V.I.P.D. Ends Collection Of Social Security Numbers Following Identity Theft-Related Data Breach Incident

The Virgin Islands Police Department has ended the practice of requesting the Social Security numbers of persons making incident reports, following a data breach at the department where personal identifying information of four individuals was stolen by a now-fired police officer, who gave the information to someone outside the V.I.P.D., in what has been described as an attempted identity theft crime.

That’s according to Police Commissioner Delroy Richards, who confirmed to The Consortium late Monday that he was in the process of reviewing the new internal policy, which includes the cease and desist directive on collecting Social Security numbers. He said anyone found to be in violation of the new policy will be disciplined, with consequences leading to dismissal from the force.

The commissioner said the policy change was long overdue, adding that many organizations, including the federal government, have stopped the practice of requesting Social Security numbers. “You got to understand that the federal government has discontinued requesting Social Security numbers,” Mr. Richards said. “Even most businesses when they need your Social Security number, they request only the last four… As a matter of fact, in most other jurisdictions, when I look at other police reports, they don’t require that you provide that information.” Furthermore, the commissioner said if someone refuses to provide the Social Security number, not much could be done about it. “You can still ask for it, but if someone insists, ‘No, I’m not going to give you my Social Security number,’ you can’t use that against them,” he said.

Police Commissioner Delroy Richards

Date of birth, name, address and license number will still be requested, Mr. Richards said.

Last week, Mr. Richards told The Consortium that the information breach, which occurred over a month ago, included identifying information such as social security numbers, date of birth and names. However, the breach did not include information provided to the V.I.P.D. by informants, and that none of the force’s cases were compromised because of it. Today, he said the number of individuals affected were four — same as last week, and that the force was building its case against the fired male officer who stole the information. The commissioner said once the investigation is completed, other actions will be taken against the officer, whose identity was not revealed.

“We know clearly that there’s been only one individual… We’re just trying to cleanup the investigation now,” he said.  Explaining the term “cleanup”, Mr. Richards added, “We know that there’s been one perpetrator, we know what was compromised, so we’re just investigating to determine whether there’s anything else that we don’t know of. So far it doesn’t seem like there is, but we want to be 100 percent certain, and not 90 percent certain.”

The V.I.P.D. has a large database of residents’ information because of the important role it plays in society. For example, everyone with a driver’s license has sensitive information stored in the force’s database. But the data breached was limited to persons who made police reports, according to Mr. Richards.

“By law, if it is determined that there might have been some breach of information within the department, whether it be information such as a police report with the person’s name, address and social security — along that line, once we suspect that there might have been a breach and sensitive information might have been revealed, we have an obligation to report it to the public,” the commissioner told this publication last week.

The force is asking residents in both districts who have submitted police reports, to pay attention to their credit reports and notify authorities of any suspicious activities. “In a nutshell that’s what it was, identity theft,” Mr. Richards said.