Encryption Failure in Portable Device Storage: Technical-Operational Analysis of the Veterans Affairs Data Breach

Round 1

Reviewer 1 Report

This paper presents a structured analysis of the Veterans Affairs data breach, introduces a Portable Device Data Exposure Chain model, and proposes a defense-in-depth control framework. The article is well-organized, theoretically grounded, and methodologically sound, offering strong analytical and generalizable value. However, the paper has the following shortcomings that need to be addressed during revision.

 

• The analysis relies primarily on government reports and literature from around 2007, with no comparative examination of similar portable-device breach incidents that occurred after 2010. The authors should supplement their study with more recent cases to improve the model’s temporal validity and external generalizability.

 

• Although the “Portable Device Data Exposure Chain” is logically sound, it largely overlaps with existing data lifecycle security models. The paper does not sufficiently articulate what distinguishes this model from prior frameworks. The authors should explicitly clarify its unique contributions and theoretical advances.

 

• The study is purely qualitative and retrospective. No empirical testing, simulation, or quantitative risk assessment is conducted to validate the proposed controls. This makes it difficult to objectively compare the effectiveness or priority of the recommended measures. A small-scale empirical validation or back-testing using historical data would strengthen the paper.

 

• Although “human failures” are listed, the analysis only mentions employees not following policies, without exploring deeper behavioral economics or organizational psychology factors. A richer human factors framework would improve the analysis.

 

• The paper strongly recommends full-disk encryption as a key defense, but does not discuss scenarios where key management fails, encryption is bypassed, or metadata leakage occurs even with encryption. The authors should discuss the limitations of encryption controls and recommend compensating controls.

• The analysis relies primarily on government reports and literature from around 2007, with no comparative examination of similar portable-device breach incidents that occurred after 2010. The authors should supplement their study with more recent cases to improve the model’s temporal validity and external generalizability.

 

• Although the “Portable Device Data Exposure Chain” is logically sound, it largely overlaps with existing data lifecycle security models. The paper does not sufficiently articulate what distinguishes this model from prior frameworks. The authors should explicitly clarify its unique contributions and theoretical advances.

 

• The study is purely qualitative and retrospective. No empirical testing, simulation, or quantitative risk assessment is conducted to validate the proposed controls. This makes it difficult to objectively compare the effectiveness or priority of the recommended measures. A small-scale empirical validation or back-testing using historical data would strengthen the paper.

 

• Although “human failures” are listed, the analysis only mentions employees not following policies, without exploring deeper behavioral economics or organizational psychology factors. A richer human factors framework would improve the analysis.

 

• The paper strongly recommends full-disk encryption as a key defense, but does not discuss scenarios where key management fails, encryption is bypassed, or metadata leakage occurs even with encryption. The authors should discuss the limitations of encryption controls and recommend compensating controls.

Author Response

We sincerely thank the reviewer for the thorough evaluation of our manuscript and for the constructive suggestions provided. We appreciate the recognition of the paper's organization, methodological rigor, and analytical value. In response to the review, we have substantially revised the manuscript to strengthen its theoretical positioning, improve its analytical validation, expand the treatment of human factors, and provide a more balanced discussion of encryption controls and their limitations.

All changes have been incorporated into the revised manuscript and are highlighted in this response in attachment.

Author Response File: Author Response.pdf

Reviewer 2 Report

The manuscript provides a well-structured retrospective analysis of the 2006 U.S. Department of Veterans Affairs (VA) data breach. The application of James Reason’s Swiss Cheese Model to information security is pedagogically valuable, effectively demonstrating that data breaches are rarely isolated technical failures but rather a cascade of procedural, physical, and human breakdowns.

However, as a paper submitted to the "Security Engineering & Applications" section in 2026, the manuscript currently suffers from a significant temporal gap. The preventive measures proposed in Section 6 (e.g., "Mandatory Encryption of Portable Devices") read as outdated because they are already ubiquitous industry defaults today. To make this historical case study relevant to modern security engineering, the authors must bridge the gap between the technical constraints of 2006 and the realities of modern cryptographic engineering.

