The 2019 data breach at the Defense Manpower Data Center (DMDC) was a wake-up call. When sensitive info on over 200,000 service members and vets gets exposed, it shows how badly we need better data standards in government systems. And that breach wasn’t a one-off event. It pointed to deep, systemic problems that still put veterans at risk. Protecting this data isn’t a single-shot fix. It’s going to take a combination of new technology and a serious push for real, systemic change from advocates. So how do advocates actually make that happen?
Key Takeaways
- Get in front of lawmakers on committees like the House Committee on Veterans’ Affairs and demand specific changes to data security rules in the National Defense Authorization Act (NDAA).
- Mandate that all organizations handling vet data use the NIST Special Publication 800-53 Revision 5 framework, paying close attention to controls for Access Control (AC) and Audit and Accountability (AU).
- Make annual data security audits by independent, third-party firms a non-negotiable for any government agency that manages veteran data.
- Create a dedicated ombudsman’s office inside the Department of Defense (DoD) that veterans can actually contact to report security problems and get answers about their data.
1. Understand the Current Regulatory Framework and its Gaps
You can’t advocate effectively if you don’t know the playbook. The main laws on the books are the Privacy Act of 1974 and the yearly National Defense Authorization Act (NDAA). They’re supposed to provide a baseline of protection, but in practice, they often fail, especially when you’re talking about ancient IT systems and the mountains of data agencies like the DMDC are sitting on.
Take the Privacy Act. It says agencies have to keep accurate, relevant, timely, and complete records, but it’s vague on the specific tech standards needed to do that today. The NDAA gets updated all the time, but it can easily miss cybersecurity rules for the old databases that are somehow still running. A lot of these systems use ancient protocols that are sitting ducks for modern attacks. A law on the books is just paper unless it forces agencies to adopt the most current, rigorous standards out there.
Pro Tip: Focus on Specific Legislative Language
When you talk to lawmakers, don’t just ask for “better security.” That’s useless. You need to give them actual text for amendments. For example, you could propose language that explicitly requires all DoD and VA systems handling veteran data to follow NIST Special Publication 800-171 Revision 2 for protecting controlled unclassified information (CUI). Giving them this much detail makes your proposal concrete and hard for them to just brush aside.
“Clearly, the way that the highest confidential data, which is medical data, is being looked at by voyeuristic people in the NHS is disgraceful.”
2. Advocate for Adoption of Strong Data Security Frameworks
The frameworks from the National Institute of Standards and Technology (NIST) are the gold standard for cybersecurity, and any agency managing military data should be forced to use them. I’m talking about NIST Special Publication 800-53 Revision 5, “Security and Privacy Controls for Information Systems and Organizations,” which is basically a giant catalog of controls for federal IT systems. This stuff is foundational.
So, as an advocate, you should be pushing for laws that make agencies get regular, independent assessments against these NIST controls. No more letting them grade their own homework. We need external validation. Imagine a rule that required annual third-party audits for every system touching veteran data, with the non-compliance findings, redacted for security, obviously, made public. That would finally create some real accountability.
Common Mistake: Vague Calls for “Better Security”
Just asking for “better security” gets you nowhere because it’s too vague. You have to give lawmakers and agency heads specific, measurable things to do. Don’t say “improve data protection.” Say “mandate NIST SP 800-53 Rev. 5 compliance across all DoD and VA data systems, verified with annual independent audits.” Being this specific gives them a clear target and a real path to get there.
3. Demand Transparency and Accountability Post-Breach
After a data breach, veterans are often left completely in the dark about what happened. Advocates have to fight for policies that force agencies to be clear, fast, and thorough with their notifications. They need more than a form letter saying their data was compromised. They need to know exactly what data was exposed, what the real-world impact could be, and what the agency is actually doing to prevent it from happening again.
Veteran homeowners. Want to lower your monthly payments?
See if a VA Cash Out Loan or VA Home Loan can put cash in your pocket or help you buy with $0 down. A specialist will review your options, free.
- VA Cash Out Loan: use up to 100% of your home’s equity
- VA Home Loan: buy a home with $0 down payment
- No cost, no obligation eligibility check
You’re all set.
A VA loan specialist will reach out shortly to review your Home Loan and Cash Out options.
You have to establish clear lines of accountability. When a breach happens, who’s on the hook? Are there any consequences for negligence? Right now it’s almost impossible to pin down who’s responsible, so the same mistakes happen over and over. Advocates could push to create an investigative body for federal data breaches, kind of like how the NTSB investigates plane crashes. Give it real teeth to investigate, assign blame, and force agencies to make binding changes.
Pro Tip: Use Public Records Requests
Get good at using the Freedom of Information Act (FOIA). File requests for details on old breaches, internal security reports, and audit results. Sure, they’ll redact some of it for national security reasons, but FOIA requests can turn up damning patterns of non-compliance or ignored warnings that will make your case much stronger. If you study past failures, you can help prevent the next one.
