Nine months of access to an unencrypted personnel roster, and a department that will not say whether anyone was looking for it.