Data Breach Exposes RAF Staff To Blackmail

Yehuda writes "Wired reports, 'Yet another breach of sensitive, unencrypted data is making news in the United Kingdom. This time the breach puts Royal Air Force staff at serious risk of being targeted for blackmail by foreign intelligence services or others. The breach involves audio recordings with high-ranking air force officers who were being interviewed in-depth for a security clearance. In the interviews, the officers disclosed information about extra-marital affairs, drug abuse, visits to prostitutes, medical conditions, criminal convictions and debt histories — information the military needed to determine their security risk. The recordings were stored on three unencrypted hard drives that disappeared last year.'"

Re:Since the RAF already knows...

[Anonymous Coward]

um, just because your boss knows something embarrassing, it doesn't mean your wife, family, whole world needs to know.

On the other hand, if your boss has special forces, it could work to your advantage...

Idiot: "Sir, you know that midget fetish I spoke about during the security interview?"

Chief Idiot: "Yes? I really quite enjoyed that bit. Quite naughty!"

Idiot: "Well, there are some chaps who think they can hold it over me, for a few quid, per week... not tell the missus, and all."

Chief Idiot: "Oh, well, that's not right, I'll send some SAS over there ASAP and they won't be a problem anymore."

Mr. Bean, Ministry of Defence Internet Security

[leftie]

"Ummm..."

Re:Mr. Bean, Ministry of Defence Internet Security

[legallyillegal]

I guess this is what happens when you put a teddy bear in charge of implementing security protocols.

An information society

[jasonmanley]

It seems to me that many organisations would consider payroll, health and other HR info as private and hence restrict access to it on the network, but they wouldn't consider encrypting it with a passowrd - well at least nowhere where I have worked.
And perhaps military institutions consider attack plans, weapons secrets and such as worthy of protection but not an "inteview" that we did "ourselves", "inhouse".
We are learning more and more that this is a connected world - yes even your fridge will have an IP address and be on the net one day mark my words and EVERYTHING will need to be encrypted. Encryption grammar and other security verbiage will be second hand speak for moms and kids ...
"have you packed your lunch"
"Yes mom"
"And MD5 SSL'd your homework via the kerebos LDAP certificate server? You know what happened last time when Mr Jones found your SSH key unencoded on the SELinux partition - I don't want to go through that again"
"Arghh yes mom I have been over this 1000 times with you let it go - my friends and I were scanning photons of the prom dance when James accidentally Bluetoothed a letter from his brother in the army to Amy's communication jewellery which had a compaible 3DES encrytpion algorithm - now will you let it go!? Shees!"
"I'm just saying is all - I have to go and buy some groceries and when I scan my embedded subcutaneous barcode it better not say that I have been SQL Injected because of a bad CRC checksum - I won't be embarrassed like I was the last time"

viral marketing???

[zetabrown]

"extra-marital affairs, drug abuse, visits to prostitutes, medical conditions, criminal convictions and debt histories " - sounds like a viral marketing campaign for the RAF if you ask me - who knew that they had so much fun! I suppose the word 'raffish' had to come from somewhere.

UK Government loses all data on everyone

[David Gerard]

Annual reports from Whitehall departments show that the government has lost all data it ever held on anyone [today.com].

Losses have occurred through couriered unencrypted disks, misplaced memory sticks, lost laptops, briefcases left on trains and files falling down the side of the tea machine. "The real scandal is that a train was running for them to lose a case on," said a source whose name has been lost.

Treasury minister Jane Kennedy said the HM Revenue and Customs breaches did not necessarily result in data losses, or at least any that they have records of. HMRC said it takes data losses and security breaches "very seriously" and thoroughly investigates any breach that it does not lose track of.

Information Commissioner Richard Thomas has served enforcement notices on various departments for their data losses, but the departments in question could not find their office addresses to accept the notices. They noted, however, that Mr Thomas' call was very important to them, and that he had been placed in a queue.

Home Secretary Jacqui Smith reassured citizens that plans for an all-encompassing ID card linked to biometric passports and a universal medical record with the NHS would not change because of these losses. "We won't even be thinking about them."

Re:It's no wonder...

[noundi]

Oh my god the UK recorded something and it leaked! Who could have ever imagined this possible outcome!?

Open Government

[Arancaytar]

I guess the British government is now following the principle of "information wants to be free". :P

Re:Mr. Bean, Ministry of Defence Internet Security

[Fred_A]

I guess this is what happens when you put a teddy bear in charge of implementing security protocols.

I dunno, I thought the "Do *not* leave at the pub" stickers on the drives were a brilliant idea.
Well, back to the drawing board.

Blackmail is such an ugly word...

[gnarlyhotep]

I prefer extortion. The X makes it sound cool. -Bender