Thursday, 28 November 2013

Royal Borough of Windsor & Maidenhead loses 388 laptops!

Windsor Labour members were shocked to hear that the council recently announced that they had lost 388 laptops. Not only that, the Chairman of the Audit and Performance Review Panel, Councillor Duncan McBride, dismissed it as 'not a big security breach'. With some of the lost laptops being assigned to schools, we were really concerned.

Our Chairman, Roy Reeves has written the following letter to Councillor McBride, asking some key questions. Watch this space for updates:

Roy Reeves
Chairman,
Windsor Labour Party
c/o 4 Knights Close
Windsor
SL4 5QR

Councillor Duncan McBride
Chairman, Audit and Performance Review Panel
Royal Borough of Windsor & Maidenhead Council

(By Email)

28th November 2013

Dear Councillor McBride,

I refer to the minutes of the Audit and Performance Review Panel on the 14th of November and the subsequent report by the Royal Borough Observer newspaper on the 25th of November: “Loss of 388 council laptops described as 'not a big security breach’. In the Observer article, you were quoted as saying: “It is not the first time it has come before us. It is clear from the previous meeting that this is not a major security breach.” A review of the minutes from previous meetings of the Audit and Performance Review Panel in 2013 finds no mention of this issue at all.

The Windsor Labour Party has very grave concerns about the loss of residents’ personal data within these 388 laptops, some of which were apparently in schools meaning that potentially information on children is contained within them. We would expect that you have already reported this issue to the Information Commissioner. There seems to be an extremely large disparity between the 388 figure and the figures disclosed in the response to Freedom of Information request FOI63300, which states that only 6 laptops were lost between 2008 and 2011.

In addition, we are concerned by what appears to be a blasé attitude by the panel to the loss of the laptops and to information security in general, because some of the laptops were old. We concur with the commenter ‘DatchetVillager’ on the Royal Borough Observer’s website who stated:  “Exactly what does the age of a laptop have to do with Data/Information ! The five year old laptop could have 20 years of data on it if it was used by a long serving employee, who would have moved his data from old to new laptops as changes happened.”

We therefore have a number of questions, which we would like you to answer:

1.      Has the breach been reported to the Information Commissioner’s office?
2.      Was the data on all the missing laptops encrypted?
3.      What personal data of residents was held on the 388 missing laptops?
4.      In the case of the missing laptops attributed to schools, what information about school children is contained on these laptops?
5.      Have the Police been informed, given that Freedom of Information request FOI63300 stated that only a total of 6 laptops were missing?
6.      How many missing laptops were assigned to agency staff or employees who have now left the council?
7.      What disciplinary action has been taken in terms of the staff involved?
8.      What steps are now being taken to find the missing laptops and recover them?
9.      What controls do the council have in place for secure destruction of electronic equipment?
10.  Why do the council consider this to be “not a big security breach”?

I look forward to your response.

Yours sincerely,




Roy Reeves
Chairman, Windsor Labour Party

No comments:

Post a Comment