500 government devices missing highlights need for clearer processes

News that nearly 500 government devices have gone missing since 2001 has highlighted the need for government departments to re-think their processes on how laptops are managed.

The total number of missing devices includes 234 laptops, as well as 234 other devices, such as mobile phones and PDAs.

The figures were released by different government departments in written parliamentary answers to questions asked by Liberal Democrat MP Sarah Teather, and recorded on TheyWorkForYou.com.

Security firm Morse consultant, Simon Forster, advises departments to ensure processes are in place to ensure this scale of loss does not occur. "When a disc, document or anything else containing data comes into an organisation it needs to be logged and then managed,” he added.

The Ministry of Justice (MoJ) has been the worst culprit, responsible for 135 stolen laptops and 34 lost, while 56 mobile phones have been stolen and 116 lost.

An MoJ spokesperson responded, stating, “We have robust measures in place to protect the physical security of the Department’s IT assets and these measures are kept under constant review,” adding, the MoJ recognises laptops are “high risk items” and so ensures “specific security guidance is provided to staff using laptops”.

But Alan Bentley, vice president of Lumension Security, formerly PatchLink, said the numerous data losses indicate employees are not aware of organisation’s security policies. “Educating employees over the risks of data theft needs to be tackled first and then implementing policy, which employees will adhere to comes second - but it is no mean feat, especially when you consider the numbers of people that must abide to the policy,” Bentley said.

The Department for International Development (DFID) was the next most careless department after the MoJ, managing to have 20 laptops, 18 mobile phones and two PDAs stolen, as well as losing nine mobile phones and three laptops. The Department of Communities and Local Government (DCLG) closely followed, recording 28 stolen laptops and five lost or stolen mobile phones since the forming of its predecessor in May 2002; the Office of the Deputy Prime Minister.

A DFID spokesperson, like MoJ’s, said their department had “rigorous procedures in place to ensure that personal information is stored”, but said these will be reviewed in line with the data security review announced by the Prime Minister on 21st November.

DCLG did not comment, believing this was the responsibility of Cabinet. A Cabinet spokesman said the laptops are the responsibility of individual departments, adding “We set the guidance in the Manual of Protective Security and it is up to the departments to create security standards and rules within the frame-work.”

The Ministry of Defence has no details recoding either lost or stolen devices but said it is initiating an investigation into the details of all lost or stolen electronic media since 2003 as a result of a recent laptop being stolen. However the department seems to be having difficulty. “While every effort is being made to gather the information as quickly and accurately, not all the details are presently available,” said Bob Ainsworth, the Ministry of Defence minister.

The Wales Office had the smallest amount of data losses, reporting only two missing mobile phones. A welsh spokesman said “this is the result of use following government guidelines closely, while remaining diligent.”

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!