What should I do when classified information stayed on a unauthorized laptop?

Question

Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it?

How did you quarantine the system. Were you required to turn in the entire laptop or were you able to destroy/format the HDD?

NISPOM says that incineration or physical destruction of the HDD is required, but I just wanted to get peoples experiences with this type of situation.

Clarification: the data was released to us as unclass (marked as such) and then was later found to have the class data on it. at which point they called us to lock everything down.

Conclusion:

laptops seized and we are told that the free space will be wiped after a forensic expert takes a look at it. if everything works out we should have our laptops and data back in a few days.

Answer 1

I used to work IT at an Airforce Base for a while and we actually had a couple of incidents like this happen.

First and foremost, make sure you notify the appropriate authorities of the incident. They will be able to instruct you further based on their current security policies.

1. You need to isolate access to the laptop. Shut it down completely, boot into the bios and disable the network devices. If there are any wireless switches, make sure those are set to off.

2. Make sure you property identify the classified material and the scope of where it might reside on your system. And take the proper steps to remove it.

3. Then defragment the hard drive and find a utility to push all of the existing files on the hard drive to the front of the drive. Then you can safely run a utility to securely wipe the remaining disk space.

That is a common technique used to cleanse a system, but don't attempt this without first reporting the incident and verifying that you have permission to perform these actions. Different types of incidents call for different responses and it's imperative to identify issue correctly so that the correct actions can be taken. The steps above are not a solution for every incident. They're just a good generic starting point.

Answer 2

This an incident you need to handle and I am guessing that a standard response has not been detailed in your documentation.

Realize that your system is malfunctioning. It is not operating the the way it was intended to.

1. Isolate your system [meaning your network(s) and physical facility if possible] to prevent the data from leaving your system. Take care to cause as little change to individual assets as possible. You want the state of the assets to stay constant until you can assess them.
2. Identify the source or sources of the data leak.
3. Isolate the leak source or sources to prevent further contamination in your system. Again, try to preserve there current state as much as possible. This will help you identify assets contaminated by the source.
4. Identify all assets that may have been contaminated by the source or sources.
5. Isolate the potentially contaminated assets. I know it is getting repetitive, but preserve the state of each asset as much as possible. These assets will help you assess the extent of the contamination.
6. Treat all potentially contaminated assets at the level of the contamination. In this case TS.
7. Verify that the remaining assets are not contaminated.
8. Breathe, have something to eat or drink, take a short break, because the rest of your day/week/month is going to be painful.
9. Discuss and plan remediation of contaminated assets. Planning well here will allow you to understand the scope of the problem, who is impacted, and how long you expect it to take.
10. Execute the remediation plan and periodically report on progress.
11. Pain
12. Vacation

Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it?

I have not. I have been involved in containment and remediation of sensitive data.

How did you quarantine the system?

I have not been involved with the primary contaminated system, only secondary systems.

For systems suspected of contamination:

• Posted restricted area notice sign on the door.
• Locked the door.
• Removed network communications.
• Shutdown the system to preserve as much of the current state as possible.
• Analyzed the system to check for presence of data in question.
• If detected, moved the system to a secure area for sanitization.

Were you required to turn in the entire laptop or were you able to destroy/format the HDD?

The agency involved will determine the action to be taken, and the policies and practices may vary from agency to agency.

I do not have personal experience, but given that TS is described as 'Such material would cause "exceptionally grave damage" to national security if made publicly available.' I would expect that every physical component of the item formerly known as a laptop will be crushed, smashed, melted, dissolved, extruded, shredded, and used as target in a artillery range.

The consequence of the release of the information compared to the value of the laptop, the other software and data on the laptop, and any other adjacent items of value, makes it clear that preventing the release of the data is worth the cost of total destruction of the laptop.

Answer 3

If the information is of that high level, after the isolation and forensics parts are done it never ever leaves the organisation functional and in one piece. You could securely wipe and reuse it for the purpose of usage under the same high classification if needed, but again - it stays within the organisation. When the laptop is ready for retirement it gets securely wiped and physically destroyed.

And if your organisation is really dealing with Top Secret information, then information is what is valued the most and it is of top priority. In that case, the cost of a laptop is not traded for the cost of information.

Answer 4

The two core issues in any jurisdiction should be:

• notify the relevant body
• protect the asset (in this case it is the data - not the laptop)

The notified body will tell you exactly what to do with the device so you shouldn't need to work out what you need to do from that point onwards, but depending on your environment you will need to decide on a course of action prior to receiving guidance.

If you are an organisation which generally handles TS information you should have a procedures document - follow it!

Answer 5

I had a similar issue when I was consulting for the NSA. They had some classified data that needed to be analyzed on our specialized hardware. They insisted on physical destruction of the hard drive and RAM.

I'm still kind of baffled why the RAM had to be physically destroyed. They said the rule was anything that can store data. But the CPU can store data -- it has caches and registers that store data too. And the RAM is as volatile as the CPU.

But that was the rule, so that's what we did.

Answer 6

Realize that the relevant question is not "how do we sanitize the data" (a quick boot to DBAN would do that) but "how do we remediate this failure in a way that restores trust to the system". That's why the procedures appear so damn stupid sometimes: especially depending on the data involved, trust in the system may be more valuable than the data itself.

Notify your security officer and isolate the system. Do not attempt remediation yourself. Let them wipe the drive, but more importantly, let them wave their magic wand over the system and return everything to status quo. Most likely, the ceremony is even more important than the data.