The BBC has confirmed that more than 170 of its employees’ mobile devices have either been lost or stolen in the past two years.

The figure, revealed after think tank Parliament Street submitted a Freedom of Information request to the national broadcaster, underlines the difficulty of managing a large mobile workforce.

The BBC disclosed that 91 devices, including laptops, mobile phones and tablets, were stolen over the past two financial years while 81 were lost.

82 laptops, including MacBooks and high-end HP EliteBooks, were either lost or stolen, along with 80 mobile phones, eight iPads and two desktop computers.

Regrettably inevitable

BBC employees have commonly lost devices at Westminster, on trains, in taxis, buses, hospitals and hotels. The devices cost an estimated total of at least £109,000.

A BBC statement read: “The BBC employs about 20,000 people and the number of items lost or stolen is relatively small, however, it is regrettably inevitable some items will occasionally go missing.

“The BBC takes incidents of crime seriously and we are constantly implementing and reviewing measures to reduce crime and recover lost and stolen items.”

With GDPR now in effect, encryption is particularly important, according to Bernard Parsons, CEO of cyber security firm Becrypt.

He told Infosecurity magazine: “Encryption is one of the few technical controls explicitly called out by GDPR, as its proper use means that device loss is purely the loss of a physical asset, as opposed to the more serious loss of information, which leads to reporting requirements and potential fines.

“Choosing an encryption solution for laptops that has some form of third-party validation, such as National Cyber Security Centre (NCSC) assurance, allows an organisation to confidently address both risks and liabilities. But equally important is that technology does not inhibit user experience. Poorly implemented security leads to user bypass, such as passwords on stick-it notes, that can actually increase an organisation’s risk. NCSC have some great guidance on appropriate password policies that balance security with user needs.”

Andrew Brown, executive director of Enterprise Research at Strategy Analytics, warned that “cost savings from BYOD are not comparable to the financial damage and reputational risk that can be incurred as a result of lost or stolen data and the security implications that a data breach entails.”

Parson urged organisations to adopt mobile device management platforms to enforce mobile policies such as remote wipe and screen-lock in the event of loss or theft.

He added: “Organisations that are higher-threat targets need also to be aware that lost devices can be used to carry out subsequent attacks on the company’s networks, particularly as many organisations host MDM servers outside of their more secure networks.”