I recommend a Major Revision to address the following critical points:

1. The Evolution of Cryptographic Engineering (Performance vs. Security Trade-off) In 2006, Full-Disk Encryption (FDE) was often disabled on commercial laptops due to severe CPU overhead and latency issues. Today, FDE (e.g., BitLocker, FileVault) has virtually zero performance penalty due to hardware acceleration (e.g., AES-NI instruction sets) and Self-Encrypting Drives (SEDs).

• Action required: Please add a subsection discussing why encryption was practically difficult to enforce at the time of the VA breach, and how modern hardware-accelerated cryptography has eliminated this trade-off, making the proposed "Mandatory Encryption" a standard baseline rather than a novel recommendation.

2. Modernization of Key Management (Hardware Trust Roots) In Section 6.2 (Formal Key Management Procedures), the discussion is too abstract. Modern endpoint security relies heavily on hardware-based trust roots (e.g., TPM 2.0, Apple Secure Enclave) to securely store and manage cryptographic keys, binding the encryption to the specific hardware state.

• Action required: Update the key management recommendations to explicitly include the role of hardware security modules (TPM/Secure Enclave) in mitigating the risk of physical device theft.

3. Evolution of the Threat Model (Data-at-Rest vs. Data-in-Use) The "Portable Device Data Exposure Chain" model perfectly addresses "Data-at-Rest" vulnerabilities. However, modern attackers have evolved. If a stolen device is in a sleep state (Modern Standby) rather than fully powered off, FDE keys remain in the RAM, making them vulnerable to Cold Boot attacks or DMA attacks.

• Action required: Briefly acknowledge the limitations of FDE in the modern threat landscape. Mention that while FDE prevents the specific 2006 VA scenario, modern security engineering is now shifting towards protecting "Data-in-Use" (e.g., memory encryption, Confidential Computing) to counter advanced physical attacks.

4. Update References

• Action required: The current references are mostly from 2007 and 2020. Please include recent literature (2022-2026) regarding modern endpoint encryption standards, hardware-based security (TPM), or modern data breach case studies to contextualize the historical VA incident.

• Section 1 (Introduction): Please explicitly state the year of the VA data breach (2006) early in the introduction. This sets the correct historical context for the reader.
• Figure 4 & 6: The visual models are excellent and highly reusable. However, in Figure 6, under "Cryptographic key management layer", consider adding "Hardware-backed key storage (e.g., TPM)" to reflect modern engineering practices.
• Section 7 (Lessons Learned): It would be highly beneficial to add a paragraph discussing how the lessons from this 20-year-old case apply to emerging paradigms, such as Bring Your Own Device (BYOD) policies and Zero Trust Architecture (ZTA), where the trust boundary is entirely dissolved.

Author Response

We sincerely thank the reviewer for the careful evaluation of our manuscript and for the constructive suggestions provided. We appreciate the reviewer's recognition of the pedagogical value of applying James Reason's Swiss Cheese Model to information security incidents and the positive assessment of the analytical structure of the paper.

In response to the review, we substantially revised the manuscript to better position the historical Veterans Affairs breach within the context of modern security engineering. The revised version expands the discussion of contemporary cryptographic engineering, hardware-assisted encryption, hardware trust roots, evolving threat models, Zero Trust concepts, and modern endpoint-security practices. We also updated the literature base and clarified the applicability of the proposed model to contemporary environments.

All changes have been incorporated into the revised manuscript and are highlighted in this response in attachment.

Author Response File: Author Response.pdf

Reviewer 3 Report

Review Comments on the Manuscript: “Encryption Failure in Portable Device Storage: Technical-Operational Analysis of the Veterans Affairs Data Breach”

1. The manuscript does not include a dedicated related work section. Incorporating such a section would provide a stronger theoretical and practical context regarding portable device security, risk mitigation strategies, and contemporary cybersecurity frameworks. This addition would help position the proposed model within the existing body of knowledge and more clearly highlight its novelty, contributions, and advantages over previous approaches.

