DND to buy colour-coded, serial-numbered USB drives as feds bolster security guidelines

National Defence hopes to prevent data breaches by buying up to 47,000 colour-coded, serial-numbered USB drives.

The new features are expected to help track the devices. The department’s move comes in anticipation of forthcoming federal standards intended to help identify and control portable media devices, following a year peppered with prominent data breaches.

Early last year, Employment and Social Development (called Human Resources and Skills Development Canada at the time) publicly revealed the office had lost an external hard drive containing the names, birthdays, social insurance numbers, addresses and student loan balances of nearly 60,000 Canadians.

Weeks earlier, the same department told the federal privacy commissioner’s office of the loss of a USB key holding, among other bits of sensitive personal information, social insurances numbers, birth dates, medical conditions, education levels and occupations of more than 5,000 people who had appealed disability rulings under the Canadian Pension Plan.

The investigation into that breach later spread to Justice Canada when it was revealed one of their lawyers working at HRSDC was involved.

Yet another USB key, this one intended to stay in the hands of a security intelligence officer working in British Columbia, was found in a schoolyard after the man dropped his child off. The key was marked as belonging to Correctional Service of Canada and returned, apparently without any unauthorised people looking at the personal information of more than 150 offenders contained within.

Employment and Social Development has since implemented new, stricter rules regarding portable data devices, even though the Treasury Board’s new policy isn’t yet finalized, a spokeswoman for the minister’s office said.

The new federal policy is expected to lay out exactly how departments should store, transport, wipe and dispose of information on portable devices.

“Treasury Board is finalizing a policy document for the secure use of portable storage devices, including USBs,” a spokeswoman for Treasury Board President Tony Clement’s office wrote in an email.

A draft version of the policy was shared with departments, including National Defence, for input, the spokeswoman wrote.

In response, National Defence is looking for an outside supplier to fill an initial order of 23,512 credit card-style USB flash drives with capacities of 4 GB, 16 GB or 32 GB. The department said it may make the same order twice, bringing the total order close to 50,000 units.

The new keys will be “branded with a colour security caveat and serial number to improve tracking,” said Maj. James Simiana, a spokesman with the Royal Canadian Air Force.

There is no dollar amount yet attached to the purchase, but the department says it will likely award the contract to the company offering the lowest price estimate.

Once the drives are delivered later this winter, they will be distributed across the department to members of the army, navy and air force.