Feeds

Binned PCs were stuffed with MoD and Sun staffers' privates

Resold without wiping Rebekah Wade's naughty bits

High performance access to file storage

Updated Security researchers have found personal records of Sun newspaper and MoD staff on the hard drives of discarded or resold computers.

The studyThe ghosts from the machines: A history of 10 years of carelessly discarded data, found that both businesses and consumers are getting rid of old PCs without wiping them clean.

Carelessly discarded data on such machines might be used for ID theft. It may also lead to the release of potentially sensitive customer data.

The study was carried out by the Cyber Security Research Institute (CSRI) on behalf of the Asset Disposal and Information Security Association.

In a revelation likely to bring fresh embarrassment to News International, which was embroiled in the phone hacking scandal this year, researchers found that an unwiped hard drive belonging to the media giant was later sold on to a third party. "The hard drive names contained the home addresses and mobile phone numbers of the entire staff of The Sun, plus other high-profile individuals," according to CSRI.

The details included those of then Sun editor Rebekah Wade, later chief executive of News International, Andy Coulson, who worked as David Cameron’s communications supremo before resigning over the hacking affair, and Top Gear presenter and News International columnist Jeremy Clarkson. Disappointingly the researchers did not find the phone numbers for private eyes in the Sun machine.

The Sun's PC came into the hands of CSRI via a third-party disposal firm that had failed to wipe the data.

"Fortunately for News International – and by sheer chance – the data from the hard drive came to the Cyber Security Research Institute," says CSRI chairman and report author Peter Warren. "But it highlights once again the huge volume and value of data that is literally being thrown away by UK businesses and individuals each year.

"In the case of News International, this information on staff could have been used by competitors or criminals to glean vital and commercially confidential information. It could even have been used to hack their staff members’ phones," he added.

The research found 30 per cent of drives making their way onto the second-hand market came with data from previous owners. Over a 10-year period the figure is 40 per cent.

Unwiped data on discarded mobile storage devices and, increasingly, mobile phones poses much the same problem as carelessly discarded data on PCs.

"Whilst the problem has shown some signs of improvement over the last few years we are entering a new technology phase with solid state media being particularly difficult to handle," said Steve Mellings, director of trade group Adisa (the Asset Disposal and Information Security Alliance).

"With mobile phones, USB sticks, tablets and many new laptops utilising SSD, it is critical that people address this issue by implementing effective asset disposal policies."

The report authors estimate around 90 million gigabytes of unprotected data is annually discarded from mobile phones. Though the bulk of this will be music and pictures, around 4.5 million gigabytes will be personal data such as emails and contact details. The report authors reckon 15.1 million gigabytes of data a year is left on discarded old computers.

Carelessness in disposal of data exposes firms to fines by the Information Commissioner as well as reputation-damaging publicity if lax discarded kit disposal policies are exposed.

Apart from more and better education of the public and businesses about securing their data, the report suggests the long-standing problem of carelessly discarded data might be addressed by creating a rigorous set of standards for data destruction and audits of data destruction firms.

"One of the more worrying trends to emerge from our surveys over the last decade concerns the fact that, in a number of cases, the drives we have examined had been given to a third party for disposal but instead of destroying the data those third parties had simply sold on the drives," Warren said.

The CSRI worked with academic partner organisations including the University of Glamorgan, Australia’s Edith Cowan University and Longwood University in the US on the study. ®

Updated to Add

A News International spokesperson said:

“All our drives are encrypted and we have a policy to only dispose of end-of-life hardware in a secure way through a 3rd party supplier. We are contacting the CSRI to find out more about the drive that has been passed to them.”

High performance access to file storage

More from The Register

next story
Report: Apple seeking to raise iPhone 6 price by a HUNDRED BUCKS
'Well, that 5c experiment didn't go so well – let's try the other direction'
Microsoft lobs pre-release Windows Phone 8.1 at devs who dare
App makers can load it before anyone else, but if they do they're stuck with it
Zucker punched: Google gobbles Facebook-wooed Titan Aerospace
Up, up and away in my beautiful balloon flying broadband-bot
Nvidia gamers hit trifecta with driver, optimizer, and mobile upgrades
Li'l Shield moves up to Android 4.4.2 KitKat, GameStream comes to notebooks
Gimme a high S5: Samsung Galaxy S5 puts substance over style
Biometrics and kid-friendly mode in back-to-basics blockbuster
AMD unveils Godzilla's graphics card – 'the world's fastest, period'
The Radeon R9 295X2: Water-cooled, 5,632 stream processors, 11.5TFLOPS
Sony battery recall as VAIO goes out with a bang, not a whimper
The perils of having Panasonic as a partner
NORKS' own smartmobe pegged as Chinese landfill Android
Fake kit in the hermit kingdom? That's just Kim Jong-un-believable!
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.