FBI spills sensitive data due to mishandling storage devices in audit

TLDR:

• The FBI failed to properly secure decommissioned electronic storage media containing sensitive information, as revealed by an audit report from the Department of Justice’s Office of the Inspector General.
• Weaknesses were found in the physical security of the media at an FBI-controlled facility, where devices containing sensitive but unclassified law enforcement information and classified national security information were stored.

Summary:

The Federal Bureau of Investigation has been found to have shortcomings in properly labeling, storing, and securing decommissioned electronic storage media containing sensitive information, as highlighted in a report by the Department of Justice’s Office of the Inspector General. The audit revealed weaknesses in the physical security of these items at an FBI-controlled facility where the media was being destroyed. Devices like internal hard drives and thumb drives, which contained sensitive but unclassified law enforcement information and classified national security information, were not properly accounted for. The lack of proper labeling on internal electronic storage media extracted from computers and servers posed a risk as their classification could not be identified.

The audit also found that extracted internal hard drives marked non-accountable were stored for a significant period on a pallet with torn wrapping at the destruction facility, exposing them to unauthorized personnel. The OIG made recommendations for the FBI to revise procedures to ensure proper accountability, tracking, and destruction of storage media, implement classification labeling, and enhance physical security at the destruction facility to prevent loss or theft. These measures aim to mitigate the risk of sensitive information falling into the wrong hands due to inadequate inventory controls by the FBI.