Keep your hard drives safe, warn experts, as a survey finds more discarded ones with sensitive information
For the past month or so, Dudley Group of Hospitals NHS Trust has been dealing with a problem that should not have happened – all because a computer hard drive containing sensitive patient information from a trust hospital was sold on the auction site eBay.
Losing disks loaded with confidential data is not a new thing; BT and Glamorgan University’s forensics computing laboratory have been finding such hard drives every year as part of their annual survey designed to highlight the problem of people disposing of disks without destroying the data on them.
Red faces
What is unusual about this incident, which came to light in the latest survey ‘Ghosts from the machines’, is that no-one knew that the computer was on the hospital network in the first place.
Tracking down the origin of the disk, which contained data on cancer patients at the hospital, has led to an inquiry at the trust headquarters – and red faces, because the Dudley trust is a group of new hospitals operating under the Private Finance Initiative (PFI), all of whose computer assets are managed by Siemens Medical. It is understood that the computer that the disk came from was not part of the Siemens network.
The trust says: “There is an ongoing investigation into this incident involving very senior people and we are looking at possible loopholes in the system. There is no record of this machine going through the systems that Siemens has in place for disposing of equipment. We cannot have something like this happening again.” It added that the computer could have been stolen from the hospital.
And Dudley is not alone. Once again BT and Glamorgan, which obtained 350 hard disks from around the world, have added more significant names to the corporate casualties which have found that the data so jealously guarded at the front door slips unnoticed out via the back.
“This is the third time we have done this,” says Dr Andy Jones, head of security technology research at BT’s Security Research Centre. “What’s clear is that despite the publicity, nothing much has changed. All organisations lose equipment, but if they contain sensitive data they should look to using something like encryption to make sure it’s better protected.”
Marathon Oil, based in Texas, found out that two disks dealing with corporate data from its North Sea drilling operations were in this year’s haul. “The policy at Marathon is that all disks are destroyed. We do not know how this got out there,” says the company.
Police investigation
Of the 133 disks obtained in the UK, which were all analysed using techniques available to anyone, only 75 were working but the Glamorgan team found data on 62% of those – including company records, personal information, financial data and paedophile material which has resulted in a police investigation in Wales.
“The figures are slightly down on the years before,” said Dr Andrew Blyth, principal lecturer at Glamorgan’s School of Computing, “but we are still in a situation where over 50% of the disks contain sensitive corporate and personal data and a significant amount contained names, CVs, addresses and phone numbers. With some, the information was so detailed that they could have had their identities stolen.”
According to Jon Godfrey of Lifecycle Services, which ensures that disks are properly wiped, the Glamorgan study is only the tip of an iceberg.
“If you think about how much data is being stored up every day, and that that data keeps on increasing and that the size of the drives holding that data is also increasing, it is inevitable that something significant is going to slip. At the moment people are just relying on luck that their data does not fall into the wrong hands.”
Clear out your data
The destruction of data about individuals by companies is a legal requirement in disposing of a computer. But just deleting a file or reformatting the drive does not remove the data; it removes the file entry from the index, marking the space as available for reuse, and the data can be restored – we have put together a help page for those wishing to make sure their data cannot be recovered. To prevent that, overwrite the data. Encrypting a disk is a good first measure: Windows XP and Vista, Mac OSX and Linux all offer this facility. Then get a disk-wiping program: there’s a list including free ones and instructions at howtowipeyourdrive.com. Some erase the entire disk while others can select files or folders to erase. Ensure you erase free space.
For really important data, destroy the disk with an electric drill or a nail. It’s considered environmentally unsound and technologically inelegant – but it might make you feel better.
_______________________________________________________________
Article first appeared in Guardian Sept 13, 2007
