Hard Luck with a Hard Drive

While a resident of Arizona in the early 1980s, I heard reams of anecdotes about the benefits of making Southwest Airlines your preferred carrier. I even shared a house with two people who worked for the airline and talked about its colorful founder, Herb Kelleher, in almost reverential terms.

Predictably, on my first flight with them, they lost my luggage. And mind you, this was on a short hop of roughly 40 minutes. True to form, they were properly apologetic and promised the bags would be returned within 24 hours -- which they were.

Like a good restaurant reviewer who doesn't base his rating on just one meal, I had another go at it, on a Phoenix to Denver route. On this excursion, my luggage was not exactly lost, it just ended up in Albuquerque.

My baggage nightmares aside, I know that Southwest is a quality airline. Just like FedEx is a quality delivery service.

But (expletive) happens.

Over the past week, I've received a barrage of e-mails centering on the case of the hard drive sent out by the American Institute of CPAs for repair that has been classified MIA. Problem is, unlike my luggage at Southwest -- which had little or no value to anyone but me -- the drive contained the names, addresses and Social Security numbers of AICPA members.

The institute sent out a contrite missive to roughly 330,000 members giving them a heads-up that the as-yet-unrecovered drive, which apparently, was sent out for repair -- in direct violation of the institute's internal controls policy.

Not to downplay its seriousness, I find this situation more than a bit ironic, since the topic of IT security usually comes near the top of the institute's annual Top 10 Technologies survey and headlines multiple seminars at every major IT conference.

Naturally, the usual e-mail threads have speculated on the causes and competence levels at 1211 Avenue of the Americas as well as offering up the requisite conspiracy theories. Several of which by the way, I may shamelessly borrow for that spy novel I've been promising to write.

Despite the AICPA's "exhaustive investigations" in concert with FedEx, the hard drive has apparently vanished like Judge Crater.

The institute said it would offer a free year of credit monitoring to members and launched a dedicated section of its Web site to house information regarding the incident. As one skeptical member intimated, it must be serious if the AICPA is giving anything away for free.

I don't pretend to be an expert on all things technology, nor is it my place to lecture about effective procedures and controls to prevent a gaffe of this scope. To be fair, it was counter to institute policy.

That being said, the disappearing hard drive does little to soothe members' concerns about the institute's ability to smoothly execute bolder initiatives on its agenda such as the pending move to North Carolina.

And in case anyone's wondering, Herb Kelleher's company and I have reconciled. So there's hope.

For reprint and licensing requests for this article, click here.
Associations
MORE FROM ACCOUNTING TODAY