in

This Blog

Syndication

Tags

AlertBoot Endpoint Security

Full Disk Encryption: School Gives Boy USB Stick With Sensitive Info

Well, here's a case where drive encryption like AlertBoot wouldn't have made a difference, although things may be a little different with file encryption.

UK School Gives Student USB Stick With Sensitive Information

Carlos McSweeney, a 10-year-old boy with attention-deficit hyperactivity disorder (ADHD), was given a computer memory stick on which his artwork was saved...as well as sensitive information about his classmates, such as "details of all the pupils at the school and their education history as well as addresses and phone numbers."

The family of the child soon realized the implications of what the information meant, and waited for the school to get in touch with them.  The school didn't.  So, the family did the right thing and called the school.  And this is what happened:

"When I did tell them again they got angry and demanded we give it back and harassed us with early phone calls and then threatened us saying if we didn't give them the memory stick then they would have to send the police around to get it." [thisisbristol.co.uk]

I realize that there's always two sides to a story, but if the above is true, where does the school get the gall to harass people?  I mean, is it because the family is adamant about not returning the USB stick?  If so, why?

Also, note how the above quote starts off with "when I did tell them again...."  Is the family implying that they had to let them know of the data breach more than once?  Why not just return the thing?  More questions than answers on this one.

Why Won't Disk Encryption Work In This Case?

For the very basic reason that this USB memory stick was given to the kid for taking his artwork with him.  (Rant: what are kids doing nowadays?  In my time, we used crayons.  Cheaper, too.)

If the USB stick had been protected with disk encryption, he wouldn't have been able to access his artwork once he gets home.  So, it only makes sense that one of the teachers--or whoever actually little Carlos the USB disk--would have sent him home with an unencrypted one.  In principle, they should have to check that the disk is free of sensitive data.

In principle.


Related Articles and Sites:
http://www.thisisbristol.co.uk/educationplus/home/Memory-stick-given-Bristol-boy-sparks-school-data-law-row/article-1573873-detail/article.html

<Previous Next>

Data Encryption: Confidential Papers Lost By Canada Minister Morton

Data Security: HIPAA vs HITECH - Mandating Patient Notification

Comments

No Comments

About sang_lee

Sang Lee is a Senior Account Manager and Security Analyst with AlertBoot, Inc., the leading provider of managed endpoint security services, based in Las Vegas, NV. Mr. Lee helps with the deployment and ongoing support of the AlertBoot disk encryption managed service. Prior to working at AlertBoot, Mr. Lee served in the South Korean Navy. He holds both a B.S. and an M.S. from Tufts University in Medford, Massachusetts, U.S.A.