IT device losses at HMRC increased by nearly 50% in the space of a year, according to Freedom of Information Act (FOI) requests submitted in 2022.
Statistics released under the FOI act show that between September 2021 and 2022, HMRC declared 635 lost and stolen devices.
The total number of devices lost or stolen during this period included 387 mobile phones, 244 tablets, and four USB drives, the tax office revealed. The majority of devices were declared as lost. However, 25 mobile devices and 121 tablets/laptops were recorded as stolen.
Analysis of the figures by software firm Apricorn, which submitted the information requests last year, showed that this equates to a 45% increase in the volume of devices lost during the same period in 2020-2021. Similarly, this also amounts to a 40% increase compared to 2019-2020.
John Fielding, managing director for EMEA at Apricorn, said the figures highlight a concerning trend of government-related device losses over a period of several years.
“We have asked these same questions via FOI requests for the last three years, and whilst it’s not surprising to see devices unaccounted for, we would hope to see the numbers declining as cyber security becomes more established,” he said.
The sensitivity of data residing on public sector devices is fully known to the government and was one of the driving concerns in its landmark decision to ban the TikTok app from government devices this week.
Nearly 2,000 devices lost since 2017
The latest statistics mean that, since 2017, HMRC has declared around 2,000 devices as lost or stolen.
Data retrieved via FOI requests by the Parliament Street think tank in February last year found that HMRC recorded 1,491 electronic devices lost or stolen between April 2017 and December 2021.
The largest losses declared during a single period for the department came between April 2019 and March 2020, with 431 devices missing.
At the time, HMRC attributed a portion of the losses to the shift to remote working amidst the onset of the COVID-19 pandemic.
HMRC invested heavily in IT devices during the pandemic as staff shifted to remote and hybrid working practices.
Between October 2020 and 2021, the department invested in more than 37,000 laptops, tablets, and mobile phones to support staff.
Device protection protocols
Responding to Apricorn’s FOI request, HMRC told IT Pro that all standard-issue devices are "encrypted to HMG standards".
"We keep our practices under constant review and are fully committed to complying with all data protection laws, including UKGDPR," a spokesperson said. "As part of our compliance activity, we regularly engage with the Information Commissioners Office and with our Data Protection Officer to check that we are meeting requirements and put in place improvements, further protections and enhancements where needed."
Any devices reported as lost or stolen are deactivated remotely upon declaration to “reduce the risk of unauthorised access to any data held”, the department said.
"HMRC colleagues are required to report lost or stolen devices immediately and we have a strong culture of security incident reporting."
In addition, HMRC said that no losses were declared to the ICO due to encryption and deactivation protocols employed by the department.
