Government accidentally leaks counter-terrorism tools via Trello | IT PRO
Government accidentally leaks counter-terrorism tools via Trello
Hundreds of sensitive documents also revealed thanks to poor security settings - report
by: Adam Shepherd
23 Jul 2018
Government
Details about the inner workings of the UK government have been accidentally leaked online, thanks to unsecure use of a web-based project management tool, it is claimed.
Hundreds of confidential documents from the Cabinet Office and Home Office were reportedly available via a Google search, including details of government anti-terrorism tools and instructions for how to go about obtaining entry passes for government buildings.
Project management: everything you need to know
DCMS gets new boss amid Brexit reshuffle
Child sexual abuse inquiry fined £200,000 for exposing victims
Best free project management tools
The calendar appointments of civil servants were also allegedly accessible, allowing hackers to potentially trace who government figures are meeting and what they are meeting about.
The trove even included names, phone numbers and personal email addresses for top civil servants like the prime minister's head of cross-government business engagement, potentially leaving senior government figures open to phishing attacks like the one that allegedly allowed Russian hackers to sway the US elections.
The alarming news was revealed by a Sunday Telegraph investigation, which found that the information - which may have been available for up to four years - was leaked via poor configuration and use of Trello, a cloud-based project management tool.
Get the IT Pro newsletter
Get the free daily newsletter from IT Pro, delivering the latest news, reviews, insights and case studies
Your email address
SIGN UP
Trello is commonly used to manage the workflows of individual teams within an organisation, using a system of kanban-style 'boards'. By default, these boards are set to 'private', so that only members of the relevant team can access them. They can, however, be set to 'public', which allows anyone with the correct link to access them.
Advertisement
Advertisement - Article continues below
Crucially, it also allows those boards to be indexed by search engines like Google, which means that searching for certain keywords found within the boards - such as government departments, topic areas or civil servants - would result in the boards themselves (as well as specific files and task cards within them) showing up on a Google search.
The Sunday Telegraph's investigation found that at least ten government Trello boards were set as publicly accessible. These boards have now been switched to private, but certain parts of their contents remain accessible via Google searches.
Related Videos
video playingWeb users mock UK counter-terrorism plan
Egypt: state security documents leaked online
09/03/11Egypt: state security documents leaked online
Hundreds flout Greek lockdown to celebrate...
25/03/21Hundreds flout Greek lockdown to celebrate revolution bicentennial
AirPods Pro 2 To Launch In April
11/01/21AirPods Pro 2 To Launch In April
New 12.9-Inch iPad Pro Rumored To Launch 2021
28/12/20New 12.9-Inch iPad Pro Rumored To Launch 2021
Samsung Galaxy Buds Pro To Cost $199
24/12/20Samsung Galaxy Buds Pro To Cost $199
The use of Trello within government is part of a wider digital transformation drive, encouraging civil servants to use mobile, cloud-based collaboration and productivity tools, rather than relying on older, less agile methods like email. The drive was initially started in 2013 by the Government Digital Service, and included tools like Skype and Twitter in addition to Trello.
"We take data protection very seriously, and impress upon all government departments to exercise best practice and implement suitable measures to ensure data is secure when using platforms such as Trello boards," a government spokesperson told IT Pro.
"The Government Digital Service and Trello are working with government departments to ensure any data breached is made secure. Trello has offered to make all government accounts private, to ensure data is better protected in the future."
Hundreds of sensitive documents also revealed thanks to poor security settings - report
by: Adam Shepherd
23 Jul 2018
Government
Details about the inner workings of the UK government have been accidentally leaked online, thanks to unsecure use of a web-based project management tool, it is claimed.
Hundreds of confidential documents from the Cabinet Office and Home Office were reportedly available via a Google search, including details of government anti-terrorism tools and instructions for how to go about obtaining entry passes for government buildings.
Project management: everything you need to know
DCMS gets new boss amid Brexit reshuffle
Child sexual abuse inquiry fined £200,000 for exposing victims
Best free project management tools
The calendar appointments of civil servants were also allegedly accessible, allowing hackers to potentially trace who government figures are meeting and what they are meeting about.
The trove even included names, phone numbers and personal email addresses for top civil servants like the prime minister's head of cross-government business engagement, potentially leaving senior government figures open to phishing attacks like the one that allegedly allowed Russian hackers to sway the US elections.
The alarming news was revealed by a Sunday Telegraph investigation, which found that the information - which may have been available for up to four years - was leaked via poor configuration and use of Trello, a cloud-based project management tool.
Get the IT Pro newsletter
Get the free daily newsletter from IT Pro, delivering the latest news, reviews, insights and case studies
Your email address
SIGN UP
Trello is commonly used to manage the workflows of individual teams within an organisation, using a system of kanban-style 'boards'. By default, these boards are set to 'private', so that only members of the relevant team can access them. They can, however, be set to 'public', which allows anyone with the correct link to access them.
Advertisement
Advertisement - Article continues below
Crucially, it also allows those boards to be indexed by search engines like Google, which means that searching for certain keywords found within the boards - such as government departments, topic areas or civil servants - would result in the boards themselves (as well as specific files and task cards within them) showing up on a Google search.
The Sunday Telegraph's investigation found that at least ten government Trello boards were set as publicly accessible. These boards have now been switched to private, but certain parts of their contents remain accessible via Google searches.
Related Videos
video playingWeb users mock UK counter-terrorism plan
Egypt: state security documents leaked online
09/03/11Egypt: state security documents leaked online
Hundreds flout Greek lockdown to celebrate...
25/03/21Hundreds flout Greek lockdown to celebrate revolution bicentennial
AirPods Pro 2 To Launch In April
11/01/21AirPods Pro 2 To Launch In April
New 12.9-Inch iPad Pro Rumored To Launch 2021
28/12/20New 12.9-Inch iPad Pro Rumored To Launch 2021
Samsung Galaxy Buds Pro To Cost $199
24/12/20Samsung Galaxy Buds Pro To Cost $199
The use of Trello within government is part of a wider digital transformation drive, encouraging civil servants to use mobile, cloud-based collaboration and productivity tools, rather than relying on older, less agile methods like email. The drive was initially started in 2013 by the Government Digital Service, and included tools like Skype and Twitter in addition to Trello.
"We take data protection very seriously, and impress upon all government departments to exercise best practice and implement suitable measures to ensure data is secure when using platforms such as Trello boards," a government spokesperson told IT Pro.
"The Government Digital Service and Trello are working with government departments to ensure any data breached is made secure. Trello has offered to make all government accounts private, to ensure data is better protected in the future."
