iPods, USB drives are 'security risks'

Security is threatened at more than 20 government agencies that allow staff to use their own iPods, flash drives and other devices, the privacy commissioner says.

Marie Shroff said two thirds of 37 agencies surveyed allowed staff to use portable storage devices (PSDs) that put confidential or personal information at risk.

PSDs such as USB sticks, iPods, iPhones, Blackberrys and cellphones could store and transfer large volumes of information. They could easily be lost or stolen, exposing organisations to risks of major data breaches, she said.

The devices could be "potentially major security risks" if they contained unsecured sensitive data.

In May, the commission surveyed government use of PSDs including police and defence forces, ministries, State Services and Crown Law and found "real gaps in procedure and practice".

Of the 37 agencies, 95 per cent made PSDs available to staff and three-quarters had policies to control their use. But less than half had procedures for deleting data and just nine agencies made encryption mandatory.

Sixty-two per cent kept a PSD register but only 22 per cent would be able to track transfers of data.

Ms Shroff said agencies holding classified or sensitive information had tighter controls over the use of PSDs than other agencies.

"However, it is worrying that agencies that hold the largest amounts of personal information had fewer controls."

The commission recommended that agencies should have a policy on PSD use. They should also make staff aware of the need to report losses or theft, and how to delete data.

Encryption should be used for all PSDs likely to store personal information, and strict limits on personal PSDs should be enforced.

"We want to get it right before we get it wrong," Ms Shroff said.

A police spokesman said police were considering the recommendations. Police had a policy on "moveable storage media", data they could contain and how it should be destroyed.

State Services Commission spokesman Jason Ryan said the commission had no specific policy on PSD use, as it had an information and communication policy. Staff could not connect PSDs without permission.

- © Fairfax NZ News