Private Data of RAF Personnel Stolen UK MoD Establishment

Via The Register UK -

Personal details of potentially all current and ex-RAF personnel and dependents were stored on three USB-connected storage drives which went missing from a Ministry of Defence establishment at Innsworth, Gloucestershire.

Both the MoD police and Gloucester Police are investigating a presumed theft. A statement from the MoD said: "The theft of these hard drives from a secure location, where they were subject to physical protection standards consistent with the Data Handling Review, is being treated with great seriousness.

"There is no indication that the theft was motivated by a desire to obtain the data, nor that the data has been exploited maliciously in any way; but personal information on anyone serving or who has served in recent years in the RAF, Regular or Reservist, may have been compromised."

[...]

The three A5 book-sized hard disk drives holding the unencrypted data were stored, it is understood, in a locked cupboard in the SPVA office. Two of the drives contained personnel details such as MoD email addresses, appraisal results, and bank details. The third did not contain any personal details. Access to the room in question is via two successive manned security doors. Visitors need a pass and an escort to pass between the two doors. It's understood that there is no perimeter security for the site.

Laurence Robertson, the MP for Tewkesbury, said: "It is totally unsatisfactory ... It does seem a bit like somebody inside knows something about it. For someone to walk in off the street, know where to find a certain file and walk in and take it, seems a bit strange ... There needs to be a full investigation." That they might have been able to walk in off the street is not the least strange aspect of the affair.

An implication is that the control of perimeter access to the site may have been compromised by the changeover from RAF to Army base supervision, particularly as much of the base is empty and has no perimeter access control. Another implication is that a site visitor whose details were recorded is responsible for the theft.

-------------------------------

Lets look at this part of the MoD statement...

"There is no indication that the theft was motivated by a desire to obtain the data, nor that the data has been exploited maliciously in any way...."

Sounds like the standard data breach remark....meant to reassure those affected and help reduce fears. But lets look at it the same statement from a different angle.

Someone stole confidential data from a MoD Base - a base with almost no perimeter security. The data is unencrypted and was supposedly protected behind two manned security doors. After all of this, the MoD comes out and tells the public that "there is no indication that the theft was motivated by a desire to obtain the [personal] data". Seriously?

Affected people are suppose to be reassured by the knowledge that a non-targeted attacker can obtain sensitive personal information and walk away?

Well, thank god..the attack doesn't appear targeted..otherwise they might have made off with the crown jewels.