3 ms·

> Heathrow Airport seems to have been in denial that anyone might save data to drives or, if they did, would fail to secure them properly. Just entertaining my

> Heathrow Airport seems to have been in denial that anyone might save data to drives or, if they did, would fail to secure them properly. Just entertaining myself here by speculating, but could it have been possible that someone attempted to steal this information from the airport with malicious intent and lost it?

eesmith 8y ago
The odds would be extremely low, and would fall into Schneier's 'movie plot threat' category, https://en.wikipedia.org/wiki/Bruce_Schneier#Movie_plot_threat https://en.wikipedia.org/wiki/Bruce_Schneier#Movie_plot_thre... More specifically, we know that people use USB sticks to transfer data, even across "secure" air-gapped systems. (Eg, Stuxnet.) Some organizations will even fill USB slots with glue to prevent this sort of use. By comparison, the rate of espionage/information theft through physical access to the data is much lower. Since you posit a rare occurrence - information theft - followed by an even more rare scenario - losing the information - I can easily conclude that it's very unlikely.
- practice9 8y ago
  > The odds would be extremely low That's why I have trouble believing this story really happened. Simpler explanation would be that money simply changed hands for reasons unknown (bribes, etc.)
  - eesmith 8y ago
    You think it's easier to believe that The Sunday Mirror paid someone at Heathrow to deliver a USB stick than it is to believe that lots of people at Heathrow are using USB sticks and one of them dropped it? And you think The Sunday Mirror lied to the Information Commissioner’s Office about the data provenance? That is, lied that it was found by a member of the public in Kilburn, and/or lied that it was viewed by that same member of the public on a public library computer before handing it over to The Sunday Mirror? I don't. I don't see why you do. I don't see why we should regard your interpretation as "simpler". Especially when (according to the linked-to report), Heathrow Airport Limited's own investigation could figured out who lost the stick, concluded that the USB stick was likely lost during commute-time transit, and showed that there were serious information security problems at Heathrow, with 'limited data protecting training in place' and no technical methods in place to keep data from being transferred to unencrypted or unauthorized sticks? The report disagrees with your doubt, saying "The Commissioner has made the above findings of fact on the balance of probabilities." How do you end up with a different balance? What scenario are you thinking of?

eesmith 8y ago

The odds would be extremely low, and would fall into Schneier's 'movie plot threat' category, https://en.wikipedia.org/wiki/Bruce_Schneier#Movie_plot_threat https://en.wikipedia.org/wiki/Bruce_Schneier#Movie_plot_thre... More specifically, we know that people use USB sticks to transfer data, even across "secure" air-gapped systems. (Eg, Stuxnet.) Some organizations will even fill USB slots with glue to prevent this sort of use. By comparison, the rate of espionage/information theft through physical access to the data is much lower. Since you posit a rare occurrence - information theft - followed by an even more rare scenario - losing the information - I can easily conclude that it's very unlikely.

practice9 8y ago
> The odds would be extremely low That's why I have trouble believing this story really happened. Simpler explanation would be that money simply changed hands for reasons unknown (bribes, etc.)
- eesmith 8y ago
  You think it's easier to believe that The Sunday Mirror paid someone at Heathrow to deliver a USB stick than it is to believe that lots of people at Heathrow are using USB sticks and one of them dropped it? And you think The Sunday Mirror lied to the Information Commissioner’s Office about the data provenance? That is, lied that it was found by a member of the public in Kilburn, and/or lied that it was viewed by that same member of the public on a public library computer before handing it over to The Sunday Mirror? I don't. I don't see why you do. I don't see why we should regard your interpretation as "simpler". Especially when (according to the linked-to report), Heathrow Airport Limited's own investigation could figured out who lost the stick, concluded that the USB stick was likely lost during commute-time transit, and showed that there were serious information security problems at Heathrow, with 'limited data protecting training in place' and no technical methods in place to keep data from being transferred to unencrypted or unauthorized sticks? The report disagrees with your doubt, saying "The Commissioner has made the above findings of fact on the balance of probabilities." How do you end up with a different balance? What scenario are you thinking of?