That's according to an official report from the VA's Office of the Inspector General (OIG) released this week. The report also identified process and policy failures, a lack of supervisory oversight and personal squabbles that exacerbated the incident -- and the agency's response to it.
Personal information, including names and Social Security numbers, about 26.5 million veterans was exposed when a laptop and external hard disk containing the data were stolen May 3. Both pieces of hardware were recovered last month by the FBI, which said the data appears to have been untouched.
In a statement responding to the report by Inspector General George Opfer, VA Secretary Jim Nicholson said he fully concurs with the recommendations and is committed to making the VA a "gold standard" for information security among government agencies.
But Bruce Brody, a former chief information security officer at the agency, called the findings underwhelming.
"It points fingers at all the symptoms instead of all the underlying causes," Brody said. A lot of the problems at the VA have to do with systemic cultural issues and an environment in which the information technology office and the security office have traditionally had far too little authority to be really effective, he said.
"Decades and decades of neglect and a fierce resistance to centralized authority are the root causes for this," he said. Nowhere in the report is that issue addressed, Brody said.
The OIG's 78-page report cites lapses up and down the chain of command at the VA and offers recommendations for addressing them. For instance, the data analyst from whose house the equipment was stolen was authorized to access and use VA databases.
But much of the information he had stored on the stolen hard drive was being used for a self-initiated "fascination project" being done on his own time since 2003, without the knowledge of his supervisors, according to the report.
"The loss of VA data was possible because the employee used extremely poor judgment when he decided to take personal information pertaining to millions of veterans out of the office and store it in his house, without encrypting or password-protecting the data," the report said.
The OIG's investigation also found the agency's response to the incident to be deeply flawed.
Early on, few attempts were made to understand the magnitude and significance of the stolen data. In fact, Michael McLendon, the VA's deputy assistant secretary for policy, attempted to downplay the risk of the data being misused by suggesting that it had been protected via a "statistical software program."
That claim was later proved to be inaccurate, the report said. A "very strained" personal relationship between McLendon and Dennis Duffy, the acting assistant secretary for policy, planning and preparedness, also affected how the incident was handled and the manner in which it was communicated to higher-ups. As a result, Nicholson wasn't even told of the breach until May 16.
The initial incident report from the information security office at the office of policy, planning and preparedness had "significant errors and omissions," the OIG report said. But no attempts were made by the district information security officer and the office of information technology to get clarifications from the employee from whom the data was stolen.
"At nearly every step, VA information security officials with responsibility for receiving, investigating or notifying higher-level officials of the data loss reacted with indifference and little sense of urgency or responsibility," the report said.
The VA also lacked policies for safeguarding sensitive information used by its employees and contractors. and little supervisory oversight over how data was being accessed and used. John Pescatore, an analyst at Stamford, Conn.-based Gartner Inc., said the findings aren't surprising.
"Don't be surprised in a dysfunctional organization if the security group is also dysfunctional," Pescatore said. "I don't want to say the CISO is blame-free. But if you are in that job and you don't have the authority you are supposed to have," problems can arise, he said.