WA Government discovers dangerous data leakage

Stuart Corner
Monday, 31 March 2008 10:53

Your IT - Home IT

The WA Government's Auditor General's department purchased a sample for former government computers at auction and from second hand stores - and was able to recover confidential information on four out of 10 of them.

The Auditor General's Public Sector Performance Report 2008 states that: "From these computers we were able to recover confidential and sensitive data, including information about public sector employees, detailed technical information about agencies IT systems and documentation of their internal software development projects."

Examination of the computers was carried out using forensic software purchased at a cost of $680, though the report added that "this could be done using less expensive commercial software or even free software available on the Internet."

In addition to sensitive government information the report noted that "All four computers contained personal information of the previous users such as photos, personal emails and letters, resumes, performance reviews, and contact details...This kind of information could potentially be used to design social engineering attacks targeting the agencies or to assist in identity theft and other fraudulent activities."

Hard drives of three of the four computers had been formatted prior to disposal, indication that some attempt had been made to remove sensitive data. The fourth computer still had an operating system and licensed software installed indicating that there had been no attempt to remove any data or software prior to disposal.

"We were able to recover sensitive information from four out of 10 computers relating to three government agencies. The data from the other six ex-government computers could not be recovered. We established that all six computers were from the same agency," the report said.

The AG's department purchased a sample of 19 second-hand computers at prices ranging between $2 and $180, selected because they bore some evidence to suggest that they might be ex-government. However, subsequent examination revealed that only 10 were government computers. CONTINUED