News that nearly 500 government devices have gone missing since 2001 has
highlighted the need for government departments to re-think their processes on
how laptops are managed.
The total number of missing devices includes 234 laptops, as well as 234
other devices, such as mobile phones and PDAs.
The figures were released by different government departments in written
parliamentary answers to questions asked by Liberal Democrat MP Sarah Teather,
and recorded on TheyWorkForYou.com.
Security firm Morse consultant, Simon Forster, advises departments to ensure
processes are in place to ensure this scale of loss does not occur. "When a
disc, document or anything else containing data comes into an organisation it
needs to be logged and then managed,” he added.
The Ministry of Justice (MoJ) has been the worst culprit, responsible for 135
stolen laptops and 34 lost, while 56 mobile phones have been stolen and 116
lost.
An MoJ spokesperson responded, stating, “We have robust measures in place to
protect the physical security of the Department’s IT assets and these measures
are kept under constant review,” adding, the MoJ recognises laptops are “high
risk items” and so ensures “specific security guidance is provided to staff
using laptops”.
But Alan Bentley, vice president of Lumension Security, formerly PatchLink,
said the numerous data losses indicate employees are not aware of organisation’s
security policies. “Educating employees over the risks of data theft needs to be
tackled first and then implementing policy, which employees will adhere to comes
second - but it is no mean feat, especially when you consider the numbers of
people that must abide to the policy,” Bentley said.
The Department for International Development (DFID) was the next most
careless department after the MoJ, managing to have 20 laptops, 18 mobile phones
and two PDAs stolen, as well as losing nine mobile phones and three laptops. The
Department of Communities and Local Government (DCLG) closely followed,
recording 28 stolen laptops and five lost or stolen mobile phones since the
forming of its predecessor in May 2002; the Office of the Deputy Prime Minister.
A DFID spokesperson, like MoJ’s, said their department had “rigorous
procedures in place to ensure that personal information is stored”, but said
these will be reviewed in line with the data security review announced by the
Prime Minister on 21st November.
DCLG did not comment, believing this was the responsibility of Cabinet. A
Cabinet spokesman said the laptops are the responsibility of individual
departments, adding “We set the guidance in the Manual of Protective Security
and it is up to the departments to create security standards and rules within
the frame-work.”
The Ministry of Defence has no details recoding either lost or stolen devices
but said it is initiating an investigation into the details of all lost or
stolen electronic media since 2003 as a result of a recent laptop being stolen.
However the department seems to be having difficulty. “While every effort is
being made to gather the information as quickly and accurately, not all the
details are presently available,” said Bob Ainsworth, the Ministry of Defence
minister.
The Wales Office had the smallest amount of data losses, reporting only two
missing mobile phones. A welsh spokesman said “this is the result of use
following government guidelines closely, while remaining diligent.”
Comments
Have your say on this article