By far, the worst criminal in this case is the jerk government
> employee who took the data home.
I strongly disagree. The criminals were the kids who stole the laptop, and the other criminals who perform identity theft. A second level of criminals are those who created a system where identity theft is a profitable enterprise, that is, allowing stolen identies to make money. This is the area that needs reform.
Until very recently, the data involved was not considered "sensitive". It's not military secrets. Until recently, having the data was worthless because you couldn't do anything with it. But that was then.
What nobody -- government, business, and the armchair critics -- seems to realize is that it's real easy to take home sensitive data without even realizing it. It's very common for people to take home work; people have done so for years. A person might be working on a particular data column and not realize the row (record) contains sensitive stuff like SSN or other critical stuff.
Don't forget that at one time work consisted of file folders. It's hard to manipulate the data stored within. But now work is encoded on computers and easy to steal and manipulate.
The Nixon Administration warned that the use of the SSN as a universal identifier was dangerous for privacy concerns way back then and recommended against it. Today it is the universal number and impossible to function without it. The government requires kids to get one at birth. Almost all organizations require it to check credit on someone.
The retail world loves instant credit. That should be illegal. Anyone wanting a credit card should have to fill out a handwritten application and mail it in, with the card returned by Registered Mail. A nuisance and expense no one would tolerate, but one that would go a long way to control identity theft and fraud. There are other controls that could and should be instituted by retailers won't tolerate them.
Ordering on-line must get more controls to prevent fraud.