Investigation Underway at Heathrow Airport After USB Drive Containing Sensitive Security Documents Found on Sidewalk

CERT-LatestNews ThreatsStrategic

Security personnel at Heathrow Airport have an exciting investigation underway after confidential security documentation was found on a sidewalk in West London.

An unnamed man, on his way to the library, spotted a thumb drive on the sidewalk in Queen’s Park, West London. He pocketed the USB drive and continued on his way. He remembered the USB drive a few days later and returned to the library to view its contents. Recognizing the sensitive nature of the information, he then turned the USB drive over to The Sunday Mirror tabloid.

In their article on October 28th, the Mirror confirmed that the thumb drive contained at least 174 documents. These documents describe various security controls and protocols in place at Heathrow including:
  • timetables of roving security patrols
  • locations of CCTV cameras
  • types of security badges required to access restricted areas
  • maps of tunnels, access points and restricted areas
  • routes taken by the Queen and other VIPs to the Royal Suite private area at Heathrow, and
  • security protocols for VIPs travelling through the airport

Heathrow Airport

It is obvious how this information would benefit someone intent on disrupting the airport or causing harm to dignitaries or VIPs. Many documents were labeled as “confidential” or “restricted” highlighting their sensitive nature. In an interesting twist, these labels follow an older labeling scheme so there is a question of how up-to-date this information isEven if the information is outdated, knowing former protocols and designs help a bad actor to anticipate the current solutions.

According to a Heathrow Airport spokesperson’s comment to CNN, “Heathrow’s top priority is the safety and security of our passengers and colleaguesThe UK and Heathrow have some of the most robust aviation ­security measures in the world and we remain vigilant to evolving threats by updating our procedures on a daily basisWe have reviewed all of our security plans and are confident that Heathrow remains secureWe have also launched an internal investigation to understand how this happened and are taking steps to prevent a similar occurrence in future.”

The first step in any such investigation is to understand what the immediate risk is. If exposing this information increased the risk, new risk mitigations may be requiredThe next step is to understand how the information found its way onto an unsecured USB drive on a public street in London. The security team then needs to come up with solutions to prevent it from happening again. At a minimum, the Heathrow security team have a few busy days of investigation ahead. More likely there are changes to security protocols and procedures coming in response to sensitive information being exposedEven if it was only exposed to one individual and one English tabloid, will Heathrow authorities be able to identify who originally dropped the thumb drive and how can they be sure it wasn’t copied?

About the author:  Steve Biswanger has over 20 years experience in Information Security consulting, and is a frequent speaker on risk, ICS and IoT topics. He is currently Director of Information Security for Encana, a North American oil & gas company and sits on the Board of Directors for the (ISC)2 Alberta Chapter.