Army News, opinions, editorials, news from Iraq, photos, reports - Army Times

A breakdown in security

Promotion selection lists containing the names and Social Security numbers of more than 50,000 active-component noncommissioned officers were compromised earlier this year and in 2005, according to officials familiar with an ongoing Army investigation.

The 2008 sergeant first class list that was compiled by a board that met in February initially was the subject of the probe. The public version of that 8,620-name list was released by Human Resources Command March 20.

READ MORE: Take steps to prevent ID theft

Eight days later, Army officials at Criminal Investigation Command, commonly know as CID, notified Human Resources Command that the “close hold” version of the list made available to commanders and their designated representatives in mid-March had been improperly released over the Internet, according to Brig. Gen. Reuben Jones, adjutant general of the Army.

Just days after opening an investigation into the matter, CID officials determined that the prepositioned 2005 master sergeant list also had been compromised.

Human Resources Command was notified of that finding March 31.

Jones, whose directorate oversees the management and distribution of officer and enlisted promotion materials, said the CID notifications were particularly troubling because at that time, prepositioned lists contained the names and Social Security numbers of all soldiers — non-selectees as well as selectees — considered by a board.

Jones said that within 48 hours after being notified, the promotions division of Human Resources Command sent e-mail notices via Army Knowledge Online to all soldiers whose names were on the prepositioned lists.

That was a major undertaking, as the prepositioned sergeant first class list contained 30,812 names, and the master sergeant list 20,048.

The command letters alerted soldiers to the unauthorized disclosure of their Social Security numbers, apologized for the compromise of that information and provided information about measures they can take to help protect against possible identity theft.

“We deeply regret putting soldiers and families at risk through the unauthorized disclosure of personal identity information, such as happened here,” Jones said.

“So far we do not know of any cases of identity theft associated with these lists,” he said.

Both CID and Human Resources Command declined to identify the field commands involved in the unauthorized disclosures. However, Jones and Chris Grey, a CID spokesman, said it would be up to the commanders concerned to pursue military legal proceedings if people responsible for the disclosures are identified.

The Army will continue to allow designated commanders access to prepositioned lists, but in a major change from past practice, “prepositioned lists of any type or component will not contain any part of a soldier’s Social Security number,” according to a notice recently sent to all field commands.

The same directive also noted that access to prepositioned list information “is a privilege and it requires a general officer or senior executive service official to request access for primary and alternate designees.”

These designees, who Jones calls “trusted agents,” will lose preposition access for their command if they violate the close-hold restrictions imposed on such rosters by the Army.

“What’s so very disturbing about the lists in these two cases is that it appears from the investigation that the trusted agents are the ones who violated their commanders’ trust.”

Jones said the Army had been putting Social Security numbers on prepositioned lists to help commanders identify soldiers considered by a board, both selectees and non-selectees.

He noted that many commanders want to prepare congratulatory notes to soldiers who are selected for promotion, and to prepare themselves to talk to soldiers who are not selected for advancement.

“Social Security numbers can be very helpful in this process, especially if you have several people in the command with the same name,” Jones said.

The decision to stop using Social Security numbers on the prepositioned lists “was a difficult one for us,” Jones said, “and this means commanders and trusted agents must use other data items (specialty codes, unit codes, rank, etc.) to identify soldiers.

“We have established some procedures to help them do that, but of course the long-term solution is DIMHRS (Defense Integrated Military Human Resources Management System), which will use an employee number rather than Social Security number,” Jones said.

Grey said CID is assisting commanders in their probe of the compromised lists.

Because the cases do not involve the type of criminal activity normally in the purview of the investigative agency, CID officials do not control the investigation; field commanders do.

Sources noted that investigators are looking at other lists to determine if they were compromised.

The prepositioning system is used for brigade and battalion command selections, senior service college lists and promotion lists for the ranks of captain through colonel, the chief warrant ranks of CW3 through CW5, and NCO lists in the ranks of sergeant first class through command sergeant major.

CID initially was alerted to the list problem by Army Knowledge Online, which detected an unusual amount of e-mail traffic with the prepositioned lists and Social Security numbers attached.

E-mails for the sergeant first class lists numbered more than 500, and were sent to military and civilian addresses.

While investigating the E-7 list problem, CID agents found the 2005 prepositioned master sergeant list in a folder on a peer-to-peer, or shared, Web site.