Thread: Another MoD harddrive missing

EDS are still in the running for many future IT projects despite having proven on many occasions that they couldn't organise a nun shoot in a nunnery. Just another example of a company treated as a preferential bidder by government regardless of actual performance.

I'm not worried about this or the loss from Innsworth a couple of weeks ago. If my career to date has taught me anything, it is that information held about me by the MOD is almost always incorrect.

What is even more worrying is that these details are only the ones we get to hear about , how many other , perhaps even more serious IT security losses are there that are kept secret ??

Originally Posted by wheelchair warrior

http://news.bbc.co.uk/1/hi/uk/7662604.stm

"An investigation is under way into the disappearance of a computer hard drive containing the personal details of about 100,000 of the Armed Forces.

The information was being held by EDS, which is the Ministry of Defence's main IT contractor.

The MoD said the portable hard drive went missing on Wednesday during a priority audit carried out by EDS."

How damm incompitent can these people get ?

WW

Why oh why is these contractors being trusted with such sensitive information its not just military files which have gone missing ,It people's other sensitive information including personal information and medical information in both military and civilian walks of life . These contractors should be accountable for there actions and realise what distress they are causing people .

Originally Posted by meridian

Surely after everything that has happened and the massive press coverage about information security, this is a joke

EDS just simply need their contracts terminating immediately and criminal action taken against its directors, no ifs no buts

Unless someone in the public sector is made a very serious example of this is a problem that is not going to go away

thats the real problem so much of the public sector is in private company hands now, which is why so much is going missing!

Go back too the Revenues loss of CD's back in the day, they would have been internal mailed by the Revenue internal messengers branch.

bla bla etc etc... Contracting out! you know it works...

Given recent attempts to behead a muslim soldier, I hope these details don't fall into the wrong hands.

Originally Posted by halo_jones

Originally Posted by meridian

Surely after everything that has happened and the massive press coverage about information security, this is a joke

EDS just simply need their contracts terminating immediately and criminal action taken against its directors, no ifs no buts

Unless someone in the public sector is made a very serious example of this is a problem that is not going to go away

thats the real problem so much of the public sector is in private company hands now, which is why so much is going missing!

Go back too the Revenues loss of CD's back in the day, they would have been internal mailed by the Revenue internal messengers branch.

bla bla etc etc... Contracting out! you know it works...

Agree with Halo - we could load up the bus every week. Quite simply, many of those entrusted with the data, neither understand the risks and are ignorant in terms of data security. Not made any better, by the multiple layers of contract responsibility, that the government has no sanction over.

Best brush up on Symbian.

Now are the MoD going to pay to have all my details changed?

Passport
Driving Licence
Bank
National Insurance Number
Insurance- PAX
CILOCT

All of which can be used to obtain services and money by deception. Thereby robbing me off my money. Or is ahmed the local islamic terrorist going to start visiting peoples homes and spreading the love. Or is my money going to end up in bangladesh. All the time and effort I do keeping my identity a secret to prevent fraud has been wasted. Doesnt the MoD have a duty of care to prevent my details getting into the wrong hands.

So as I understand the entire armed services personal information may be in the hands of future and present enemies. Brilliant!

I hope MI6/5 are enjoying their morning coffee, Because everything they are here for has been completely wasted.

Well at least my pin number is secure........

Any duty of care cases that cost the MOD money will be picked up no doubt by the MOD while EDS/HP wash there hands of the whole affair...

or am i just being a cynic again...


the only reason this got discovered was because they were finaly being forced into a full audit, FFS.

http://news.bbc.co.uk/1/hi/uk/7662604.stm


A spokesman for the MoD said: "On 8 October we were informed by our contractor EDS that they were unable to account for a portable hard drive used in connection with the administration of Armed Forces personnel data.

"This came to light during a priority audit EDS are conducting to comply with the Cabinet Office data handling review. The MoD Police are investigating with EDS."

Originally Posted by halo_jones

Any duty of care cases that cost the MOD money will be picked up no doubt by the MOD while EDS/HP wash there hands of the whole affair...

or am i just being a cynic again...


the only reason this got discovered was because they were finaly being forced into a full audit, FFS.

http://news.bbc.co.uk/1/hi/uk/7662604.stm


A spokesman for the MoD said: "On 8 October we were informed by our contractor EDS that they were unable to account for a portable hard drive used in connection with the administration of Armed Forces personnel data.

