Third of UK directors steal company secrets

Internal data theft is widespread, claims survey.

One in three UK directors has admitted to taking confidential corporate information when they left the company, according to a new study.

A Hummingbird/YouGov survey of 1,385 UK executives found that 29 percent of directors, and 17 percent of middle managers, admitted to taking confidential data.
The 2006 Hummingbird Information Management Survey also revealed that women decision-makers are more honest than men.

Some 37 percent of women claimed that they would never take unauthorised information from their employers, compared with 25 percent of men.

The survey suggested that UK businesses are fighting a losing battle against data theft. Around 67 per cent of respondents believe that the ease of purloining corporate data made it impractical for employers to prevent theft.

"While the majority of employment contracts have a clause forbidding the unauthorised removal of information, it is incredibly difficult to track and monitor the explosion in the volume of information dealt with on a daily basis," said Tony Heywood, European senior vice president at Hummingbird.

"While our survey shows that employees are more likely to steal company training documentation [51 percent] and procedure manuals [48 percent] than financial information [18 percent] and client reports [14 percent], organisations have to be aware of their growing vulnerability to corporate espionage."

Donal Casey, a security consultant at Morse, told vnunet.com: "This is not that surprising. It is very common for people to copy useful information when leaving a company.

"Businesses need to be aware of, and protect themselves from, the threat from within, and must put electronic and physical data security measures in place.

"They should ensure that only those who need to access confidential data are able to do so, and they should put audit trails in place so that if their data is stolen or leaked they can trace back to the source of the leak."

Casey added that these protections should not just apply to live data. "These measures should also take into account electronic and physical access to data," he said.

"For example, companies should ensure that access to physical back-up media is controlled and that the backed-up data is encrypted."