Travel Reference
In-Depth Information
the calls could have originated from his home office. He even agreed to
provide access to the office to show that he had nothing to hide. He had
forgotten that he had left a computer printout of the informant's criminal
history and motor vehicle information in plain view on his desk. His fail-
ure to adhere to a home “clean desk policy” tripped him up. The follow-
ing sections lay out the specifics of an office policy.
CLEAN DESK POLICY
Sensitive documents must not be left out on a desk that is open to plain
view. Whenever the employee leaves his or her workstation, the desk must
be clean of any sensitive materials. Generally, employees can simply lock
sensitive work product in their desk. If they are working with extremely
sensitive documents that they had to sign out for, then they must return
the documents to the proper storage area and remove them later. The
same is true for computer screens. Screens need to be turned off and
everything password protected. If you have someone handling documents
of the highest level of security, you should be cognizant that even reading
such material near a window may compromise the data. It is not a diffi-
cult task to use telescopic equipment to look into an office. It is just as
simple to take photographs of material in the office and have the pictures
enhanced to retrieve useful data. It is done every day by intelligence agen-
cies worldwide. Cleaning crews should be allowed to work only after sen-
sitive or proprietary information has been secured.
These policies need to be enforced if you are serious about informa-
tion security. Even during an evacuation, real or drill, there must be a min-
imum level of response calling for the securing of vital documents. It only
takes a couple of seconds to throw everything into a desk drawer and lock
it. Then you shut off the computer and out you go. Total time elapsed is
less than 10 seconds. In the past, spies have activated fire alarms and even
set fires to cause an evacuation and gain access to competitive informa-
tion. Security is part of the drill. If, of course, the emergency is so severe —
say an earthquake or bomb attack — that these seconds may make the
difference between life and death, then the security protocol is abandoned
in favor of saving lives. If time is not that critical, then the informational
security protocols should be followed. Even during an ordinary workday,
attention must be paid to securing your computer workstation and keep-
ing classified documents out of the reach of unauthorized individuals.
