Slashdot Mirror
UK Police Fined For Using Unencrypted Memory Sticks
An anonymous reader writes "The Information Commissioner's Office has filed a suit for £120,000 against the Greater Manchester Police because officers regularly used memory sticks without passwords to copy data from police computers and work on it away from the department. In July 2011, thousands of peoples' information was stolen from a officer's home on an unencrypted memory stick. A similar event happened at the same department in September 2010. 'This was truly sensitive personal data, left in the hands of a burglar by poor data security. The consequences of this type of breach really do send a shiver down the spine,' said ICO deputy commissioner David Smith."
Shouldn't they build or buy a system that allows employees to remote in? I work for a school system, and the school resource officers (which are city police officers) just VPN into their network from ours, so that they don't have to physically transport anything. Many of them even use computers provided by us instead of their highly-ruggedized but massively obsolete laptops...
Do not look into laser with remaining eye.
Yes, a fine against the police department will certainly show them! Oh wait.. isn't it the taxpayers who pay for their budget... sooo, wouldn't that mean the taxpayers will wind up paying for this? Some of them, twice even -- once for the loss of data, and again when they have to pay for it with their next tax return (admitedly, mere fractions of a pence, but it's the principle of the thing). That seems like a terribly effective method of teaching those officers not to leave sensitive data around! Far more effective, I think, then suspending one without pay or additional training how how to properly handle sensitive information.
#fuckbeta #iamslashdot #dicemustdie
Really?
In 2012?
copy data from police computers and work on it away from the department.
Really? Aren't there such things as encryption and networks and the data staying on the bloody server?
--
BMO
instead of offloading the cost back on the community.
remoteing systems cost more then taking data home on a usb key.
computers provided my then has cost as well.
no way the union will let that happen and they will likely not even let the officers take the blame.
Any ways what is there story it was the only way to get there work done and the official way was not in place or there was none?
How effective it will be will depend on whether the police department is unionized or somehow protected by UK law against their own screwups. If not, people can actually be fired for this type of thing - and yes, that's effective.
I've got to think that remoting systems cost less than the labor to disinfect office computers from viruses brought in by USB flash media from home computers...
Do not look into laser with remaining eye.
Is there a way to (easily) turn off USB flash device ability in Linux (particularly Debian variants)?
All this while also preserving the ability to use USB mice and keyboards?
I'm not a lawyer, but I play one on the Internet. Blog
A burglar invaded an officers home. :D
You'd expect the officer to have some form of protection.
Remote terminals come out of the capital budget, virus removal comes out of the operations budget.
But a Kanguru encrypted flash drive is like $29! (US) That's A LOT of money for police officer equipment, lol.
Unless you format the flash stick with another file system, or put encrypt all of the data, flash shows up without needing passwords. There are a lot of encryption algorithms floating around. Truecrypt is good, Skipjack is still ok.
The problem is that there is simply no standard for encrypted removable storage... It seems every vendor of "encrypted" flash drives ships their own proprietary, usually windows-only binaries on the stick which may or may not work, and may or may not require various levels of privilege in order to install, and may or may not be full of all manner of security holes.
Pity the poor consultant carrying a windows laptop that contains all these various encryption drivers installed because he never knows what proprietary encryption scheme the next client will be using.
USB storage is a good standard, you can plug such a device into almost anything and it will be mounted and read... What we need is a similar standard for encrypted storage where you can plug it into almost anything, enter a password and it mounts without having to install any non standard drivers.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
That's hardly the point, it wasn't a question of money obviously - it was lack of thought.
Back in the 90s my home in Canberra (Australia's capital and a government town) was burgled. The first, and I mean very first, thing the police asked on arrival was, "I there any classified information involved?" I was standing there in my Air Force uniform, so I guess it was a reasonable question. Nothing I was working at the time could even remotely be considered safe to take home, encrypted or not, so the answer was a no-brainer. I guess I was dismayed that the event was common enough that the automatic response had kicked in though. Some things, it seems, don't change.
Patent litigation: A doctrine of Mutually Assured Destruction... in which everyone seems willing to push the button
...guaranteed general population jail time for ANY police officer found to be responsible for ANY data leak?
It would surely be incentive to properly secure data and make sure it fucking stays that way!
Operation Guillotine is in effect.
Yeah, fine the members of the department, so the individuals have to pay the fine. Then see how fast the situation changes.
I am firmly convinced that draconian punishments are counter productive and belong in places like North Korea. Why not just fix the problem? There clearly is a need for carting data around on USB sticks despite other options, else people would not be doing it. How about issuing only laptops/desktops with an OS that has been fixed so as to be unable to export data to anything other than hardware encrypted USB sticks like Iron Key and then make officers responsible for their USB key like officers are responsible for their fire arm if they carry one (and yes I have spent enough time in the UK to know most cops there don't carry a gun). Alternatively one could issue only computers incapable of mounting external storage.
Only to idiots, are orders laws.
-- Henning von Tresckow
Every single time I've heard about a large fine like this being imposed for breach of data protection law, there's been background information - usually aggravating circumstances that make the transgression rather worse.