| Policy Fix | Option A: Legislative Amendments (NDAA) | Option B: NIST Framework Adoption | Option C: Transparency & Accountability |
|---|---|---|---|
| Addresses DMDC 2019 Breach Type | ✓ Indirectly, by forcing higher standards | ✓ Directly, via strong controls | ✓ Post-breach response |
| Advocacy Target | Congress (e.g., House Vet Affairs Cmte) | Agencies (via legislative mandate) | DoD/Congress (to create new bodies) |
| Key Framework/Standard | NIST SP 800-171 Rev. 2 (CUI) | NIST SP 800-53 Rev. 5 (Security Controls) | N/A (it’s about process) |
| Mandates Regular Audits | Can be added | ✓ Annual, independent, third-party | ✓ Via investigative body |
| Direct Channel for Veterans | ✗ No direct channel | ✗ No direct channel | ✓ Creates a direct line via Ombudsman |
| Focus on Legacy Systems | ✓ Can target legacy systems specifically | ✓ Applies to all systems, new and old | ✗ Secondary focus |
| Accountability for Negligence | Partial (through legal requirements) | Partial (through public audit findings) | ✓ Main goal is to assign blame/consequences |
4. Champion the Modernization of Legacy Systems
A lot of these data vulnerabilities come down to one thing: ancient IT. The DMDC breach is a perfect example, showing the danger of systems that have been patched together for decades instead of being properly rebuilt from the ground up. Advocates have to get loud and demand serious, long-term funding to modernize these legacy systems at both the DoD and the VA.
This requires strategic investment, not just blindly throwing money at the problem. For new systems, that means pushing for a “cloud-first” policy to take advantage of the security and scale you get from modern cloud platforms. It also means setting hard deadlines for getting critical veteran data off those old, dusty servers. The Department of Veterans Affairs (VA) has made some progress, but they’re moving too slowly for how fast the threats are evolving. We need a mandatory, phased modernization plan, and they need to report their progress to Congress regularly.
Common Mistake: Underestimating the Cost of Inaction
Of course, the first argument against modernization is always the budget. Advocates need to be ready to counter that by spelling out the massive financial and human costs of doing nothing, the identity theft, the fraud, and the complete destruction of trust. The cost to prevent a breach might seem high, but it’s nothing compared to the long-term cost of cleaning one up. You can even quantify this by using public data from the GAO or other firms that track what these breaches actually cost.
5. Foster Inter-Agency Collaboration and Information Sharing
A veteran’s data is scattered all over the place, DoD, VA, the National Archives, even state-level veteran departments. When every agency has its own data silo, you create huge security gaps. When information isn’t shared properly, you get duplicate data, conflicting security rules, and nobody has the full picture of a veteran’s records. Advocates need to push for policies that force these agencies to actually work together on security.
What would that look like? Maybe a joint DoD-VA cybersecurity task force that’s only job is veteran data. It could create unified standards and share threat intelligence. Imagine if a vulnerability found in a DoD system automatically triggered an alert and fix across all VA systems using similar tech. That kind of coordinated defense just doesn’t exist right now. Creating a central, secure data repository, with very tight access controls and audit trails, of course, that authorized people from both agencies can use would be a huge improvement.
Pro Tip: Highlight Successful Civilian Models
Point to examples where this is already working. The financial sector shares threat intelligence all the time. Other government agencies have figured it out. Yes, military data is sensitive, but the basic ideas of secure data sharing are the same. You need to show them that this kind of collaboration actually works in the real world, proving it’s possible with the right rules and real buy-in from leadership.
6. Help Veterans with Better Data Control and Education
In the end, veterans are on the front lines when their data gets stolen, so they need to be able to defend themselves. Advocates should push for tools that give veterans more control over their own data and better training on digital security. This means demanding features on government sites like VA.gov or MilConnect that let a vet see exactly what data is being stored, who’s looked at it, and allow them to set their own privacy controls.
That’s why solid, ongoing cybersecurity training needs to be standard issue. It has to be a continuous resource, not just a quick briefing you get on your way out the door. This training needs to cover the basics: how to spot phishing scams, use strong passwords and multi-factor authentication, and what to do when something looks suspicious. The VA could even team up with VSOs to get this training out to veterans where they are, making sure it’s accessible and actually useful. When you give vets the right knowledge, they’re much harder targets for criminals after a breach happens.
Advocating for better military data standards is a long game. It takes constant watchfulness, detailed work, and real commitment. Focusing on these key areas, legislation, frameworks, transparency, modernization, collaboration, and veteran education, is how advocates can actually move the needle and improve security for the people who served. This is about protecting data, yes, but it’s really about upholding the trust we place in the system and the dignity of our veterans.
What is the DMDC breach, and why is it significant for veteran advocacy?
The 2019 DMDC breach exposed the personal information of over 200,000 service members and veterans. It was a massive failure that showed just how broken the government’s data management is, making it a key talking point for why we urgently need stronger data standards and real accountability.
Which specific data security frameworks should advocates push for?
Focus on the big ones: demand that the government mandates and actually enforces NIST Special Publication 800-53 Revision 5 and NIST Special Publication 800-171 Revision 2. These need to be the rule for every single DoD and VA system that touches veteran data, no exceptions.
How can advocates ensure greater accountability after a data breach?
Demand policies that force agencies to provide quick and clear notifications that tell vets exactly what data was lost and what’s being done about it. A huge step would be creating an independent group, like the NTSB for data breaches, that can investigate failures, assign responsibility, and force agencies to make changes.
What role does legacy system modernization play in data security?
Old, outdated IT systems are a huge security risk and a favorite target for hackers. A core part of advocacy is pushing for the money to actually modernize these systems across the DoD and VA. This means moving to the cloud and setting hard deadlines to get critical data off old servers for good.
How can veterans be empowered to better protect their own data?
Give them tools and knowledge. Advocates should push for features on sites like VA.gov that let veterans see their own data, check who has accessed it, and control their privacy settings. At the same time, demand ongoing cybersecurity training on phishing, multi-factor authentication, and other basics to make them a harder target for criminals.
