Union files suit against TSA for data breach

The American Federation of Government Employees filed a class-action lawsuit against the Transportation Security Administration for the loss or theft from headquarters of a portable hard drive that contained 100,000 payroll records of current and former employees.

AFGE, which represents about 4,000 of TSA’s 43,000 current employees, filed the suit May 8 in the U.S. District Court for the District of Columbia. The federal employee union said the agency, part of the Homeland Security Department, failed to establish adequate safeguards to ensure the security and confidentiality of personnel records under the Privacy and the Aviation and Transportation Security acts.

“TSA must be held liable for this wanton disregard for employee privacy,” AFGE National President John Gage said.

The missing records affect individuals employed by TSA from January 2002 until August 2005. The data includes Social Security numbers and bank account and routing information of the affected employees.

TSA is conducting an investigation along with the FBI and Secret Service. The hard drive was discovered missing from a controlled area at the TSA Office of Human Capital, in Arlington, Va.

“We are not able to discuss active elements of investigation,” said TSA spokesman Christopher White. He could not comment if there were advances in the investigation or any suspects, or whether there was a log that could track users of the data.

“We are singularly focused on doing what’s right for our employees,” he said. TSA has notified employees and established free credit monitoring for up to one year for affected employees.

In the lawsuit, AFGE asks that TSA be ordered to create new security procedures consistent with the cited laws.

“The American people look to DHS for security and protection,” Gage said. “A DHS agency that cannot even shield its own employee data is not reassuring.”

TSA Administrator Kip Hawley apologized for the incident in a letter to the affected employees. The agency said it has extensive data protection protocols and training in place. TSA said it will take swift disciplinary action, including dismissal, against individuals found to be in violation of its procedures.

Senate Homeland Security and Governmental Affairs Committee Chairman Sen. Joe Lieberman, (Ind-Conn.) said he will make it a priority of the committee to improve federal privacy protections.

“We have witnessed far too many incidents over the past few years in which federal employees or American citizens are subjected to potential identity theft because of the negligence of government agencies,” he said. “In this case, TSA has compromised the information of airport security officers, air marshals and other TSA law enforcement officers.”

DHS should review any potential consequences to the integrity and safety of transportation systems as a result of the data breach, Lieberman said.