And so it is here:
The ICO found that a number of officers across the force regularly used unencrypted memory sticks, which may also have been used to copy data from police computers to access away from the office. Despite a similar security breach in September 2010, the force had not put restrictions on downloading information, and staff were not sufficiently trained in data protection.
This wasn't one rogue officer breaching policy, this was a complete failure by management to implement a policy some two years after it had become pretty obvious that such a policy needed to exist.
They really should have known better - the National Health Service has been lambasted on several occasions for similar data leaks and has thoroughly learned it's lesson. We are not permitted to mount unencrypted USB volumes any more.
But the encrypted drives we are required to use if we need to transfer data are purchased from a central contract - and cost us £64 ($103) for a 2GB flash unit. I'm not surprised if there is a certain reluctance amongst the police to purchase that kind of deal.
When I first saw that price I assumed they were some kind of military grade unit with a hardware encryption controller. They are not, they're just partitioned, with a custom driver in the first, plaintext, partition. So they are taking units that were probably about £5 (at the time) and making a very substantial mark-up.
Our standard advice on what to do with an encrypted drive after we're done with it is not to just wipe the key block, making the data into worthless noise, but to physically destroy it. I'm willing to bet that our friendly encrypted storage vendor thought that one up.
As you quite rightly say, there are other options. I estimated that I could knock together a solution using TrueCrypt - including all the features that the current solution has, like key escrow - and sell them for about £15 a go. You can't even *buy* 2GB flash drives at my usual retailer any more, or even 4GB units, so they'd have to put up with having 4 times the capacity. But I'd still be making a good margin - those 8GB drives are now around £5 retail. And the TrueCrypt solution has the advantage of working on every platform, not just Windows.
and collect every story when a goverment institution mishandles peoples private information. Should be good ammunition for every debate about new laws and regulations that takes away your freedom to be left alone.
The correct spelling of "honour", "colour" etc. is clearly given in the ENGLISH dictionary, The words "honor" etc. are not English, but "American", Mr. Webster and his ilk have a lot to answer for, especially their failure to use "Z" in words such as enterprize.
nec sorte nec fato
Title: UK Police Fined For Using Unencrypted Memory Sticks
Summary: "The Information Commissioner's Office has filed a suit for £120,000 against the Greater Manchester Police because officers regularly used memory sticks without passwords to copy data from police computers and work on it away from the department. In July 2011, thousands of peoples' information was stolen from a officer's home on an unencrypted memory stick. A similar event happened at the same department in September 2010. 'This was truly sensitive personal data, left in the hands of a burglar by poor data security. The consequences of this type of breach really do send a shiver down the spine,' said ICO deputy commissioner David Smith."
Question: did whoever posted, and whoever read, and approved this 'story' bother to check the eye-ball catching headline with the contents of what is in reality in the article, presented in a hum-drum, why is this news, already? kind of a way?
Just so you know, a FINE is not the same as being SUED. Get it right, guys. You just look stupid otherwise.
When I read that headline, I thought "You can purchase encrypted DDR system memory?", then I realized they were talking about FLASH drives. Now that we're including FLASH drives into memory sticks, I think it's only fair that harddrives fall under this umbrella. I've always wanted to install a 4TB memory stick into my computer.
My concern isn't so much that the officer had the information on an unencrypted memory stick. Whats more concerning is people in the UK are so safe that a POLICE OFFICERS home was burglarized! Thieves have absolutely NOTHING to fear.
There's hoops in earlier versions of Windows, but Server 2008 introduces a group policy object that makes it pretty easy:
http://www.techrepublic.com/blog/datacenter/disable-removable-media-through-windows-server-2008s-group-policy-configuration/452
And more usefully, starting with Windows 7, you can force the use of BitKeeper on removable media via Group Policy:
http://www.windowsnetworking.com/articles_tutorials/using-bitlocker-encrypt-removable-media-part2.html
I thought Virgin Mobile has root level access to every memory stick in the U.K. Why doesn't Virgin Mobile simply encrypt the data for them?
Most Police's/Cop's files on USB Stick is public files that citizens can make a request to obtain the files. I think this is a job for Bond 007. Maybe 007 can track and find the individuals that broke into someone's home and resolve the problem(s).
You forgot about the kickbacks^Wcosts of pursuing new business required to successfully land such a contract.
What would the per-unit price be if you had to hire a newly-retired NHS exec as your business' figurehead CEO?
How much does it cost to hire former NHS execs as "consultants" to act as liaison with NHS as they write the bid specifications? Carefully crafted bid requirements can ensure that only a single vendor is able to tender a bid that satisfies the requirements.
Want to ensure that your cheap-ass, software encryption-only, crap USB stick can be sold for an obscene markup? Simple: make certain through the "consultation process" that there is a bid requirement added to stipulate that the hardware/software be compatible with Win95 SR2 or something of that ilk. (Bonus if you later meet the 'compatibility' requirement by making a 4KB autorun program that can run in Win95 but merely displays a dialog that says the device can only be used in an XP or later system)
Naturally, these matters are best discussed at the highest levels, with your consultants taking the NHS execs to Ibiza. If your consultants play their cards right they can probably even secure a subsequent directive mandating physical destruction of the USB sticks instead of erasure...