Portable PC drives security issue for U.S.

WASHINGTON, May 24 (UPI) -- The growing use of portable computer devices like flash drives is a potential privacy and security nightmare for U.S. government agencies.

"The reports we've seen over the past year (about the theft or compromise of personal data on U.S. government laptops or other computer media) are just the tip of the iceberg," technology executive John Jefferies told United Press International.

"We are expecting a huge number of similar reports over the next 18 months" relating to the use of ever-smaller and more powerful flash drives and other USB-compatible portable media.

Jeffries, whose company, Red Cannon, markets a proprietary technology to protect data in portable devices, said his assessment was based on the increasingly ubiquitous character of the drives and on his knowledge about the experience of the private sector.

"Flash drives have become an indispensable part of the workflow in the modern office," he said, adding that many companies had "exactly the same policies and procedures (for protecting data on portable devices) as the federal government, and they are ignored to exactly the same extent."

Jeffries said many of the breaches he expected to hear about in the next 18 months had already happened but declined to give examples.

Nonetheless, his concerns about the drives -- which can be as small as a pen cap and store gigabytes of data -- are shared by many inside the government.

"They (the devices) are all over the place," said C.J. Wallington, director of advanced technologies for the U.S. Army.

Wallington said the devices were a double-edged sword. They could be an important vector for an insider threat, because "short of patting everyone down, there is really no way to stop one getting inside."

But they could also enhance security. The newest Army laptops, he said, had a security feature that meant that the drive could not be read without a key embedded on a special chip in the motherboard.

For older laptops, the Army is developing a way of putting the key on a USB drive, Wallington said. "If I lose my laptop, there is no way to even boot the drive without the key," he said.

--

Shaun Waterman, UPI Homeland and National Security Editor