Sending data securely: USB sticks, email and PGP

Originally published in GP magazine .

Written for GP magazine around 2008. This is the version I submitted - the published article may have been edited.

In my last article I talked about basic security measures, including using strong passwords that aren’t easily guessable or breakable and enforcing a security policy where you have to log on to your computer and it auto-locks itself if you shut the lid or walk away from it. You should also turn on security features like hard disk encryption and secure memory, particularly on mobile devices, and there are extreme forms of security that need both a hardware key and password to work. This is all very important in a climate of public outrage at security breaches. A news article in November in GP stated that there had been 135 data losses in the NHS in the last year, which included the theft of an entire computer system, a lost backup tape and records being delivered to the wrong address.

In this article I want to discuss various ways of sending data to someone else securely. While much of the data in the NHS is in theory in the public domain, some is commercially sensitive and some includes data on or about patients, and it seems sensible to have as a default the policy to send information securely, thereby reducing the risk of inadvertent breaches.

In addition to the above, there is a nice feature for some mobile devices called Remote Wipe that should be implemented where possible. This allows a signal from base to wipe clean the entire device once it is reported lost or stolen.

Perhaps the most common security risk is the USB memory device, which is everywhere, particularly as the drug companies have been giving them out. They are in standard form very unsecure, as they will work in any computer. However, you can now get ones that have built-in encryption and when inserted run a special program that makes you type in a password to unlock them. I have also come across a system where a password has to be typed in every so often at regular intervals, and if not done the memory is wiped. USB sticks are great for storing your own information and can even be sent to others as long as the password is sent securely, though the future is probably secure cloud (internet) based storage accessible from anywhere.

At the moment most people use email to send information. Email is inherently insecure. A simple analogy is semaphore towers, where anyone can see the message being sent unless it is encrypted. Even worse, email can easily be tampered with. I currently get a lot of spam that seems to come from me but obviously doesn’t, so another need is digital signatures that prove you are who you say you are.

The easiest solution for many is to send information as an attachment having zipped it with a password. There are free programs like 7-Zip that offer good encryption but rely on you sending the password and the recipient being able to unzip it.

NHSmail offers a secure email service when both sender and recipient are on its system, as links to and from it are encrypted. However, one of my local IT gurus worries it isn’t that secure, as it allows offline browsing where information can be stored on a home PC and there is no way of enforcing a security policy on an end user.

Also, it is wrong to assume that all communications are only going to be with other users of NHSmail. I often email patients, and I might like to discuss patients with other bodies like social services, DVLA, community pharmacies and insurance companies.

I also worry slightly that people will think that because one end of the chain uses NHSmail the message is secure, which it clearly isn’t. To be fair, in their security policies they clearly state that they are only responsible for the messaging between two NHSmail accounts and you as the user are responsible for keeping your PC secure and what you do with the information and whom you send it to.

I think there is an alternative or perhaps complementary solution called PGP (Pretty Good Privacy) that uses public key cryptosystems to encrypt data to and from anyone, and that should be considered more widely. It can be added to your existing email client, and when you select the recipient as usual the computer looks up their public key on a trusted database, encrypts the message before it has left your computer and sends it. Only the recipient can decrypt the message using their private key, which only they know. There are two advantages - anyone can install this system for free, so it isn’t limited to those inside the NHS, and you can also use it to digitally sign an email to prove it is from you. The major disadvantage is it needs pre-installing, and you need to set up your keys and register them with a trusted body. However, I could see it being integrated with NHSmail, and they could be such a body.

In summary, you need to think clearly about your security policy in practice and ask for help if needed, as you don’t want to be on the front page of the Daily Mail for a security breach.