Ex-VA hospital worker admits offer to sell veterans’ data for $100,000

A former database administrator at the Veterans Affairs Medical Center in North Little Rock admitted Tuesday in 2017, he offered to sell the personal data of veterans, their dependents and employees for $100,000.

The information “would be particularly valuable to identity thieves,” he told a confidential informant for the VA’s Office of Inspector General, noting it would include personal account information for employees who made over $50,000 a year, according to court documents.

Phillip Keith Hill, 33, of Benton, was indicted Jan. 9, 2018 on three charges — attempted trafficking of Social Security numbers and other personally identifiable information, aggravated identity theft and possession of device-making equipment. On Tuesday, he pleaded guilty before U.S. District Judge Brian Miller to the first charge, in exchange for the dismissal of the remaining charges.

He had been facing a jury trial on all three charges beginning Oct. 28.

According to a criminal complaint filed Dec. 18, 2017, Hill was arrested the previous day, which was 12 days after he was fired for excessive absences and poor performance. Kris Raper, a special agent for the Department of Veterans Affairs, said in the complaint that his office had received information beginning in October that a department employee was stealing personal information from patient and employee databases.

Raper said after Hill was identified as the suspect, the agent talked to his former girlfriend, who said she didn’t know what he might be doing at the medical center, but she had seen him with blank plastic cards he was planning to use to make fake identification cards and fake credit cards. The woman said Hill “buys credit card numbers from web sites and apps on his personal cell phone,” according to the complaint.

The agent said he also received information from another law enforcement agency about Hill’s efforts to sell the Veterans Affairs data.

The confidential informant later showed the agent messages he and Hill exchanged, including one in which Hill insisted on being paid $100,000 for the material, “given the amount of work involved and the fact that he would be committing a federal crime,” the agent wrote.

In monitored conversations between the informant and Hill, Hill even explained in detail how he could organize the data to suit a buyer’s needs, and asked the informant to have the buyer provide a “wish list” of data fields, such as names and Social Security numbers, that the buyer wanted to easily access, Raper said.

Despite having been fired, Hill told the informant he could still access the Veterans Affairs information remotely, using one of the department’s computers he had at home or by stealing one of the servers, according to Raper’s affidavit.

It said in one of the monitored calls between the two men, Hill told the informant he was heading to North Little Rock to remove the Veterans Affairs server and copy personal data.

Several hours later, the agent wrote, Hill was spotted in a parking lot outside the Medical Center. A short time later, he was arrested by federal agents in a bathroom outside a secured hallway where the servers were located.

The agent had already confiscated a computer Hill had used at the office and had instructed Hill’s manager to remove his access to all databases, according to the document.

Hill appeared Tuesday before Miller with defense attorney Chris Tarver of the federal public defender’s office.

When sentenced at a later date, after a pre-sentence investigation is completed, Hill will face up to 10 years in prison for trafficking in Social Security numbers, and up to three years’ supervised release.

Miller told Tarver and Assistant U.S. Attorney Jana Harris he would accept the plea, but because he wasn’t sure if his personal data might be among the data was compromised, he would recuse from the case, which will result in a different judge being assigned to the case for sentencing.

Harris told the judge all 1,400 people whose data may have been compromised had been notified, so he likely wasn’t among the victims.