ITWire

iTWire previously reported that security vendor Sophos had purchased 50 thumb drives at a RailCorp lost property auction in Sydney. Two-thirds of the devices were infected with malware, and the 4443 directly accessible files they contained involved the sort of data you probably wouldn't want to go into circulation, including photo albums, AutoCAD drawings, and software source code. None of the files were encrypted.

After an 'own motion' investigation, the NSW Privacy Commissioner has commended RailCorp for its subsequent change of policy. Without waiting for the Commissioner's report, but after determining that securely erasing such devices prior to auction could not be justified in terms of cost and the amount of labour required, RailCorp has decided to arrange for the secure destruction of thumb drives if an examination of their contents does not reveal the owner's identity.

"Taking into account the limitations of the existing ‘cleansing’ process, the potential risks to the Agency in this aspect of their operations when managing their privacy obligations under the PPIP Act, coupled with the economic necessity for RailCorp to run its lost property operation on a cost recovery basis, it seems prohibitive to the Privacy Commissioner for RailCorp to continue to offer such portable date storage devices (USB keys) for sale," said the Deputy Commissioner in a written report.

"The Privacy Commissioner considers that RailCorp’s assessment of the risk to the privacy of individuals is correct and that the decision to cease auctioning USBs is the most reasonable outcome."