2. In section 2: Methodology, pp. 2–3. The study is described as a retrospective qualitative analysis; however, the methodology lacks sufficient detail to ensure transparency and reproducibility. Specifically, the authors should clarify: How the documentary and archival sources were selected; the procedures used to identify and classify control failures; the criteria employed to develop the proposed Portable Device Data Exposure Chain model, and 
The methodology used to define and categorize risk levels.
Providing this information would strengthen the rigor and credibility of the study.

3. In Section 2.4, the authors claim that the proposed model can be generalized to other organizational environments. However, the manuscript does not provide sufficient evidence to substantiate this assertion. To strengthen the argument, the authors could consider:

4. Comparing the proposed model with other documented portable device loss or data exposure incidents; and including a comparative table accompanied by a brief discussion highlighting the model’s applicability across different organizational and operational contexts. Such additions would provide stronger support for the model’s external validity.

5. Although the manuscript presents a detailed case description, causal analysis, and risk assessment, it lacks a formal Results section. A dedicated results section would improve the overall structure of the paper and allow readers to clearly distinguish between findings, interpretation, and discussion.

6. In section 5.3, pp. 10–12. The risk assessment classifies the incident as Likelihood = Moderate, Impact = Severe, and Overall Risk = High. However, the rationale underlying these classifications is not adequately explained. The manuscript should explicitly describe: The risk assessment scale employed, the thresholds or criteria used for each classification level, and the methodology used to derive the overall risk rating. Providing these details would enhance the transparency and reproducibility of the assessment process.

7. In Section 5.2, pp. 9–10. The Portable Device Data Exposure Chain constitutes the manuscript’s primary contribution. Nevertheless, it is currently presented only as a conceptual sequence of events. The contribution could be significantly strengthened through a more formal definition of the model, including: A clear description of its components and variables, the relationships among model elements, conditions and assumptions governing its application, Potential limitations, and a comparison with established incident analysis and risk assessment frameworks. A more rigorous formalization would improve both the academic value and practical applicability of the proposed model.

Please refer to the "Major comments"' section for specific observations, page references, and actionable feedback regarding the manuscript's methodology, structure, and literature review."

Author Response

We sincerely appreciate the detailed evaluation of our manuscript with the emphasis on methodological rigor, model formalization, literature positioning, and validation.

In response to these comments, we substantially revised the manuscript. The revised version introduces a dedicated section on related work and contemporary security context, expands the methodology and model-construction procedures, formalizes the Portable Device Data Exposure Chain (PDDEC), strengthens the risk-assessment methodology, introduces a comparative back-test against post-2010 incidents, and broadens the literature base to include contemporary endpoint-security, Zero Trust, and platform-security research.

All modifications have been incorporated into the revised manuscript and are highlighted in this response in attachment.

Author Response File: Author Response.pdf

Round 2

Reviewer 1 Report

accept

no

Author Response

We thank the reviewer for this observation. The manuscript has been carefully revised to improve the clarity, readability, and overall quality of the English language. We reviewed the text to reduce repetitive wording, simplify overly complex sentence structures, improve academic style, and enhance the precision of the technical explanations. These revisions were made throughout the manuscript without altering the underlying technical content or conclusions.

Reviewer 3 Report

After reviewing each comment, I consider that all of them have been addressed, and I was able to clear them. Thank you for your attention and support

No action required

Author Response

We thank the reviewer for this observation. The revised manuscript already contains a dedicated "Related Work and Contemporary Security Context" section (Section 2), where the proposed model is positioned relative to storage-encryption guidance, Zero Trust Architecture, defense-in-depth approaches, and endpoint-security literature. In addition, the manuscript includes a dedicated Discussion section (Section 7) and Conclusions section (Section 10).

We acknowledge, however, that the analytical findings were presented under the heading "Technical-Operational Analysis" rather than an explicit "Results" section. To improve clarity and align the manuscript structure with common scientific conventions, we have renamed Section 6 to "Results and Analysis" and clarified the distinction between the presentation of findings and their interpretation in the Discussion section.