The Ministry of Defence is investigating the reported loss of 69 laptops and seven personal computers over the past year, officials revealed yesterday, as Whitehall staff were banned from removing laptops containing sensitive data from their offices.
The extent of the lack of security surrounding MoD computers containing un-encrypted information emerged as Des Browne, the defence secretary, announced an inquiry into the latest theft: a laptop containing information on 600,000 people - recruits and those who had expressed an interest in joining the armed forces - which was stolen from a naval officer's car earlier this month.
Browne told MPs there was no reason to believe the laptop had been targeted for the data it held, though he said the MoD "cannot wholly discount this". He said the data included passport, National Insurance and driver's licence numbers, family details, and NHS numbers for about 153,000 people who applied to join the armed forces and banking details of around 3,700.
He revealed that two further laptops containing unencrypted information on at least 500 people had been stolen since 2005. A Royal Navy laptop was stolen from a car in Manchester in October 2006 and an army laptop was stolen from a careers office in Edinburgh in December 2005.
These losses were on top of the 69 laptops and seven PCs reported stolen from the ministry. It was not known whether the information on them was encrypted. The MoD has not got the technology to encrypt such information, a defence official told the Guardian yesterday.
Announcing an inquiry by Sir Edmund Burton, chairman of the Information Assurance Advisory Council, into weaknesses in the MoD's information security procedures, Browne told the Commons: "It is not clear to me why recruiting officers routinely carry with them information on such a large number of people or, indeed, why the database retains this information at all."
He said there was no indication the unencrypted files had fallen into the hands of extremists. A Royal Navy internal investigation had been completed, all similar laptops recalled and "appropriate action" was being considered against the officer responsible, he added.
Last night, the Cabinet secretary, Sir Gus O'Donnell, laid down the new rule for Whitehall staff in an email to permanent secretaries at all government departments. It said: "From now on, no unencrypted laptops or drives containing personal data should be taken outside secured office premises."
Browne told the Commons that though the laptop stolen in Birmingham - containing the names of recruits and those expressing interest in the navy, marines, and RAF - had been stolen during the night of January 9, ministers were only told the data was not encrypted on January 14. Richard Thomas, the information commissioner, was kept informed and the Association for Payment Clearing Services was alerted so that the banks could monitor the accounts listed.
Liam Fox, shadow defence secretary, said the Birmingham theft was potentially more damaging than HM Revenue and Customs' recent loss of 25 million people's child benefit details.