2008 a bad year for MoD data

Friday, December 05, 2008

Data losses over the last year are far more extensive and common at the MoD than first indicated by the ministry, including the theft and loss of sensitive data on thousands of personnel and MoD staff both in the UK and abroad.

In some cases huge amounts of data that were lost were never made public, leaving the lives and identities of personnel and staff in jeopardy, while in other cases where a significant data loss was reported, the extent of the loss was underreported.

There have been several high profile data losses at the MoD this year including the theft of a recruitment official's laptop in January that contained details of 600,000 individuals and the loss of several other laptops and USB sticks in isolated incidents around the country. However in the latter report, the MoD only admitted to the loss of several dozen USB sticks and laptops. No information on what exactly was lost has been revealed until now.

According to the MoD the losses included sensitive training information and personal details. Between November 2007 and January 2008 an unencrypted laptop was stolen during an "overseas exercise" that contained information on the training exercise along with the personal details of 500 individuals taking part in it. In March a computer server containing detailed medical records of 7,000 servicemen was lost in transit between Lisbon and the UK.

Perhaps the most frightening loss however was a laptop in October that was used to make local passes for soldiers. The information on the laptop not only included software that would allow one to make the passes but also photographs and details of 450 junior soldiers.

In other cases, high profile data losses were simply underreported. In September 2008 it was reported that three USB sticks containing the medical details of around half a million current and former servicemen were stolen from RAF Innsworth. In reality, the total loss amounted to data on 6.2m individuals all of whom currently or previously served in the RAF.

The high profile data loss of recruitment information in January was also under reported according to the MoD. Initially the loss was estimated to be 600,000 current and potential recruits. But according to the MoD it also contained the next of kin details on 400,000 individuals.

All of this data would be of immense value to the criminal world. Personal details can be used to help setup fake bank and credit card accounts and to create false IDs. Anyone involved in terrorism or the support of other anti-military groups would also have information on where current and potential servicemen live, work and what types of training they are undertaking.

Armed forces minister Bob Ainsworth did not specify to MPs why so many incidents had not been reported or underreported in the first place.