FBI Is Sloppy On Secure Data Storage and Destruction, Warns Watchdog

The Register's Iain Thomson reports: The FBI has made serious slip-ups in how it processes and destroys electronic storage media seized as part of investigations, according to an audit by the Department of Justice Office of the Inspector General. Drives containing national security data, Foreign Intelligence Surveillance Act information and documents classified as Secret were routinely unlabeled, opening the potential for it to be either lost or stolen, the report [PDF] addressed to FBI Director Christopher Wray states. Ironically, this lack of identification might be considered a benefit, given the lax security at the FBI's facility used to destroy such media after they have been finished with.

The OIG report notes that it found boxes of hard drives and removable storage sitting open and unattended for "days or even weeks" because they were only sealed once the boxes were full. This potentially allows any of the 395 staff and contractors with access to the facility to have a rummage around. To deal with this, the FBI is installing wire cages to lock away storage media. In December, the bureau said it would install a video surveillance system at the evidence destruction storage facility to tighten security. As of June this year, it was still processing the paperwork to do so. The OIG also found that FBI agents aren't tracking hard drives and removable storage sent into the central office and the destruction facility. Typically, seized computers are tagged for tracking, but as a cost-saving measure, agents are advised to send in media storage devices containing national security information without the chassis. While there is a requirement to tag removable storage, there isn't the same requirement for internal hard drives. [...]

The FBI has assured the regulator that it has the problem in hand and has drafted a Physical Control and Destruction of Classified and Sensitive Electronic Devices and Material Policy Directive, which will require data to be marked up and destroyed safely. The agency says this policy is in the final editing stage and will be issued as soon as possible.

fruit of the poisonous tree

[Joe_Dragon]

if the FBI messes up the chain of your evidence then you should be able to get off.

Re:

[timeOday]

This isn't that. It's about their disposal chain for stuff they're done with.

Re: fruit of the poisonous tree

[50000BTU_barbecue]

Joe Dragon has never once posted anything that makes sense.

Re:

[Marful]

Or... not quite done with but destroy prematurely.

Didn't they let a suspect destroy evidence?

[Marful]

Didn't they let a suspect of an investigation willingly and knowingly destroy evidence, and then give them immunity after the fact?

Re:

[labnet]

Most corporations actually hate cutting corners, because they know it pays them back in future pain, but corporations have to make a profit. Government has no such obligation.

Re:

[Tablizer]

That's not entirely true because current commonly used ROI models prefer a short-term payout over long-term. Thus, too many companies milk away the future to have profit now. Part of the theory is it boosts their stock price, and this boost allows them to pay for "fixing the future" at a later time.

Japan and Germany have better quality because their system mostly rejects this philosophy. Boeing and Intel both sold out the future for the here and now. Those who made money off them probably knew to get out be

One old lady

[engineer37]

One old lady with a clip board and a usb stick could probably break the best cyber security in the country. The fact that this is an old joke shows how long this has been a problem, which makes it even worse that very little has been done about it in all these years.