Tim Smith, Greenville News
COLUMBIA - Senators are discussing a plan to reimburse those who suffer financial losses from last year's hacking at the Department of Revenue, a plan that might also create a fund for victims of the 2011 Cleveland Park miniature train crash.
The proposal by Sen. Vincent Sheheen, a Camden Democrat who ran unsuccessfully against Gov. Nikki Haley, would amend a cyber security bill crafted in the wake of the breach.
The Senate voted to carry over the bill until today to give senators a chance to work more on details.
Sheheen said he believes the state has a "moral obligation" to cover the financial losses of anyone victimized by the breach.
"Our state, through what we all know was a complete failure to protect the most personal and private information of the citizens of South Carolina, allowed millions of records to be stolen," he said. "It is our responsibility, if a citizen suffers financial harm because of that, the state make that person whole. That is a core concept of our law in South Carolina."
Dozens of people have told DOR that they have been the victims of identity theft and believed the hacking is the cause, GreenvilleOnline.com reported last month. But DOR Director Bill Blume said then his staff has looked at each case and has not found any caused by the breach. A DOR spokeswoman said Tuesday that neither DOR nor law enforcement has identified any case directly related to the breach.
Sheheen said his plan would establish a fund but leave it to budget committees to decide the amount. He said it would only apply to those who have suffered a financial loss as a result of the hacking and would remain open for years in case those whose personal information was stolen in the breach are not victimized until much later.
Sheheen said the fund might only cover 25 to 100 people who show they have suffered a loss because of the hacking "but that's 25 or 50 or 100 too many."
The breach in September 2012 exposed an estimated 3.8 million Social Security numbers, 3.3 million bank account numbers and information for nearly 700,000 businesses.
Sheheen said while the state is paying for credit-monitoring services, "that's basically saying if you get ripped off, somebody is going to call and tell you. That's not enough."
Asked about the proposal, Rob Godfrey, Haley's spokesman, told GreenvilleOnline.com the governor looks forward to working with lawmakers on cyber security.
"It's important that we get the best and most comprehensive bill possible through the General Assembly this session," he said.
Other senators said they agree with the idea but questioned how it would work.
Sen. Paul Thurmond of Charleston questioned whether people have the ability now to use the courts to recover their losses. Sheheen said they do not.
He said the state's Insurance Reserve Fund, which covers claims made against the state, does not cover any claims that are the result of the breach.
"I don't want to throw it into the legal system where people have to file lawsuits against the state," Sheheen said. "I'd like us to have a streamlined administrative system."
Sen. Kevin Bryant, an Anderson Republican who co-chaired a panel that investigated the breach, asked if victims should attempt first to recover losses from the identity thief, if caught.
Sheheen said he would be willing to add a provision to his proposal for the state to recover any loss paid out from anyone charged in connection with the hacking.
Bryant argued that some agencies haven't responded to the breach seriously enough and asked if there was a way to use the establishment of the fund to hold them accountable.
"I would be very open to incentivizing those agencies to being more competent and serious," Sheheen said.
Sen. Paul Campbell of Goose Creek asked if there was a requirement that victims have enrolled in some protection service like that offered citizens through Experian before becoming eligible for aid.
Sheheen said there are more than a million victims of the hacking who did not sign up for the Experian's service. He said he believes there are hundreds of thousands of people who still do not know about the hacking or have moved away from the state.
He said he is open to the idea that if someone did not take some action to monitor their credit or protect themselves after the hacking became public that they not receive full reimbursement for any loss.
"I would hate to punish some person, because of what the government did wrong, who doesn't keep up with the newspaper or TV or moved out of state," he said. "There are people who are 90 that live in a nursing home that might not know."
Sen. Thomas Alexander, a Walhalla Republican who chairs the Senate Labor, Commerce and Industry Committee, asked how the state could confirm the loss was the result of the hacking.
Sheheen said the best way to deal with that is to treat it as other special funds are, leaving the regulations to the state's treasurer.
"Identity theft has been going on for quite some time," Alexander argued.
Replied Sheheen, "Not on the scale that has been in South Carolina for the last year."
Sen. Shane Maassey, an Edgefield Republican and lawyer, said someone has to decide whether the loss is eligible.
"I'm with you on the overall concept," he told Sheheen. "I don't know that I like the idea of leaving it to regulation. It seems to me that we ought to set out some type of cap on it."
He said someone could claim a loss of $1 million.
"If you lost your $1 million, you would want the state to pay you for what they allowed to happen," replied Sheheen.
Sen. Nikki Setzler likened it to the state compensating those whose property it takes. He said there is "substantial interest" in passing the bill in the Senate.
After Senate Majority Leader Harvey Peeler of Gaffney asked Sheheen about his thoughts on creating a fund for victims of a 2011 miniature train accident in Spartanburg's Cleveland Park that killed one child and injured 27, Sheheen said he agreed such a fund could also be established in the bill.
Peeler attempted to get a bill passed last year creating the fund with $2 million from the state but the bill failed to pass the House.