Victoria Police data management under fire after decade of device losses

Dozens of electronic devices used by Victoria Police, containing potentially sensitive data from investigations, have been reported lost or stolen, including USB drives, digital cameras and body-worn cameras.

Data obtained through freedom of information laws reveal that over the past decade, 40 devices have been lost by police or have been stolen, in 38 incidents classified as “data spills” which may have contained confidential information.

All Victoria Police data spills are referred to the privacy watchdog, the Office of the Victorian Information Commissioner.Credit: Paul Rovere

Despite the spills, police maintain that no investigations have been compromised, emphasising that the losses are minimal compared to the tens of thousands of devices in use across the force.

The spills are part of more than 1100 recorded incidents of lost or stolen digital assets used by Victoria Police officers, encompassing phones, laptops, tablets, police radios and external hard drives.

All data spills are referred to the privacy watchdog, the Office of the Victorian Information Commissioner.

The fresh revelations about data spills come as the information commissioner probes Victoria Police’s data-management policies, including an incident where 186 witnesses, victims and police officers’ personal information was given to an incarcerated murderer.

A police spokesman said the dynamic nature of police work meant there was always a risk electronic devices could be damaged, stolen or lost in the field. “This data shows theft and loss of electronic equipment is minimal compared with the tens of thousands of devices in use across the force,” he said.

The spokesman said all incidents were investigated in line with standard criminal processes, and that in the overwhelming majority of cases, the information was not categorised as protected or identifiable to any individual or organisation.

“Victoria Police’s digital devices are fitted with a range of security safeguards, including encryption to protect sensitive information, and can be remotely deactivated as soon as they’re reported missing,” he said.

“This data shows theft and loss of electronic equipment is minimal compared with the tens of thousands of devices in use across the force,” a police spokesman says.Credit: Paul Rovere

“Information on portable flash devices can only be stored temporarily, the devices must be encrypted and password protected and there are restrictions on what type of information can be stored in the first place.”

Of the 40 devices in the data spill, there were 20 USB drives, 12 cameras, three external hard drives, two SD cards, a body-worn camera, a phone and a digital voice recorder.

These 40 devices form part of the overall losses of devices over the past decade, including 80 mobile phones, 66 laptops, 27 cameras, more than 50 body-worn cameras, over 110 police radios, nine external hard drives, 20 iPads, more than 30 USBs and over 700 IRIS devices.

Officers and staff have also reported lost or stolen a breath-tester, six gate remotes, four SD cards (cards which record pictures in digital cameras), and a digital voice recorder with data on it.

The Office of the Victorian Information Commissioner is investigating whether Victoria Police complies with its obligations under privacy laws to protect personal information from being deliberately mishandled by its employees.

Privacy and Data Protection Deputy Commissioner Rachel Dixon said the information commissioner expected public sector organisations to understand and meet their information and data security obligations under privacy laws.

“The Office of the Victorian Information Commissioner conducts investigations to determine whether a regulated body has breached an information privacy principle, code of practice or information usage arrangement and, if so, whether the breach is serious or flagrant,” Dixon said.

Dixon declined to comment on whether this newly discovered breach was being probed.

Police accountability expert Jeremy King, from Robinson Gill lawyers, said he had observed Victoria Police data protection was often outdated and that police had remote access to databases from devices like iPads, which caused concern if they were lost.

The Independent Broad-based Anti-corruption Commission and integrity officers within Victoria Police have investigated and prosecuted officers for accessing internal police databases without authorisation.

John Silvester lifts the lid on Australia’s criminal underworld. Subscribers can sign up to receive his Naked City newsletter every Thursday.