British MoD Stunned By Massive Data Loss

Master of Transhuman writes "Seems like nobody can keep their data under wraps these days. On the heels of the World Bank piece about massive penetrations of their servers, the British Ministry of Defense has lost a hard drive with the personal details of 100,000 serving personnel in the British armed forces, and perhaps another 600,000 applicants. This comes on the heels of the MoD losing 658 of its laptops over the past four years and 26 flash drives holding confidential information. Apparently the MoD outsources this stuff to EDS, which is under fire for not being able to confirm that the data was or was not encrypted."

Comments

No, no, no

[gowen]

the British Ministry of Defense has lost a hard drive with the personal details of 100,000 serving personnel

No. EDS lost a hard-drive, belonging to the MoD. Had to get that in before the "Government is intrinsically incompetent" posse got here. EDS, a privately owned and run subsidiary of Hewlett-Packard, subcontracting to the MoD, were responsible for the security of this drive, and they, not anyone at the MoD did the losing here.

Re:No, no, no

[gowen]

Fuck Labour.

What? Do you really believe a politician made the decision on whom to outsource data management too?
Are you familiar with the concept of a civil service at all? Do you know who runs the day-to-day operations for the MoD?

Clue: Decisions like "Which subcontractor should we hire" are not made by the Secretary of State for Defence.

Re:No, no, no

[Zsub]

Are you just an idiot?

How does the fact that this company loses the gov'ts data not imply that the gov't loses data? Please tell me if this logic is flawed...

And does it actually matter who loses the data? I mean, I don't live there, I can't be arsed, it's not my private information but the whole point of my post was that the UK gov't loses data. Who exactly magically makes the disks or flashdrives disappear is besides the point.

Re:No, no, no

[cyber-vandal]

But the overuse of external subcontractors is a political decision. Fuck New Labour and fuck the Tories who started it all.

Re:No, no, no

[hdparm]

Why are you so apologetic on behalf of the British government? The drive was the responsibility of MoD. This includes the choice of people and/or organisations who do the handling. Likewise, even if the EDS was not the minister's choice, he should have been sacked because he hasn't made the decisions of this magnitude his choice.

Re:No, no, no

[CountBrass]

And who decided that EDS were competent to manage the MoD's data? That would be the MoD i.e. the government. So it is the Government that is intrinsically incompetent: they have a history of either handing over vast amounts of private data to untrustworthy companies (EDS, PA Consulting, Capgemini) or of losing it themselves (HMRC, Home Office, SIS).

In law under the Data Protection Act the MoD, not EDS, are the Data Controller and therefore responsible for losing it.

I can!

[matt4077]

I can confirm that the data was or was not encrypted.

Re:Hardly 3 hours

[Goldberg's Pants]

They want to spy more so they can gather more information to lose.

Seriously, lately it seems not a week goes by without some ridiculous data leak in the UK. Whether it be thumbdrives that automatically log into private networks, laptops being stolen, documents being left on a train, confidential information being lost in the post etc...

They won't need the Data Protection Act much longer in the UK because there'll be no data left to protect as it'll all have been leaked.

News from MOD

[auric_dude]

Update from MOD http://www.mod.uk/DefenceInternet/DefenceNews/DefencePolicyAndBusiness/ModIssuesUpdateOnMissingEdsHardDisk.htm

Are they really being lost?

[argiedot]

The only time I have ever lost a device is when I was mugged and my phones were taken from me and I'm just any other person.

It should be interesting to see what the ratio of laptops lost to all laptops provided is. Maybe this cynicism is because I live in India where corruption is rampant and entire flyovers can be 'lost', but I'm a bit suspicious about this whole thing.

Also, if they're losing laptops with information at such a high rate, at what rate are they losing paper files? Surely it's harder to keep track of the 20 binders with 100 sheets in them than it is to keep track of one hard drive?

I find it hard to believe that these people are really that incompetent. Hanlon's Razor doesn't always apply.

Re:Are they really being lost?

[Anonymous Coward]

Business travellers in the US and Europe lose a staggering 15,648 laptops per week, according to a new study by Dell.

So one shouldn't be surprised that laptops go missing, if the study is anything like accurate.

Re:Hardly 3 hours

[Dr. Hellno]

"I'm just looking forward to when the data gets lost."

From the summary of that post. 3 hours ago.

...Holy Crap.

We know they're abusing their power. We know that they're incompetent!
And it never changes! It just happens again and again and again!
I don't know whether to laugh or cry or scream or kill or just give up anymore. I just don't know.

Yet another example...

