AUSTRALIA GOVERNMENT COMPUTER THEFT ISSUE CAUSING CONCERNThe Australian: Stolen laptops contained secret Defence material [April 03, 2004]Stolen laptops contained secret Defence material
By John Kerin
April 03, 2004
LAPTOP PCs with top-secret Defence material were among the more than 1000 laptops stolen from government departments over the past four years, an inquiry has found.

Thieves also walked away with more than 250 desktop computers.

The alarming picture has emerged in a report on the security of government electronic information by the federal Joint Committee of Public Accounts and Audit.

The report says Defence has topped the list of laptop losses, with 537 missing. Industry and Tourism has lost 138 and Family and Community Services is missing 117 -- the latter scoring the highest rate of desktop theft (94).

"For sheer volume, the quantity of equipment lost by Defence stands out," the report says. "A particularly worrying aspect of the (537) Defence losses is that three of the computers lost contained material classified as secret.

"Even though these machines were recovered, these incidents represent significant security breaches."

The report says the theft of Defence information is underscored by an incident in 1990 where a British Defence laptop with plans for the 1991 Gulf War was stolen.

The report reveals that most often laptops are stolen from offices, private homes, vehicles and hotel rooms. Others have been left in taxis and lost at airports.

The report also found that physical security around commonwealth offices, which often shared space with private-sector businesses, was sometimes lax.

"The committee found that a number of commonwealth agencies had inadequate levels of physical security for IT equipment," committee chairman and Liberal MP Bob Charles said.

"This was reflected in successful breaches of the security of facilities, poor record-keeping on lost or stolen IT equipment and a lack of appropriate reporting mechanisms."

The committee said many agencies had followed a policy of reporting only the most serious thefts to the agency responsible for government IT security - the Defence Signals Directorate - and many had not been reported to police.

These actions should be mandatory after a theft.

The committee also recommended that laptops be assigned to an individual rather than an agency.