Missing memory stick found in Leicester council worker's lunch bag

Trusted article source icon
Thursday, April 07, 2011
Profile image for This is Leicestershire

This is Leicestershire

A missing memory stick containing the medical and security details of thousands of Leicester residents has been discovered – in an employee's lunch bag.

The device disappeared last month from the offices of LeicesterCare, the city council service which supports vulnerable residents.

But at the weekend it was discovered in a plastic carrier bag, thought to have been used by an employee to carry lunch to work.

The council faces a fine of up to £500,000 for temporarily losing the device, which holds information about 4,000 elderly and vulnerable people.

A spokesperson for Leicester City Council said: "We have continued our search for the missing data stick and, as a result, can confirm that it was found over the weekend.

"As soon the data stick had been recovered, we ran a series of tests on it which indicated that the data on it has not been accessed during the period the device was missing.

"We are continuing with our investigation into the incident and will report fully on its findings as soon as this has been completed."

The employee whose bag the stick was found in will now be interviewed as part of the investigation.

A council worker, who was involved in the hunt for the stick, said: "Data protection is a massive worry for councils these days and there was utter panic when it was first discovered that the disk was lost.

"The fact that details on there were from some of the most vulnerable folks in Leicester made matters even worse.

"There was relief all round when it was found and things are already being tightened up to make sure that we know where all of our sensitive data is at any one time."

The missing device was used as a back-up to record information on council computers and was locked in a safe each night.

It is understood that the equipment was encrypted, so it would have been difficult for anyone intercepting the device to read the information contained on the stick.

The loss of the memory stick has already been reported to police and the Government's Information Commissioner's Office (ICO), which has started its own investigation.

If the city council is found to have failed to meet ICO guidelines, it could be fined a maximum of £500,000.

An ICO spokesman said: "The main concerns for us are whether or not the organisation has done enough to prevent that breach and whether or not the breach has caused damage."

The council has contacted all 4,000 people with medical information contained on the disk, and visited the 2,000 of those whose keysafe codes were also on the disk.

The codes are used to open boxes, attached to an outside wall of people's homes, which contain a key to the front door. The council has now changed nearly all of the codes.

27
Tweet this article
Report

27 Comments

  • Profile image for This is Leicestershire

    by Baz, Leicestershire

    Wednesday, April 13 2011, 11:14PM

    “If they are careless enough not to know or remember where they have put an important device like a memory stick with so important info on it then they are not fit to work there.”

  • Profile image for This is Leicestershire

    by Paul, Hamilton

    Friday, April 08 2011, 4:21PM

    “J Leic,

    How do my comments disagree from yours?

    They only thing I have presumed and many other is that something has gone wrong? and in all your responses something has for such sensitive data to go missing.

    In my orginal comments you answer the comments:

    "I presume LCC has a disciplinary code around these matters and if individuals are found to have broken them, then they should face the consequences." You have confirmed the answer is yes.

    If there are no disciplinary codes then someone in HR should be fired as there should be if the council was already on a warning and the data is highly sensitive.
    You have confirmed the answer is Yes so does not apply

    Obviously something has gone wrong as it should never of ended up in a lunch bag and by the sound of it an awful lot of time and money has gone into finding it. Again answer is Yes as it was misplaced and as you say there is a full enquiry so we shall get the answers why it got into the sandwich bag!

    Regarding the anonymous worker, well that is what was in the story and what we are all commenting on- unless you are suggesting the LM made it up?

    I entirely agree that Human error will take place but I am sure the inquiry will give suggestions on how it can be reduced.

    Hopefully the LM will do a follow up from the lessons learnt then we can all make some more comments for the enjoyment of readers to the website! lollll”

  • Profile image for This is Leicestershire

    by j, leic

    Friday, April 08 2011, 2:39PM

    “"If they are so professional how did it get in a sandwich bag in the first place!!! Memory sticks do not fly!"

    BANGS. HEAD. AGAINST. WALL.

    Right, I'll see if I can dumb this down even further to help you understand:

    Person who own bag might not be person who put stick in bag. Nasty person might have put stick in bag. Stick might have fallen in bag from desk. Person might have put stick in bag thinking it was theirs. Lots of ways stick might have got in bag. Assumption = bad. Full investigation = good.

    Got it yet?

    "If I have secure IT data I never let it out of my sight. Also it would be on a password protected security stick......"

    You mean like the encryption that was used on the stick making it far more secure than a simple password which is hackable in minutes?

    "Also as a council worker is quoted ""There was relief all round when it was found and things are already being tightened up to make sure that we know where all of our sensitive data is at any one time."

