Government agencies have generally improved security around 'portable storage devices' (PSDs) such as USB memory sticks - but there are still some key agencies that have less than desirable controls, Privacy Commissioner Marie Shroff says.
A recent survey by the Office of the Privacy Commissioner of 42 main government agencies found an estimated 120 organisation-owned PSDs had been lost or stolen in the previous 12 months.
Methodology
This second New Zealand survey follows the format used in the Australian Privacy Commissioner’s survey released in April 20091. Although the format has been modified since last year, many of the questions are the same as last year to allow us to compare results. We selected 42 state sector organisations for participation in the survey:
- 35 Public Service Departments;
- 6 Non-Public Service Departments; and
- 1 Crown Entity.
On 19 February 2010 we sent covering letters with an enclosed survey to each Chief Executive (or equivalent) explaining the purpose of the survey. At the same time, we sent an electronic version of the survey to each CE’s Executive Assistant, requesting that they forward the survey to the staff member nominated by the Chief Executive to complete it.
The survey consisted of 45 questions. These fitted into the following categories:
- use of hardware or software controls;
- use of organisation-owned PSDs; and
- use of privately-owned PSDs
All 42 agencies surveyed responded in time to be included in the report.
The survey results are presented in four parts as follows;
- combined results of all 42 agencies on the use of hardware or software controls;
- combined results of all 42 agencies which allow use of organisation-owned PSDs;
- combined results of the 13 agencies which allow use of privately owned PSDs; and
- a comparison of key results after agencies were separated into three groups:
Group 1 Agencies that hold large amounts of personal information
Group 2 Agencies that primarily hold classified or sensitive information
Group 3 Agencies that hold relatively small amounts of personal information
Key Results
- 29 of the 42 agencies that responded to this year’s survey prohibited the use of personal PSDs for work purposes (14 of 37 agencies last year);
- an estimated 120 organisation owned PSDs have been lost or stolen in the 12 months to March;
- 79 percent of agencies surveyed keep a PSD register (62 percent last year);
- 76 percent or agencies surveyed used hardware or software controls (59 percent last year);
- many agencies have controls only on some PSDs they provide to staff; and
- agencies which primarily hold sensitive or classified information continue to out - perform agencies which primarily hold personal information.