Australian Police Lose Thousands of Public Records

June 27th, 2006: Australian High Tech Crime Centre in very low-tech error exposes the personal banking details of 3,500 people.

The Russian 'mafia', thousands of bank records from nearly 20 banks, classified dossiers, a plane to London - all the makings of a crime thriller, but this one reached its conclusion in a style more fitting to the Police Academy series as, yet again, a USB thumb drive containing sensitive data was lost.

The Australian High Tech Crime Centre (AHTCC), which has been in operation since 2002, is the unit responsible for the investigation into email 'phishing' apparently run by Russian crime gangs. The investigation entailed collecting some 3,500 bank records of people who had already succumbed to the scams.

"Where did we put that USB thumb drive?" - All joking aside, the AFP's great work during the Solomon Islands riots is contrasted by shoddy document management at home.

Details included in the records include names, banking details such as branch names and numbers, and bank account numbers. Following searches in Sydney, Singapore and London, the hardware has still not been located.

The, unnamed, officer responsible for this breach in security not only transported confidential information, he or she did not encrypt the information, nor did they lock the drive, but they did store this data along with other highly-classified documents.

This basic error, not only in security but in records and document management, comes only two months since Brigadier Elizabeth Cosson left a copy of the confidential draft report into the death of Private Jake Kovco in Qantas Club lounge at Melbourne Airport.

Both these incidents highlight the problems inherent in any ECM or ILM system which has no policy for managing end-point security. In this case, however, the fact that the self-styled 'High Tech' Crime Centre does not issue its officers with encryption keys, and does enable them to bring the technological equivalent of a loaded weapon into the office, suggests that the infrastructure needs some serious examination.

USB Keys in the workplace - a disaster waiting to happen?Tell us your opinion