“It is appalling to all veterans that their personal information–information that is supposed to be held in confidence–is potentially in the hands of individuals who can wreak identity-theft havoc,” said John Rowan, National President of VVA and a plaintiff in the lawsuit. 

“VA Secretary Nicholson has said he is ‘mad as hell’ over this incident and the breakdown in command and control of his department, and we believe him.  However, he has yet to answer some critical questions:  What was an employee of the VA doing with the names, Social Security numbers, and dates of birth of all these veterans, the vast majority of whom have never availed themselves of VA services?  Why is the VA collecting this information in the first place?” 

VVA is joined by four other national organizations and individual veterans in the lawsuit, which was filed in federal district court today by attorney Douglas Rosinski of the law firm Ogletree, Deakins, Nash, Smoak & Stewart, P.C.  They are the National Gulf War Resource Center, Radiated Veterans of America, Citizen Soldier, and Veterans for Peace. 

“Saying ‘We’re sorry’ is hardly comforting to veterans and their families,” Rowan said.  “The VA has been criticized for years about lax information security and that includes criticism from the VA’s own Inspector General. The VA still hasn’t properly secured all the personal information under its control. We’ve just seen the largest known unauthorized disclosure of Social Security numbers in history.  We hope this lawsuit will help Secretary Nicholson correct the known vulnerabilities in how the VA protects private information.  If the VA can’t solve the problem, maybe the courts can help. Since all previous attempts at protecting privacy of individual veterans by heads of the VA have failed, perhaps the weight of the judiciary can make the difference.  This lawsuit seeks to insure that no harm will come to veterans as a result of this theft, and that such an incident can never occur again.” 

The veterans’ complaint, filed in the U.S. District Court for the District of Columbia, seeks:

• A declaratory judgment that the VA’s loss of these records violated and continues to violate both the Privacy and Administrative Procedure Acts. 

• A court order that the VA disclose the exact nature of its compromised records system and to individually inform each veteran of every record it maintains on him/her.

• An injunction preventing the VA from altering any data storage system and prohibiting any further use of these data until a court-appointed panel of experts determines how best to implement safeguards to prevent any further breaches.

• A judgment awarding $1,000 to each veteran who can show that he/she has been harmed by the VA’s violation of the Privacy Act.

###