BSI ID: G 0.16

Theft of equipment, data carriers or documents The theft of data carriers, IT systems, accessories, software or data results in costs for replacement and restoration to a working condition, as well as losses due to lack of availability. If confidential information is disclosed as a result of the theft, this can lead to further damage. In addition to servers and other expensive IT systems, mobile IT systems, which are inconspicuous and easy to transport, are also frequently stolen. However, there are also cases in which data carriers such as documents or USB sticks have been stolen specifically to obtain the confidential information stored on them.

Examples:

• In the spring of 2000, a notebook disappeared from the US State Department. An official statement did not rule out the possibility that the device might contain confidential information. Nor was it known whether the device was secured against unauthorised access by cryptography or other measures.

• A German federal office was broken into several times through the same unsecured windows. Among other valuables, mobile IT systems also disappeared. It could not be ruled out with certainty that files had been copied or manipulated.

• In the United Kingdom, there were a series of data breaches in which confidential documents were disclosed because data carriers were stolen. In one case, several computer hard drives containing highly personal information that had been collected for employee security checks were stolen from the British Air Force.

• Shortly before leaving the company, a call centre employee made copies of a large amount of confidential customer data. After leaving the company, he sold this data to competitors. Details of the incident were subsequently leaked to the press, causing the call centre to lose many important customers.