[Firefalcon]

...of why we shouldn't be outsourcing critical/sensitive data handling. Yes, Government departments can cock-up enough without external help, but so many of these data loss issues at the moment seem to be the fault of a private company they've outsourced to.

Also, I worry about the outsourcing of anything relating to our Country's security. When you give the job to the lowest bidder, what can you expect but a barely adequate service?

Government Incompetence?

[BenEnglishAtHome]

Isn't that the definition of a government?

Not really. Where I work, any laptop connected to the network is checked at every connection for the presence of active full disk encryption software. If it isn't found (which can happen when computers are being built and the encryption installation hasn't been completed) then an immediate alert is sent to the support staff nearest the machine. In response to that alert, the machine must be encrypted or seized immediately. We're talking same-day action, here, with the consequence of inaction being that someone gets fired.

The result is that when we lose (usually through theft but the method is unimportant in this context) a laptop, we can immediately report that said laptop was fully encrypted and no data was lost or is at risk.

If we need to let a contractor on our network, we set up one of our laptops to meet all security requirements and lend that hardware to the contractor. No contractor is allowed to put their machine on our network.

Finally, when data is written to removable media, it's encrypted. We run a software package (Guardian Edge) that forces all writes to removable media to be encrypted. It's a pain sometimes, but it's the least we can do to keep the publics private data safe.

Frankly, I'm shocked that the MOD would accept less stringent practices on the part of contractors. I know we don't.

Re:Government Incompetence?

[lysergic.acid]

there's no inherent reason for the government to be incompetent. but it's always those who want to cut down on public infrastructure and social welfare programs that are incompetent themselves. of course when you elect such people into government they make a complete mess of things and use their own incompetence as an excuse to hand these roles over to the private sector.

i mean, how can you put people who don't believe in public infrastructure in charge of public infrastructure? it's a self-fulfilling prophecy.

Re:Government Incompetence?

[BenEnglishAtHome]

what kind of tricky stuff are you doing to detect full-disk encryption on any machine that touches the network?

I don't know. I'm on the receiving end of those alerts, so I know they happen. Exactly how, I'm not sure. Our logon scripts do all sorts of stuff, including automatically installing updates to vertical apps, so checking for full disk encryption wouldn't seem to be too hard a task. I know there are certain files on the machines that do not exist until encryption has been installed and fully enabled. I assume that looking for them would be trivial. But that's just a guess.

To show you how tight our scans are, we had a contractor who plugged a personally-owned USB key into his IRS-issued laptop. It contained some basic maintenance tools as well as some network monitoring tools. He wanted some simple utility, I forget which one, and instead of asking for it through channels he just plugged in his copy. Literally *5* minutes after he plugged in the key, his machine was deleted from the domain and his personal identifier was wiped from all systems, just like we do when someone is fired. 5 minutes after that, his boss got a call from our security office explaining that the employee was being reviewed for termination. The boss explained that he was a good guy, new to the organization, just made a mistake, and asked for some slack. Ultimately, the guy got a two-week suspension and then had to re-build everything (system access permissions, etc.) as if he were newly hired.

I really don't question the notion that our monitoring does a good job of catching any funny business.

And more importantly (assuming that this requires a boot-time password; I've never bothered with any serious encryption), do you have something that detects the sticky note on the bottom of the laptop with said password?

This is one of the areas where we take a notably sensible approach. Our security rules that each person must sign and obey do NOT prohibit writing down passwords. It's officially discouraged but not prohibited. We take the attitude that as long as that list is protected, like people protect their ID card, door key card, and credit card, there's no problem.

Nobody puts a sticker on the bottom of their laptop or keyboard. We have constant security inspections, usually after hours, and doing crap like that gets you disciplined severely.

I wont go into excess detail (which, by itself, would be a violation of our security rules) but suffice it to say that if you wanted to steal and get data off an IRS laptop, you'd have to mug the user, get their password list, know their internal ID (which no one writes down because we use it constantly) then mug a different person with local machine administrator credentials, get logons and passwords from that person, then know exactly where to type all of them in without making more than three mistakes to lock up the machine.

The only people who could successfully get information off our laptops would be our admins. But we can get to that stuff internally, already, so that's not a realistic threat.

Realistically, the only thing a thief can do with a stolen IRS laptop is wipe it, install an OS, and use it.

Re:Hardly 3 hours

[gbjbaanb]

or they're just moving to a more distributed data system, they want to spy on you so they can see the data you now hold. Its like a bittorrent data-storage solution, all these 'lost' laptops and pendrives is a secret mechanism of distributing the data in the most widely and random way - thus adding to the security of the overall system, as no-one else knows where its ended up.

See, its simple really :-)