Second data blunder fear

UK COMPUTERS STOLEN Second data blunder fear:

Second data blunder fear
Tuesday, April 14, 2009, 09:30

Computer security experts today warned council leaders they faced a second embarrassing data security blunder.

Consultants spoke out after Charnwood Borough Council admitted it could not find nine missing computers that could contain personal and sensitive information about residents.

It comes after the authority discovered, in August, that a hard drive, holding financial details of thousands of taxpayers, had been stolen by an employee and sold on an internet auction site.

Information technology consultants, bought in to beef up the council's computer security following the theft, believe the missing computers could lead to further data security losses.

The council has said it does not know what information is stored on them.

A report by Woodside IT Consulting is to be considered by the council's audit committee on Thursday.

The report said: "The council should be aware that any subsequent security breach will most likely have a devastating impact on the credibility of the council as a whole.

"One event is bad enough, but a second event would make things very difficult for the council.

"The public's opinion of the council will have been severely damaged as a result of the subsequent disclosure that personal information was released on an auction site, and it is inevitable that rebuilding the trust will neither come easy nor quickly."

Without immediate action on its remaining computers, the council is at risk of a similar data security breach from the accidental loss or theft of computers.

It recommends laptops, given to officers and councillors, should be encrypted so the information on them is secure even if they are lost.

Councillor Jewel Miah, who sits on the audit committee, said he was extremely concerned about computer security. He said: "There are a number of holes in security which are worrying. We are a number of months in from the embarrassment of the hard drive theft when many people's personal information was at risk, but still council laptops are not encrypted.

"The thought of those nine computers, containing who knows what, still being unaccounted for is a serious matter.

"Information could fall into the hands of criminals, fraudsters or whoever, putting people at risk."

The hard drive sold on the internet was stolen by Peter Ward, a council technician. Ward, from Shepshed, was subsequently sacked and given 180 hours of community service after admitting the theft.

A council spokesman said: "Investigations indicate that the nine machines were obsolete items which may have been securely disposed of or used as spares, but our previous system did not track components such as the hard drive so we cannot absolutely confirm this.

"We recognise the public concern over this matter, and that is why our audit committee is considering the reports and the steps that have been taken to implement improvements.

"It is, however, important not to lose sight of the fact that this incident was caused by the criminal actions of a member of our staff from 2006 up to August 2008."