Confidential CD Turns Up in Laptop Bought on eBay.

[Tuckerfan]

Oops.

A highly confidential Home Office disk was found hidden in a laptop computer sold on eBay.

The CD was found between the keyboard and circuit board of the laptop by computer repair technicians in Westhoughton, near Bolton.

Technicians at the shop called police who sent around anti-terrorist officers to confiscate the machine, which had been bought in good faith.

Mr Bevan put the disk into the drive to check it and found it was encrypted.

“It also said, ‘If found please return’. I thought, ‘That’s a funny thing to have on there,’ but there you go.”

At least it was encrypted. When the laptops containing the voting records of Nashville voters (along with their name, address and SSN), none of it was encrypted. (The laptops turned out to have been stolen by a homeless man and were quickly recovered.)

[mnemosyne]

I know nothing about encryption; If the CD was in a laptop, isn’t it possible that the laptop had the software needed to read the CD anyways? How do they know it wasn’t viewed (I suppose the obvious answer is that it would absolutely need a password; is that the case?)

Anyways, interesting story. I wonder how much information on “us” gets sent out/ends up in the wrong place? A few years back there was a story of the CIBC bank chain faxing bank account information to a junk yard in New Jersey - it had been ongoing for a long time, and the junk yard owners would destroy the faxes and call and call, but they just kept coming through. I wonder if that ever got resolved…

ETA: not Jersey, West Virginia… sorry, it was 4 years ago! Still don’t know if it was resolved, though… http://www.ctv.ca/servlet/ArticleNews/story/CTVNews/1101436308027_38

[Tuckerfan]

@mnemosyne

I know nothing about encryption; If the CD was in a laptop, isn’t it possible that the laptop had the software needed to read the CD anyways? How do they know it wasn’t viewed (I suppose the obvious answer is that it would absolutely need a password; is that the case?)

Well, they can tell when a laptop’s been powered up, and without the password (which is often written on the machine itself), it’s not easy to get the information if it’s been encrypted, but it’s not impossible.

Disk encryption software used on many systems can be circumvented using what researchers referred to as “simple non-destructive techniques”.

A report from researchers at the Electronic Frontier Foundation, Princeton University and Wind River Systems concluded that many current consumer disk encryption programs can be compromised via a computer’s DRam.

The problem is that data can remain in stored in memory even after the system is shut down. By cold-booting the system, an attacker could access data from the DRam and retrieve encryption keys.

[Quartz]

Someone is going to be getting a visit from Special Branch.