06.29.06
Finding the scapegoat
The Bush Administration has showed a genius for finding low-level scapegoats to punish whenever large and systemic abuses are revealed (despite their best efforts to keep such things secret). In the war crimes area, we see enlisted troops and low-level non-coms be punished more or less severely, while officers higher up the chain of command walk away with no punishment or blemish. (The idea that an officer is responsible for actions under that officer’s command has, apparently, been discarded whenever the actions are reprehensible, the responsibility reserved for meritorious actions.) In civil affairs, Brownie took the brunt of the Katrina failure while Chertoff skated.
Now, at the VA, it’s happening again. The analyst who took home the data on 26 million veterans, only to have the laptop stolen, had sought and received permission to do it. Moreover, he reported the theft immediately. (The VA took 3 weeks to inform the relevant Congressional committee.)
Now the thought is that he’ll be fired and those who gave him permission will skate:
Newly discovered documents show that the VA analyst blamed for losing the laptop had received permission to work from home with data that included millions of Social Security numbers and other personal information on veterans and military personnel.
”From the start, the VA has acted as if the theft was a PR problem that had to be managed, not fully confronted,” said Rep. Bob Filner, D-Calif. ”They’re trying to pin it on this one guy, but I think it’s other people we need to be looking at.”
The documents obtained by The Associated Press show that the data analyst, whose name was being withheld, had approval as early as Sept. 5, 2002, to use special software at home that was designed to manipulate large amounts of data.
A separate agreement, dated Feb. 5, 2002, from the office of the assistant secretary for policy and planning, allowed the worker to access Social Security numbers for millions of veterans.
A third document, also issued in 2002, gave the analyst permission to take a laptop computer and accessories for work outside of the VA building.
”These data are protected under the Privacy Act,” one document states. The analyst is the ”lead programmer within the Policy Analysis Service and as such needs access to real Social Security numbers.”
The department said last month it was in the process of firing the data analyst, who is now challenging the dismissal.
VA officials have said the firing was justified because the analyst violated department procedure by taking the data home. They also said he was ”grossly negligent” in handling sensitive information.
However, Filner noted that the employee had informed supervisors of the theft immediately after the crime, while supervisors waited nearly three weeks to inform the public on May 22. Nicholson himself was informed on May 16.
”The gross negligence in this case are the people above him,” said Filner, the acting top Democrat on the House Veterans’ Affairs Committee.
This is contemptible behavior: refusing to accept responsibility, pushing it down to the powerless (and to a person who followed procedures to seek and gain permission for his actions). A primary rule of hierarchical organizations is that one can delegate authority, but not responsibility: the responsibility remains with the delegator. The Republican rule is quite the opposite: pin the responsibility on the powerless, and let those actually responsible go unpunished.
UPDATE: Interesting: the article at the link, which earlier had the text as displayed, has now been changed (and is less interesting). No indications in the article that the text was revised, no links to the earlier text. Is anyone else reminded of 1984?




Architected Information » Six Ways to Secure your Architecture said,
16 August 2006 at 5:58 am
[...] On a side rant, something I don’t hear enough about these days is the responsibility of the organization for their IT architecture and policies. Instead, most of the time I hear scapegoating and complaints about users. If it is your architecture, you are in charge of keeping things running safely and securely. It is your users responsibility to use your systems efficiently, not to make your life easy. [...]