Whoops! School lost unencrypted USB!

[hardtailstar]

Be interesting to see if they get fined!

 

https://www.bbc.co.uk/news/uk-england-kent-44371759

Edited June 6, 2018 by hardtailstar

[synaesthesia]

They damn well should be. All pupil info on a USB stick? Ridiculous. Someone should and no doubt will be sacked.

[Dos_Box]

A spokesperson for the Thinking Schools Academy Trust, which runs the school, said it places "the highest premium possible on data security" and it is "exceptionally disappointing" that strict policies and procedures were not followed.

 

Sounds like a case of 'These rules don't apply to me because I'm an important person in a hurry'.

[mjk]

A spokesperson for the Trust said: “We place the highest premium possible on data security and have always been clear to all staff that we consider it to be of the utmost importance.

“It is therefore exceptionally disappointing that on this occasion our strict policies and procedures, which all members of staff have been made aware of and have received training on, were not followed.

 

Rochester Grammar School lose information on 1,000 pupils

 

 

Probably will be a telling off for somebody !

[sippo]

Be interesting to see what happens. This will decide if we disable USB devices completely...

[sippo]

They damn well should be. All pupil info on a USB stick? Ridiculous. Someone should and no doubt will be sacked.

 

It'll be a disciplinary depending on their procedures. If there are no procedures in place, then there is no comeback.

[Fazza]

They damn well should be. All pupil info on a USB stick? Ridiculous. Someone should and no doubt will be sacked.

 

If it's a Teacher then unlikely as they can do what they like and if anyone says otherwise they just accuse you of affecting the "teaching and learning" and that's that!

[hardtailstar]

If it's a Teacher then unlikely as they can do what they like and if anyone says otherwise they just accuse you of affecting the "teaching and learning" and that's that!

 

happened on too many occasions.

[pete]

If it's a Teacher then unlikely as they can do what they like and if anyone says otherwise they just accuse you of affecting the "teaching and learning" and that's that!

 

Well, you'd agree. You are affecting it, just in a positive way by firing feckless individuals with no grasp of their safeguarding responsibilities.

[strawberry]

utmost importance = NM tries to enforce bitlocker, disable usbs or provide other mechanism's and gets shot down because the teachers are inconvenienced.

[synaesthesia]

"Here is the safer/more secure way of doing the same thing, it's not as convenient but it'll save your job and more importantly the personal data of our stakeholders".

[MartinT]

Ouch! I've forwarded the news item to all staff - it's a good GDPR training refresher moment...

[mjk]

utmost importance = NM tries to enforce bitlocker, disable usbs or provide other mechanism's and gets shot down because the teachers are inconvenienced.

It's an uphill struggle trying to take things away, but If you give them something *better* they won't be inconvenienced.

Our teachers don't want to use USB sticks because Google drive is a better solution for everyone.

[LeMarchand]

It's an uphill struggle trying to take things away, but If you give them something *better* they won't be inconvenienced.

Our teachers don't want to use USB sticks because Google drive is a better solution for everyone.

 

If only that were true for all teachers. We have very little take up of Google Drive/Office 365 . Of course, SMT are hardly pushing it. Maybe this headline will change things.

[difinity]

They damn well should be. All pupil info on a USB stick? Ridiculous. Someone should and no doubt will be sacked.

 

I agree totally ridiculous an inexcusable with the technology that's available, but who do you suggest ? Ultimately the responsibility lies with management, their DPO and the policies they have/should have in place. IT should have representation in management, then there are those that implement the policy and lastly the person that lost the stick.

 

It's numerous failings that result in an unencrypted USB stick with student details being found, it's not solely down to the person that lost the stick and in my experience management tend to push under buses rather than accept responsibility.

[synaesthesia]

Absolutely there are multiple failings, leaders are responsible yet the individual(s) involved have displayed a very clear lack of understanding or common sense with regards to the most basic data protection. After all, it's not just the burglar's fault if they steal a £2000 laptop that you've left in plain view on your car's passenger seat; yet people still do it, because their either naive, don't understand or let's face facts are just completely stupid.

[Andycat]

This could happen to any of us. USB drive could be a year old. There's no mending the past. We might all be trying to stop this now, but there's a lot of history out there still!!

[hardtailstar]

Ouch! I've forwarded the news item to all staff - it's a good GDPR training refresher moment...

 

@MartinT it came from our Business manager basically saying "dont let this happen to us"

[fiza]

At the bottom of that article is a link to another concerning a Hastings Borough Council Data Breach. It seems to suggest Hastings got away with it because it happened on the eve of GDPR.

 

https://www.bbc.co.uk/news/uk-england-sussex-44241494

[elsiegee40]

Nice of someone to test the water with GDPR for education so early [emoji849] Edited June 6, 2018 by elsiegee40

[mthomas08]

Our data protection officer sent this to all staff first thing this morning. Great example and let's face it.. there will be more.

 

This is a fantastic (sorry I hate to use the word) example on why being relaxed on GDPR is WRONG.

 

"We take data protection serious" then please explain why this USB was not encrypted? please explain why this USB contained all that sensitive data? please explain why this staff member had and lost it? did they have a data mapping setup? do all staff know about GDPR?

 

We all know school politics and I see failings/ignorance of data protection because it won't happen to us. I wonder if they have a trail to prove they are 'serious'..

 

I hate to say this but I hope they get a fine to be made as an example. Still "no reason to believe the information has been shared"......maybe they have that Mission Impossible software that tells the user "data copied"... because we've all got that..

[djrscally]

Is it in poor taste if we run a sweepstake on the fine amount?

[PotNoodleTech]

How many of you guys and gals have actually banned USB sticks Physically (either within Windows / Group policy, or Impero or the like).

 

Or have you just advised staff not to use them?

 

I mean, if you have not physically stopped them from working on your PCs, then this kind of breech could still happen to you no matter how tight your training/policies are? All it takes is one person's mistake.

[DrCheese]

Blocked them here full stop in 2006 using Sophos - We get a few grumbles from new staff but they learn to deal with it quickly. We enable read only access for visitors when they need it.

 

You have to enforce these things, as no matter what the policy says, you'll always get some fool do it and lose it!

[jonathan.lees]

blocked them this year for staff using Windows and we're just using OneDrive instead. No grumbles and teachers just get on with it but a bit of a pain for us for teacher interviews and visitors as we have to copy whats on their USBs to the network should not email it in advance. From September we're banning them for students too, that might be a bit bothersome.