demands.
                                 ______