MOD: three out of ten laptops unencrypted

 

Gallery

By Stewart Mitchell

Posted on 12 Aug 2010 at 08:52

Only seven out of ten Ministry of Defence laptops are fully encrypted, according to the department's annual accounts report for 2009-2010, which paint a grim picture of information mismanagement within the armed forces' infrastructure.

The MOD has improved its laptop loss rate, from 326 machines in 2008-09 to 121 notebooks in 2009-10, but at that rate some 40 laptops may have gone missing with no protection for the potentially critical information stored within them.

The MOD has focused on data management following the Data Handling Review and Sir Edmund Burton's 2008 into the loss of MOD data, and “has undertaken considerable further work to prohibit the use of unencrypted media, and to improve personal data handling generally,” the report said.

Despite the fact that 92% of staff have completed encryption awareness training and encryption rates had improved, the department acknowledged it still had much work to do to secure personal and strategic data.

“The percentage of those laptops that were fully encrypted – thus minimising the risk of any compromise of the information they contained – rose from 27.6% to 70.2%,” said accounting officer Sir Bill Jeffrey in the report. “We will continue our efforts to ensure that this welcome progress is sustained and improved on.”

Tough to find data

While the MOD might be reducing the amount of data it loses, the department often cannot find information when it needs it most, a situation that could hamper both judicial reviews and operations.

“Work is in train to improve the information management infrastructure, but current systems expose the department to the risk of being unable to guarantee access to the information needed to respond to time critical judicial or other requests,” Jeffrey said.

The management infrastructure improvements are considered urgent, particularly because the department believes the threat from cyber attacks is currently high.

“In addition to the risks posed by data losses and information infrastructure, the risk presented to the department by threats to cyber security is of increasing concern,” Jeffrey said. “The department is working to improve awareness of the risks of cyber attack, and capability to respond to it flexibly and affectively.”