Slashdot Mirror
UK Intel Agency's Missing Laptops Might Contain Sensitive Data
superapecommando writes "GCHQ lost 35 laptops in one year, potentially containing highly sensitive data. The UK's electronic spy centre was today lambasted by MPs for having a 'cavalier' attitude to data security. The centre is responsible for tracking the electronic communications of terrorists. In a new report, the Commons Intelligence and Security Committee expressed concern that GCHQ appeared to be entirely unaware whether or not the computers, lost in 2008, contained top secret information on people posing an imminent security threat to the country."
'lost laptop' translates as 'executive perk'.
This is about the UK. What's a US citizen got to do with it?
I did not understood the relation between Intel and UK MP's until I thought the word may have been abbreviated.
I've always wondered whether these 'lost laptops' are simply the personal laptops of employees, that should never have been anywhere near anything to do with GCHQ, and GCHQ is just being overly cautious (does not know what, if any, data accidentally ended up on a personal laptop, so assume the worst). Or it could just be garden variety incompetence. Except for the unlikely event of an intelligence service disclosing far more information than would be prudent, there's little to tell either way.
What do they mean by lost? Is it lost like "Lost in space", "Just lost The Game" or "Sorry, I *lost* my homework"?
My ignorance is just as good as your knowledge.
Well, surely it has been appropriately encrypted with strong encryption and protected with a strong password. After all, those people are not completely incompetent, are they?
The Tao of math: The numbers you can count are not the real numbers.
This should not be a problem IF the hard drives are full disk encrypted. Now the "if" in the previous sentence is the crucial point...
Where is Jack Bower when you need him?
That kind of gives the impression that GCHQ are trying to recruit hackers from the counter culture by advertising in tube stations.
And on Slashdot, apparently.
Forget thrust, drag, lift and weight. Airplanes fly because of money.
Quite a few others should also/rather want to know whether the computers contained information on people under an imminent security threat; information compiled by none less than the officials on a mission to protect them.
This begs the question if an eavesdropping agency losing 35 laptops in a year can really be called "responsible" for anything, or rather just irresponsible.
That's a great idea. You know where London 2600 is held, right? Pretty sensible place to advertise, then - and if the Security Service and Secret Intelligence Service are advertising, why not GCHQ, the great-granddaddy of the father of modern computing and cryptology?
The big challenge is that all the people with the requisite expertise in that particular field either have ethical problems with working for a government that does things that runs contrary to their personal beliefs (restrictions on free speech, mass surveillance and censorship, certain recent unpopular wars, and so on), or they don't really have anything left in the way of ethics at all (in which case, their trustworthiness is very limited, and they may already be working for organised crime or another government).
Many of the older ones have retired from doing that kind of thing and settled down, and the problem with that is that their skill set is unlikely to be current. There are of course timeless techniques, but the field also moves very quickly and rediscovers new things in different ways, so keeping current is important.
Of course, there are always new ones. Fresh talent does emerge and can probably be recruited in larval form, but not all hacking is self-taught, and the difference between a good hacker and a world-class hacker is things picked up from experience and teaching. Mentoring. But part of that is the counter-culture mindset, it's a required part of the critical thinking needed. Some people are needed to teach, and teach very very well. But the problem is that those people do not want to work for the UK government, even in a teaching capacity.
A similar problem emerges when trying to buy a covert remote intelligence tool (CRIT). What to do; license Zeus? Hardly. The Chinese did something similar, and as you no doubt heard it turned out worryingly successful with a simple black market Trojan and some very astute targeting. But you can scarcely expect that to work the same way twice. Something rather more advanced is needed, but those that have developed more advanced tools have essentially told the intelligence agencies to go screw themselves or are otherwise people it would be recommended to avoid dealing with (as above). So a tender was raised at a recent conference and there have been no decent bids (General Electric almost don't count).
Anyway. As for the story, the key word is "might". This audit is ahead of a new system proposed to modernise the key management by introducing ubiquitous security tokens, and full-disk encryption in software (TOP SECRET uses specialist hardware devices rather than hard disks right now). The problem here is a lack of yearly auditing, and unmarked, uncleared notebooks that should not have touched classified information, and probably did not if best practices from the CESG were followed, but conceivably could have done, which is unacceptable and something that needs to be addressed...
They look downright responsible compared to the US Department of Homeland Security who supposedly lost over 1,000 laptops in a single year (2008).
The centre is responsible for tracking the electronic communications of terrorists
...which is hardly feasible without having access to everyone's communications
Try "known or suspected terrorists" in the sentence in place of simply "terrorists" and all will be made right. Or as right as it gets.
Quite a few others should also/rather want to know whether the computers contained information on people under an imminent security threat; information compiled by none less than the officials on a mission to protect them.
Well, that's not their mission, but I guess it's not impossible. Usually if it does contain such information, it's on employees of the division in question, though not always.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Now they can make a law that will allow police to search your data without any court order in the interst of Queen and country. Because YOU could be the one that has that unknown data. As such you are also the potential criminal, so your DNS can be taken.
So all people owning a portable will be searched and their DNA will be taken. Also people who live together, are related to, work together with, know somebody who or have ever seen somebody who either owns a portable, a computer, a device connected to the Internet or heard about it, will be searched and added to the database.
No worries. Nobody can access that database or even hack it. It is placed on a portable so it moves around to avoid any physical attacks.
Don't fight for your country, if your country does not fight for you.
Don't care? Don't read it. This site may be based in the US and heavily biased towards it, but it has an international readership.
It's official. Most of you are morons.
Why didn't the UK mandate TrueCrypt (or equivalent) on laptops holding sensitive data?
[Insert pithy quote here]
Why not? Perhaps you should. You think they only contain secrets relevant to the UK? How can you be sure.
If a spy agency, any, loose data/intel it is probably a concern to more then the people in the country where the agency belongs since spying is a global business.
Yeah. They are. Been on the Tube recently?
All intents and purposes. Not intensive purposes.