Slashdot Mirror
British MoD Stunned By Massive Data Loss
Master of Transhuman writes "Seems like nobody can keep their data under wraps these days. On the heels of the World Bank piece about massive penetrations of their servers, the British Ministry of Defense has lost a hard drive with the personal details of 100,000 serving personnel in the British armed forces, and perhaps another 600,000 applicants. This comes on the heels of the MoD losing 658 of its laptops over the past four years and 26 flash drives holding confidential information. Apparently the MoD outsources this stuff to EDS, which is under fire for not being able to confirm that the data was or was not encrypted."
No. EDS lost a hard-drive, belonging to the MoD. Had to get that in before the "Government is intrinsically incompetent" posse got here. EDS, a privately owned and run subsidiary of Hewlett-Packard, subcontracting to the MoD, were responsible for the security of this drive, and they, not anyone at the MoD did the losing here.
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
I can confirm that the data was or was not encrypted.
Fleur de Sel
this is the reason why the brits have to spy more....'cuz it's about quantity.....if u have more data coming in.....than that is going out (aka losing)...then u'r golden.
(I don't think it's a coincidence that this was posted after the bit about the brits needing to spy more)
They want to spy more so they can gather more information to lose.
Seriously, lately it seems not a week goes by without some ridiculous data leak in the UK. Whether it be thumbdrives that automatically log into private networks, laptops being stolen, documents being left on a train, confidential information being lost in the post etc...
They won't need the Data Protection Act much longer in the UK because there'll be no data left to protect as it'll all have been leaked.
Update from MOD http://www.mod.uk/DefenceInternet/DefenceNews/DefencePolicyAndBusiness/ModIssuesUpdateOnMissingEdsHardDisk.htm
The only time I have ever lost a device is when I was mugged and my phones were taken from me and I'm just any other person.
It should be interesting to see what the ratio of laptops lost to all laptops provided is. Maybe this cynicism is because I live in India where corruption is rampant and entire flyovers can be 'lost', but I'm a bit suspicious about this whole thing.
Also, if they're losing laptops with information at such a high rate, at what rate are they losing paper files? Surely it's harder to keep track of the 20 binders with 100 sheets in them than it is to keep track of one hard drive?
I find it hard to believe that these people are really that incompetent. Hanlon's Razor doesn't always apply.
"I'm just looking forward to when the data gets lost."
From the summary of that post. 3 hours ago.
...Holy Crap.
We know they're abusing their power. We know that they're incompetent!
And it never changes! It just happens again and again and again!
I don't know whether to laugh or cry or scream or kill or just give up anymore. I just don't know.
...of why we shouldn't be outsourcing critical/sensitive data handling. Yes, Government departments can cock-up enough without external help, but so many of these data loss issues at the moment seem to be the fault of a private company they've outsourced to.
Also, I worry about the outsourcing of anything relating to our Country's security. When you give the job to the lowest bidder, what can you expect but a barely adequate service?
Information wants to be free.
Don't fight for your country, if your country does not fight for you.
His point was that if someone wants the data, eg they actively stole the hard drive, then they are likely to steal or obtain the mechanism to decrypt the data too.
Not really. Where I work, any laptop connected to the network is checked at every connection for the presence of active full disk encryption software. If it isn't found (which can happen when computers are being built and the encryption installation hasn't been completed) then an immediate alert is sent to the support staff nearest the machine. In response to that alert, the machine must be encrypted or seized immediately. We're talking same-day action, here, with the consequence of inaction being that someone gets fired.
The result is that when we lose (usually through theft but the method is unimportant in this context) a laptop, we can immediately report that said laptop was fully encrypted and no data was lost or is at risk.
If we need to let a contractor on our network, we set up one of our laptops to meet all security requirements and lend that hardware to the contractor. No contractor is allowed to put their machine on our network.
Finally, when data is written to removable media, it's encrypted. We run a software package (Guardian Edge) that forces all writes to removable media to be encrypted. It's a pain sometimes, but it's the least we can do to keep the publics private data safe.
Frankly, I'm shocked that the MOD would accept less stringent practices on the part of contractors. I know we don't.
or they're just moving to a more distributed data system, they want to spy on you so they can see the data you now hold. Its like a bittorrent data-storage solution, all these 'lost' laptops and pendrives is a secret mechanism of distributing the data in the most widely and random way - thus adding to the security of the overall system, as no-one else knows where its ended up.
See, its simple really :-)
From TFA:
"The portable drive contains the names, addresses, passport numbers, dates of birth and driving licence details of around 100,000 serving personnel across the Army, Royal Navy and RAF, plus their next-of-kin details. "
Wow. Just... wow.
The person who finds this and wants to exploit it would become unimaginably rich on stolen identities for pretty much the rest of their lives. I suppose if the MoD have a record of exactly who's details were on the disk, they could re-issue things like national insurance numbers and driving licences to prevent that, but even then the possibilities for other avenues of exploitation using this information would be huge (next of kin, for pity's sake!!).
Data like this needs to be treated as if it were nuclear waste or a volatile explosive mixture. It would be just about OK to have a list of 100,000 driving licence numbers if these were kept physically separate from, say, names and addresses (eg keying them on a one-time ID), but when certain classes of data are kept TOGETHER like this, it should be every right-thinking person's reaction to scream the house down in panic.
We have to assume that at some point, all data will leak out somewhere. All we can do is to to ensure than when it does, it's not actionable. Oh, and by the way - you can forget encryption. People don't understand it and in most cases those who steal data will steal or otherwise obtain the keys as well.
"And the meaning of words; when they cease to function; when will it start worrying you?"
This:
is one of the best questions I've ever seen posted on Slashdot. With an election looming, it's a question that every voter should ask themselves. Whoever modded it flamebait is a dufus.