MADISON, Wis. - A Wisconsin senator is writing legislation to remove Social Security numbers as identification in the U.S. Department of Veterans Affairs.
Sen. Tammy Baldwin (D-Wisconsin) began working on the issue after seeing a News 3 investigation into an email sent last year to an unauthorized individual that contained the names and SSNs of hundreds of Wisconsin veterans. Since Vietnam, the VA has identified service members by their SSN.
Federal privacy laws and multiple VA regulations require all emails with personally identifiable information to be password-protected. However, current VA software flags emails with nine-digit numbers separated by dashes, but not for nine-digit sequences that don't have dashes like the VA's current ID system.
"When we took a closer look and got greater information, it seemed like the real answer here was to make sure the VA moved away from using Social Security numbers as identification," Baldwin said in an interview from Capitol Hill. "The case in Wisconsin that (News 3) shined light on and constituents have brought to our attention was unintentional. It was accidental, but nonetheless, it just shows the vulnerability that our veterans and their families face when the VA uses their Social Security numbers as identification."
The constituent who first brought the issue to Baldwin's attention is Terry Everson, a Wisconsin veteran himself, who opened up an email sent by a VA.gov address on April 1, 2015, and found the attachment containing the personal information of hundreds of Wisconsin veterans. The email had been sent by a Wisconsin Department of Veterans Affairs official who is no longer with the state agency. That individual now works for the U.S. Department of Veterans Affairs.
A spokesperson for the Wisconsin Department of Veterans Affairs said the investigation conducted by the department's IT professional into how Everson was sent the unencrypted email has not been completed. VA departmental policy and federal law requires all emails with personally identifiable information to be password protected.
The WI DVA spokesperson told News 3 that the department continues to make sure "the protocols, safeguards and policies developed and implemented since April of 2015 are properly in place and working effectively."
"There's been a culture of lax oversight, a culture of lax accountability," Everson said. "Through the efforts of all the people who've been investigating this, it has exposed a huge gap to the veterans of this state and also the veterans of the United States."
An investigative team from the VA's Office of the Inspector General interviewed Everson and his advocate, Col. Rick deMoya, about the email in question and the response from state authorities. When Everson and deMoya asked about an investigation into how it was sent and promised not to share the email with anyone, they were sued by the Wisconsin Department of Justice. The lawsuits were dropped when both provided sworn affidavits that they'd paid their own money to scrub their computers of the database and the SSNs.
Everson said he believed there remained concerns about how VA officials at both the state and federal level send personally identifiable information online, but that removing the SSN from the equation, as Baldwin's legislation suggests, would dramatically reduce the problem.
"I don't think anyone wants their Social Security number floating around with the whole challenge of security and privacy and identity theft," Everson said. "(Changing the law) simply makes sense, but the old, 'We've always done it this way' (thinking) has gotten us to this point. Now it's time to make a change."
Baldwin said she hopes to introduce the legislation in the coming weeks. She said she didn't know how much it would cost.
There is a recent example that serves as a foundation for Baldwin. Congress recently passed bipartisan legislation requiring Medicare to remove the use of SSNs as its identification. That change is being phased in over the next few years.
"This is the age we live in," she said, "And we've got to double down and make sure that our government agencies are leaders, not followers in the effort to protect personally identifying information."
- Report: Milwaukee County mom drugs slushy, rapes 10-year-old boy
- Madison man arrested for sixth OWI
- Local businesses say Clinton police have ‘harassment type mentality'
- Brodhead police search for man who reportedly threatened to bring gun to work
- Organizers, participants look forward to marathon despite weather concerns
- Man charged in fatal crash, accused of drunk driving