Disk encryption was probably not used to secure the information stored on two disks that were lost, possibly affecting 3000 seasonal agricultural workers, the Home Office in the UK has announced. The loss occurred this March but was only disclosed on August 8. The use of data protection solutions like AlertBoot would have been useful, to say the least.
In all fairness, the loss of the discs was not perpetrated by the Home Office. According to a spokesperson, and external contractor decided to send the two discs via normal post, when it should have been sent via special delivery. This was against the agreed procedures. The lost discs did have to password protection, although I take this to mean that information was not encrypted.
This presumption is further supported by the fact that in June, the Home Office started using an encryption service to secure any data sent via post. Better late than never, I guess. However, what’s even better than “late,” is “at the beginning.” That is, start file encryption before disaster strikes, not after.
Perhaps I’m revealing my misanthropic streak here, but why is it that the UK government continues to rely on people to do the right thing? I’m not doubting the intentions of people in general (I have a funny way of expressing it, but I believe most people are good, as are their intentions); it’s just that history has shown, time and time again, that people cannot be relied on to enforce and follow a set policy 100% of the time—so claiming that an accident with serious repercussions occurred because “they did something against the agreed procedures” is, well, irresponsible.
This inability to follow procedures is especially true when it comes to the little things. I mean, who would be more dismissive about following procedures? The guy in charge of handling the sensitive data of 3000 people, or the guy who’s supposed to mail this stuff? Chances are it’s the latter guy.
So, again, relying on that guy for ensuring the security of sensitive data—which involves using the right courier service—is not a good idea. I just hope he’s not in charge of using the encryption service as well.
Related Articles:
http://news.zdnet.co.uk/security/0,1000000189,39460397,00.htm?r=7