Lost Data: a hostage to fortune

1. CSRI– Cyber Security Research Institute Lost Data: a hostage to fortune Discarding your data leaves a vital part of your past at the mercy of a casual passerby

2. Data, data everywhere • Laptops and PCs – In 2002 the number of PCs in the world reached a billion. By 2007 Gartner said the 2 billion mark had been reached. In 2008 one billion PCs were in use by 2014 it is predicted that figure will be 2 billion. Recent Gartner figures show PC sales at around 92.7m a quarter. • Mobile phones – Over 5 billion mobile phone connections in the world. An 18 month period ending in June last year, accounted for one billion of that figure. • USB sticks – unknown number due to amount being generated from poor quality assembly houses in Asia • SD cards – 300m now sold each year, of those 75% are micro SD and the usual size is now 8Gb

3. What sort of data is discarded? • Bank account details • Databases • Email – often compromising • Pictures – very frequently compromising • Internet search details • Correspondence • Work-related information • Illegal information

4. In an information age data has value Willie Sutton – 1930s bank robber Journalist – “Why rob banks? Sutton – “Because that’s where the money is.”

5. Is there a market in data? • Are criminals doing this? • Russian organised criminals actively fuzzy match data to produce information for sale. • The information is sold for fraud and identity theft. • Indications it is now being sold for targeted attacks • In 2004 Future Intelligence revealed that call centres staff in India were being bribed to provide the personal details of UK nationals. The investigators were told that a thriving trade in data had developed with the ultimate market being in Russia • In 2009 researchers working for a multi-national technology company in Kenya found that hard drives with data on them sold for twice as much as those without. • a recent notable case originating from Ghana was one in which U.S. Congressman Robert Wexler (Democrat-Florida) was contacted by a Ghanaian, who attempted to blackmail him with information stolen from one of Wexler’s discarded hard drives that had found its way to Ghana’s second-hand computer market (Abugri, 2011).

6. What are the consequences? • For the individual • Blackmail • Identity theft • Fraud • Misrepresentation • Malicious manipulation of data • For data keepers • Reputational loss • Litigation – business and civil suits • Financial penalties from regulators • Business failure

7. What does the future look like? • By the middle of 2013 most people in the UK will be using smartphones to connect to the internet. • According to predictions from the research house Gartner some 1.8 billion smartphones will be in use worldwide by 2013 and for the first time will overtake PC use, a projection that has major implications for UK companies. • Meanwhile forecasts by the telecommunication company Ciscosuggest that by the end of 2012 the number of mobile-connected devices will exceed the number of people on earth. By 2016 there will be over 10 billion mobile-connected devices. •  Currently some 12 percent of mobile phones in the world are smartphones yet they account for 82 percent of global mobile data traffic, a figure that has tripled in a year. •  Future developments in 4G point to even greater usage of data; 4G devices currently only account for 0.2 percent of mobile devices, yet are responsible for 6 percent of data traffic.

8. What needs to be done? • Individuals need to be provided with default level encryption to safeguard their privacy. • Businesses need to introduce default level encryption to safeguard, their employees privacy, their customers’ privacy and their own assets

9. Who needs to do it • Individuals – need to start taking the protection of their data seriously. • Businesses • Hospitals • Councils • Government

10. What do they need to protect? • Everyone needs to set a value on the information held by them on all storage devices and have a system in place to protect that data. The simplest way is to encrypt it in the first place

11. Quantification of the value of data • What is your data worth to you? • What does your data mean to you, what is it’s value? • What is your data worth to someone else?