NHS Digital recorded 393 lost or stolen devices between September 2020 and September 2021, including 52 mobiles, 19 laptops and three tablets.
In addition, a further 319 laptops were recorded as lost due to having no record of their disposal.
The maker of 256-bit AES XTS hardware-encrypted USB drives, submitted Freedom of Information (FoI) requests submitted to 16 government departments into the security of devices held by public sector employees.
Despite the number of misplaced devices, NHS Digital was not required to notify the Information Commissioner’s Office (ICO) of any lost or stolen devices in the past year. These incidents were related to encrypted devices. It was unlikely to risk individuals’ rights and freedoms as required under Article 33 of the UK GDPR.
All organisations, whether they operate in the commercial or public sector, should take heed of the level of mitigation encryption brings in a breach event.
Apricorn MD Jon Fielding said that lost and stolen devices were unavoidable.
“However, there are still many losses, any one of which could very easily put sensitive public data at risk. Fortunately, in the case of NHS Digital, despite the mishap in recording the disposal of many laptops, their security processes ensured that all these devices were encrypted. As a result, the data they housed were protected”.
Meanwhile, FOI requests submitted to the Ministry of Justice (MoJ) revealed a total loss of 184 mobile phones, PCs, laptops and tablet devices in the same period compared with 161 in 2019/20. These increasing numbers, alongside the fact that the MoJ also declared an alarming 2152 data breaches (September 2020 and September 2021), are frightening given the nature of the information at risk.
Research into the Home Office’s Annual Report and Accounts 2020-21 also highlighted a massive loss of 1150 inadequately protected electronic equipment, devices or paper documents from outside secured government premises, and a further 1085 from within secured government premises.
Additionally, it reported 2229 data incidents via unauthorised disclosure, 157 incidents through insecure disposal of inadequately protected electronic equipment, devices or paper documents and 351 via ‘other’ data incidents.
Her Majesty’s Revenue and Customs (HMRC) shared detailed information on the number of lost and stolen devices between (September 2020 and September 2021), which totalled 346, a drop on the 375 misplaced in 2019-2020. HMRC also noted that 111 of those devices were lost in tracked transit and suggested that the losses during transit reflect the higher volumes of movements to and from staff working from home due to COVID-19 restrictions.
The Department for Education (DfE) also confirmed it had lost or reported stolen 116 devices between September 2020 and September 2021. This was 23 fewer than 2020, but still worryingly high and exceeds the 91 lost devices highlighted in the 2019 findings.
The Department for Business, Energy and Industrial Strategy misplaced 107 devices compared with 193 last year. In comparison, the House of Commons confirmed that 15 machines had been lost or stolen compared to 38 in 2019/20, and the House of Lords declared seven lost or stolen, one less than 2019/20.
Fielding said: “While it’s great to see the numbers declining for several government departments, big or small, these losses and subsequent breaches of information prove that there is still work to be done. These departments must educate their employees on data security best practices and recognise that security and compliance are not a tick box exercise that requires continual effort through enforced policy, processes, and technology.”
All but one of the responses from government departments confirmed that all devices were encrypted. Public Health England declined to respond.
Of those that responded, just five government departments confirmed they have a data backup in place. Additionally, all those questioned declined to answer or would neither confirm nor deny if they had been subject to ransomware demands in the past year.
Fielding added: “We trust these government departments to responsibly and securely manage and store sensitive personal data and intellectual property. Encryption is the safest way to do so, and hardware encrypted storage devices should be provided as standard to ensure their data is unintelligible should they go MIA.
