Research highlights mobile data security risks

Organisations and individuals need to ensure that data is removed from mobile devices before they are disposed of, according to research carried out by BT, the University of Glamorgan in Wales and Edith Cowan University in Australia.

Researchers bought 160 second hand gadgets and found that one in five still contained sensitive company and personal information such as salary, financial company data, bank account details and sensitive business plans.

Discarded Blackberry devices were found to hold the largest amount of information - many of which were left unprotected despite having built-in security features such as encryption.

For example, an examination of one Blackberry revealed that the device had been used by the sales director for Europe, the Middle East and Africa (EMEA) of a major Japanese corporation. It was possible to recover the call history, the address book, the diary and the messages from the device and the information that was contained in these provided:

- The business plan of the organisation for the next period
- The identification of the main customers and the state of the relationships with them
- The relationship of the individual with their support staff
- Details of the personal life of the individual including details of their children and their occupations, movements, marital status, addresses, appointments and addresses for his dental and medical care providers
- Bank account numbers and bank sorting code
- Car make and registration index

Although far less sophisticated, one in five mobile phones still contained sufficient individual information to allow researchers to identify the phone’s previous owner and employer.

“Given the level of exposure that the subject of security and identity theft has recently received, and the availability of suitable tools to ensure the safe disposal of information, it is difficult to understand why organisations are not taking the necessary precautions when disposing of hand-held devices,” said Dr Andy Jones, head of information security research at BT.

“These everyday items now contain sophisticated digital memory capable of storing huge amounts of sensitive data. Organisations must ensure that adequate procedures are in place to destroy any data and to check that these procedures are effective.”

Dr. Iain Sutherland, who leads the research team at the University of Glamorgan, added: “Many large organisations currently dispose of obsolete hand-held devices by donating them to charities. It was discovered during the course of the research that a number of these charities then pass on a large percentage of these devices to places like China and Nigeria, both of which are regarded as posing a real threat to the security of information.”