Stolen laptop teaches Stanford a lesson on need for encryption

Computerworld - From the "Why aren't these systems encrypted already?" department comes yet another story of a laptop theft resulting in the potential compromise of personal data belonging to a large number of people.

This time, the victim is Stanford University, which on Friday issued an alert notifying its community of a laptop theft that puts about 72,000 faculty members, staffers and students at risk of identity theft. The theft affects people who have been employed with the university in any way before September 2007.

The stolen laptop contained the names, addresses, Social Security numbers, birth dates, university ID and employee numbers, as well as salary information, Stanford said in a statement posted on its Web site.

As has become typical with such announcements, a university official sought to downplay concerns by expressing doubt that the laptop had been stolen for its data. "We believe that the perpetrator of the crime was not seeking the records on the computer or even aware of them," said Randy Livingston, the university's chief financial officer, in a statement. In most such thefts, the hard drives are erased before the laptop is resold, he added.

It was not immediately clear from the statement if the laptop owner was authorized to store the data on the laptop in the first place. But a comment from Livingston about the need for the university to review its guidelines for storing sensitive information made it appear that the data on the stolen laptop had not been encrypted. An FAQ attached to the statement did not offer any details on whether the data had been encrypted, citing an ongoing investigation by law enforcement.

The university's loss continues a long and growing list of data compromises resulting from lost or stolen laptops. In almost all cases, the organizations that lost the equipment had not encrypted the data, despite the longstanding advice from analysts on the need for it.

The Breach Blog, which maintains a list of recent data compromises, listed two other incidents disclosed last week. One breach involved a stolen laptop containing salary data on an unknown number of management staffers at AT&T Inc., while the other involved a laptop belonging to the New Mexico Department of Workplace Solutions. In both incidents, the contents of the laptops were unencrypted.

This is the second time in less than a year that AT&T has suffered a laptop theft involving the loss of sensitive data. Last August, the company disclosed that a laptop containing unencrypted personal data on current and former employees of the former AT&T Corp. was stolen from the car of an employee of a professional services firm doing work for the company. That theft prompted the company to notify an unspecified number of individuals about the potential compromise of their Social Security numbers, names and other personal details. The theft affected only AT&T employees who were at the company before it was acquired by SBC Communications Inc.

Correction: This story has been changed since it was originally posted to say that the laptop theft affects faculty, staff and students who were employed at the university before September 2007.

Read more about Security in Computerworld's Security Topic Center.