    Ah yes, the anonymous worker being used as evidence of an absolute truth! A cunning ploy sir! You'll excuse me if I don't base my view of the systems in place at the Council on an anonymous quote from a Council officer, and actually base it on verifiable reality!

    Human error or misconduct will always happen, no matter what processes and systems are in place.”

  • Profile image for This is Leicestershire

    by Paul, Hamilton

    Friday, April 08 2011, 1:16PM

    “J sounds like you need to lay down!!

    Although regarding your comment "These are professional people we are talking about, often far more qualified and intelligent than the arm chair experts who comment! "

    If they are so professional how did it get in a sandwich bag in the first place!!! Memory sticks do not fly!!

    If I have secure IT data I never let it out of my sight. Also it would be on a password protected security stick so if it was lost there would not be "utter panic when it was first discovered that the disk was lost"

    Also as a council worker is quoted ""There was relief all round when it was found and things are already being tightened up to make sure that we know where all of our sensitive data is at any one time."

    Which suggests that the policy was not tight enough or we would not get council employees making comments like this.

    I do hope we will see in LM the outcome of the report in why it went missing.”

  • Profile image for This is Leicestershire

    by j, leic

    Friday, April 08 2011, 9:48AM

    “Ps, CG, what about if they didn't know it was there? Would you just assume that they did know and were lying and punish them for not owning up?!”

  • Profile image for This is Leicestershire

    by j, leic

    Friday, April 08 2011, 9:44AM

    “"What I would like to know is whether the employee concerned owned up and handed the memory stick over or someone else found it whilst conducting a search. Any susequent action should then bear this in mind.
    CGLee, near Melton"

    Gosh, thanks for that insight CG; have you ever thought about becoming an HR consultant? You insightful way of looking at issues that have been dealt with thousands of times before, bringing a whole new approach to the table, is refreshing and revolutionary.

    Perhaps you could apply some of your principles to the legal profession, you know, like getting time off your sentence if you confess at an early stage, which I'm sure you are a strong supporter of..........”

  • Profile image for This is Leicestershire

    by j, leic

    Friday, April 08 2011, 9:41AM

    “"J, Yes Maria does make an awful lot of assumptions that all those questions need to be asked and answered.

    I presume LCC has a disciplinary code around these matters and if individuals are found to have broken them, then they should face the consequences.

    If there are no disciplinary codes then someone in HR should be fired as there should be if the council was already on a warning and the data is highly sensitive.

    Obviously something has gone wrong as it should never of ended up in a lunch bag and by the sound of it an awful lot of time and money has gone into finding it.
    Paul, Hamilton"

    For gods sake, this is like going round in endless circles!!

    Lets not forget that the Public Sector often leads the way in HR practices more often than not (it has a higher level of statutory duty placed on it than business). I am gobsmacked that armchair experts like Maria and Paul who quite blatantly know nothing about local govt HR practices are coming out with the rubbish that they are.

    Instead of having a bulging veined Victor Meldrew fit of uninformed indignation ("i presume", "if there are no", etc, etc) how about actually finding out the details??!! Of course the Council has all the processes and systems in place that you refer to. Council IT policies are INCREDIBLY tight and strict, and you can get sacked immediately for gross breach of them.

    Why do some people think that Councils are run by semi-literate toddlers? These are professional people we are talking about, often far more qualified and intelligent than the arm chair experts who comment!”

  • Profile image for This is Leicestershire

    by Hudson, Leicester

    Friday, April 08 2011, 7:24AM

    “I have three relatives affected by this: they were relieved that the council acted so swiftly to change their keysafe codes.

    For those who want to know if the data was encrypted: try reading the article (and all previous articles) properly. It was.

    It's good practice to have data offsite but it must be handled securely and there are many ways to do this, including "cloud" technology. A memory stick is not the best way - and in this case should never have been out of the safe.

    The only comment I have about the worker is this: it's been several weeks since the stick went missing. How come it has only been found now, in a shopping bag that "may have" been used to carry lunch? Lieutenant Pigeon springs to mind...”

  • Profile image for This is Leicestershire

    by CGLee, near Melton

    Thursday, April 07 2011, 10:36PM

    “What I would like to know is whether the employee concerned owned up and handed the memory stick over or someone else found it whilst conducting a search. Any susequent action should then bear this in mind.”

  • Profile image for This is Leicestershire

    by Kamilla, Leicester

    Thursday, April 07 2011, 9:13PM

    “£500,000 fine, yep they will pay that and cut more services, so it won't matter to them in the end anyway.
    If they took things like this so seriously they wouldn't have let it happen twice!
    Where's the nearest carpet to sweep it under - again!!”

        Your comments awaiting moderation

        Add your comments

        max 4000 characters