Slashdot Mirror
Auditors Report FBI Fails in Tracking Lost Laptops
An anonymous reader writes "The Department of Justice's Office of Inspector General is reporting that the FBI has lackluster performance when it comes to tracking data lost on missing laptops. In a recent 44-month audit (ending in Sept. 2005), the FBI reported 160 lost or stolen machines. Of those, ten were confirmed to have sensitive info. A startling 51 of these machines had unknown information — in other words the FBI never knew what they lost. Some of these machines likely contained some of the most sensitive security information the FBI has, as there were several in the bunch that belonged to members of the Counterintelligence and Counterterrorism Divisions. But the FBI was never able to properly respond to these losses because someone didn't fill out the right paperwork. The OIG has a copy of the audit (pdf) for public consumption."
That's why They've begun to issue a remote access product called the MobiKEY. It is a USB token with a smart card that creates an SSL tunnel with 2 factor authentication (some sort of PKI based scheme) to your work computer. The company that makes this has a managed service called MobiNET that helps to broker the connection so that even Joe Sixpack can connect anywhere there is a net connection. The beauty of this is that all the corporate data stays behind the co there's no data to lose. If you do lose the token, the human that has it has four attempts to guess the password before the SIM fries itself. So assuming your password isn't "password" or something stupid like that, it's secure.
This is my opinion. To make sure you don't steal it, it's covered by the DMCA.
Too bad Rumsfeld's not in a position to announce this to the public. I can hear the press conference now: "There are the ones we know we lost, then there are the ones we don't know we lost, then are are the ones we know are not lost....."
What if the Hokey Pokey really is what it's all about?
Unlike most, I at least skimmed through the IG report. Only a handful of those laptops were confirmed as stolen, the rest are simply lost. In my experience, lost usually means: another agency or department has it and the agency that originally procured it lost track of it; it was an ancient laptop and its in the bottom of a closet somewhere; or it was scrubbed and disposed of without the proper paperwork being done. Thefts do happen, but it's just a likely that the employee took it home and his kid is playing pac-man on it.
is that many people want the government to have even more control over our lives, mainly health care and retirement. Look, this is the FBI, if they cannot keep track of sensitive data how in hell can we trust another government organization to do better?
The problem with government entities is that Congress never writes laws that punish them. Corporations sure, if a corporation lost "sensitve customer data" you can be sure of howls in Congress and a rash of new laws punishing "evil" corporations. When its the government they turn their heads.
Accountability is the one thing the government has always lacked and the one thing they seem to want from everyone else, you, me, and any other non-government entity.
They should be held to higher standards than ANY corporation, school, or private organization. We entrust them with our lives, shouldn't they be required to prove they can handle that trust?
* Winners compare their achievements to their goals, losers compare theirs to that of others.
I've decided to comment instead of mod since I feel sure you'll get to 5 without me. This:
is the most insightful thing anyone is going to post on this topic. I'm in the middle of assisting with inventory issues in a major TLA. "Missing" laptops (Katrina/flood losses aside) are always explainable in these ways. Last week, a laptop that had been "lost" for over 5 years was found in a cabinet during an office move. Years ago, that laptop went on a public report as "lost." Our inventory tech had to fall on his sword and file paperwork removing it from active inventory because we couldn't find it. It wasn't taken home by anyone, stolen, or improperly passed on to another agency. It was simply misplaced.
Add to this the pallets of used equipment that get diskwiped and then donated to schools, a process often involving running around, looking for every unissued piece of obsolete equipment we can find and quickly doing whatever is necessary to get it onto the pallet, and you have a situation where laptops become "lost" in too-big numbers but without any real threat to anybodys security.
I would only be concerned, really, about two classes of losses. First is the handful (less than 10) that were stolen apparently due to negligence. However, in most of those cases, the data was routinely encrypted and, again, there's no security threat. Second are the 4 laptops that went home with employees when they retired. That's just inexcuseable.
Overall, 150 or so lost laptops in an organization that size is pretty damn good performance.
160 over three and a half years? Out of some 21,000? Doesn't seem overly excessive to me.
The article also fails to differentiate between NIPR (unclassified) and SIPR (classified) laptops. Regardless of your clearance, it's illegal to put classified information on a non-classified laptop. And classified laptops can not generally be taken home unless you have a certified storage location (a safe.) If they're not locked up, they should be in your direct possession at all times. If a significant number of classified laptops are missing, then it's a serious issue both in terms of the potential damage and in terms of users violating security procedures.
Non-classified laptops missing can be serious as well, particularly in terms of individual personal data being compromised and leading to identity theft or credit fraud. But the loss of sensitive-but-unclassified info is not nearly as serious in terms of the big picture as loss of classified data.
"The legitimate powers of government extend only to such acts as are injurious to others." Thomas Jefferson.