Evan Schuman's StorefrontBacktalk

On Thursday (March 29), California reported that FedEx—with an important assist with IBM and Iron Mountain—had lost highly sensitive data from more than 800,000 people in its child support database. Although it’s a very bad situation, it’s a good case study of the “secure the weakest link” approach, where a small hole in Iron Mountain’s distribution network sent the four disks through an insecure shipment service (the question remains of whose idea it was to use FedEx). This is a fate that potentially awaits any retail IT shop, because backup disks ultimately have to be transported somewhere.

Almost as unsettling was a rather reckless statement from the department’s director, where she offered unwarranted confidence in the impregnable nature of disk formatting. “Because the devices are in a specialized format, we have no reason to believe, at this time, that the data has been accessed or utilized in any way,” said Kathleen Hrepich, the interim director of the California Department of Child Support Services. Presumably, “at this time” means “until I actually talk with someone in IT security.”

The cartridges require special hardware and software to properly read the data, a department official said. True, but that software and hardware exists and patient cyberthieves are quite good at getting around such obstacles.

Is there much of an incentive for the thieves to try? The state—which waited 17 days after the March 12 incident to announce it—said the data about those more than 800,000 consumers (children, too, whose identifications are always in high demand; there is often little to no activity on their IDs yet, making fraud easier) included names, addresses, Social Security numbers, driver’s license numbers, names of health insurance providers and employers.

Of course, the greatest security defense here is that the thieves have to find the disks before FedEx does, which gives the bad guys a fighting chance.

Here’s what apparently happened. The cartridges had been sent to IBM’s facility in Boulder. Colo., as part of a disaster simulation, so the technology company could test whether it could run California’s child support system remotely. The disks were then scheduled to go back to an Iron Mountain facility in California.

The details about that trip get a little murky. Christine Lally, a spokeswoman for the state’s Office of Technology Services, said FedEx was used to move the disks because of a hole in Iron Mountain’s distribution system (the state said Iron Mountain doesn’t fly disks) and that FedEx was an Iron Mountain subcontractor. Hence, FedEx was brought in because Iron Mountain couldn’t fly.