Feeds

MoD prays RAF disk thieves aren't data savvy

50,000 RAF IDs on unencrypted disks

Security for virtualized datacentres

Personal details of potentially all current and ex-RAF personnel and dependents were stored on three USB-connected storage drives which went missing from a Ministry of Defence establishment at Innsworth, Gloucestershire.

Both the MoD police and Gloucester Police are investigating a presumed theft. A statement from the MoD said: "The theft of these hard drives from a secure location, where they were subject to physical protection standards consistent with the Data Handling Review, is being treated with great seriousness.

"There is no indication that the theft was motivated by a desire to obtain the data, nor that the data has been exploited maliciously in any way; but personal information on anyone serving or who has served in recent years in the RAF, Regular or Reservist, may have been compromised."

The station used to be a non-flying RAF base, called Innsworth Camp, housing a number of administrative functions. All records for all RAF men and women were kept at the base and the site was the headquarters of the RAF Personnel and Training Command. The RAF left the site in March this year, but left behind some MoD functions such as the Services Personnel and Veterans Agency (SPVA), and it was taken over by the 43 (Wessex) Brigade of the Army.

The site has 39 WW2-style wooden framed huts, a single 1970’s hangar and a 17-hectare sports field. According to a Wikipedia entry, the old RAF Command HQ and most other buildings are now empty and being looked after under a care and maintenance program. There are a few hundred staff working at the SPVA and other offices on the site, which is available to film-makers. The overall site security level is not 'that' high.

The three A5 book-sized hard disk drives holding the unencrypted data were stored, it is understood, in a locked cupboard in the SPVA office. Two of the drives contained personnel details such as MoD email addresses, appraisal results, and bank details. The third did not contain any personal details. Access to the room in question is via two successive manned security doors. Visitors need a pass and an escort to pass between the two doors. It's understood that there is no perimeter security for the site.

Laurence Robertson, the MP for Tewkesbury, said: "It is totally unsatisfactory ... It does seem a bit like somebody inside knows something about it. For someone to walk in off the street, know where to find a certain file and walk in and take it, seems a bit strange ... There needs to be a full investigation." That they might have been able to walk in off the street is not the least strange aspect of the affair.

An implication is that the control of perimeter access to the site may have been compromised by the changeover from RAF to Army base supervision, particularly as much of the base is empty and has no perimeter access control. Another implication is that a site visitor whose details were recorded is responsible for the theft.

Current and ex-RAF personnel can call a helpline on 0800 085 3600 to find out more. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.