"This came to light during a priority audit EDS are conducting to comply with the Cabinet Office data handling review. The MoD Police are investigating with EDS."

Well what are we worrying about? It's bound to be ok.

Playing devils advocate here for a minute.....

A spokesman for the MoD said: "On 8 October we were informed by our contractor EDS that they were unable to account for a portable hard drive used in connection with the administration of Armed Forces personnel data.

"This came to light during a priority audit EDS are conducting to comply with the Cabinet Office data handling review. The MoD Police are investigating with EDS."


EDS were carrying out an audit regarding Data Handling, a portable device by its very nature is exactly that and as such should not be being used for handling sensitive data when there are other more secure means.

However, having been involved in IT within the forces, I have seen more MoD/Forces people using portable devices than I have Contractors, partly because Contractors tend to work on only 1 system where as the MoD/Forces personnel do work across multiple systems so would suggest until investigation is complete we dont hang the messenger before we know he did it.

Just my opinion

Originally Posted by Blogg

The most worrying aspect of this and other cases of Government data loss is how such a mass of sensitive data comes to be on a portable mass storage device in the first place. How many other copies of databases are knocking around on portable drives, laptops or DVD ROM? Why?

The answer in large part is that none of it matters to the people concerned. Just data they play with.

It has to be made to matter and matter a lot, which means personal sanctions against the muppets concerned and the management chain. Far too easy for contract staff to drift into a badly managed environment and when it all goes tits up drift off again and all the remaining parties can carry on as usual because they can point to "action" having been taken.

I am an IT contractor and have worked on MOD, Police & Government sites on various projects. Data handling procedures are laughable within these organisations and from what I have witnessed the majority of lost data cases come from their own staff which are then brushed under the carpet. Civil Servants appear to have a different work mentality than personnel from the private sector.

Yes, contractors do seem to take all the hits these days but part of the blame can down to project deadlines. Many a time I have taken data off site to continue the work at my hotel or over the weekend in order to get the project cracked within the require timeframe. It would be so easy to misplace an 8gb flash drive with the likes of a UK ANPR database on sitting on it. Yes, we all talk of encryption but this is very rarely implemented due to adding an extra amount of mouseclicks to the task at hand. As all IT bods will know, the less mouseclicks the better.

The data could be signed over from a civil servant but this never happens either. Contractors will always have root access to any system they are working on and then its just a case of insert flash drive, right click, copy, paste - bam > nice big database to take home with me.

Originally Posted by Daxx

One would think that an IT provider would be bright enough to have encrypted its' laptop harddrives, anticipating one may go 'missing'.

Regrettably some people are just plain stupid.

Err....Thats why I have spent the last few weeks fitting encrypted drives into laptops.

Slightly off topic...

Does anyone know the MOD’s policy on stolen laptops?

For as little as £50 a laptop can be upgraded to track the physical location of a laptops MAC address the next time it connects to the internet, commands can also be sent to instruct the BIOS to format the HD.
Laptops with internal web cams have the option to take pictures of the thief.

Is this system in place with sensitive laptops?

Originally Posted by hackle

this from TimesOnline

MoD loses hard drive with troop and family details
Richard Kerbaj

**SNIP**

The portable hard drive — which is believed not to have been encrypted — was used by EDS, the MoD’s main IT contractor, to test computer equipment. It could have been missing for several days.

**SNIP**

This raises the question of why the hell they needed to use live data in order to test computer equipment

Originally Posted by Goku

Slightly off topic...

Does anyone know the MOD’s policy on stolen laptops?

For as little as £50 a laptop can be upgraded to track the physical location of a laptops MAC address the next time it connects to the internet, commands can also be sent to instruct the BIOS to format the HD.
Laptops with internal web cams have the option to take pictures of the thief.

Is this system in place with sensitive laptops?

Web cam on a secure laptop? I think CESG and DSSO would have a collective cardiac arrest at that idea

Maybe EDS should have a name change?

ED(N)]S Every ones Data NOT Secure :D