You probably have no idea the degree to which the IT people in and around the military maximize their belief that those simpleton sailors not in the IT circle of trust are sheeple, and that they, the IT gods are, each and every one, the grand saviors of the Republic.

That sort of arrogance begets an unprecedented sense of entitlement. Coupled with a severe dependence on Microsoft Tuesday updates, and a general inability to recognize an SQL query (not making that up), and you have a real problem.

I would not doubt, for a second, that 134k SSNs were on some contractor's laptop.

I can imagine this happening very easily. Let's say a contractor is helping add a module to some web application...

"It worked on test, but not in production. It's supposed to be live already, what's the holdup? Fine, I'm not supposed to do this but I'll give him access to the live-server, read only, of course, since you have security clearance anyway. Plus, the data is in the DB, not on the application server. Ok, so now you have the whole /deploy folder, find the issue..."

"What do you mean you lost you laptop on the metro this morning? Fuck! Ok, well you only had access to the /deploy folder, but now I'm required to audit your laptop's backup to see if you had anything important, what a pain in the ass. Wait, what's this? There are all these XML files with personnel data in them in /deploy/api/xml/!!!!! Those files are supposed to be processed and removed from the web server, not stored! Shit!"

It was probably the MS Access database from BUPERS. It gets mailed to every command (or downloaded nowadays) on a monthly basis. It has everything on everyone. SSN, names, addresses, ranks, birthdays, etc. At least 50 fields of personnel info for almost everyone in the Navy. And it's not classified, otherwise they wouldn't be able to distribute it so widely (although they could at least make it Secret since most admin have Secret clearance, but most admin also work on unclas machines, so I guess not).

Source - I was a Yeoman in the Navy and had access to this. I already didn't think much of the Navy's PII procedures, but seeing this thing for the first time blew me away. It shouldn't exist.

HP does government consulting, it's quite likely they were working on an application that needed access to that data. When I was a civilian working in Navy medicine (building apps), that was often the case.

It's pretty common for the government to do this sort of thing --

http://www.cnn.com/2009/POLITICS/01/27/va.data.theft/ 600+

http://thehill.com/policy/technology/97817-va-loses-another-... 26.5 million veterans/active

The funniest part of all of this is that the non veterans here seem to be surprised by this.

The real question is why not? Its not like HP will be fined to the tune of tens of millions for the breach, at best they will get stern reprimand letter.