"Viral status" on stolen laptop

[Vega1447]

http://www.ireland.com/newspaper/irelan ... 98341.html

"The personal details of donors and patients on the laptop included their names, addresses, gender, dates of birth and contact phone numbers. The IBTS said details of people's viral status was also included but was coded."

Rather makes the sending of the data to the US (without permission from those whose details were included) more serious?

[HanleyS]

Yep, gf works for the HSE mentioned this as a possibility last night. Terrible implications for those people.

[michael1965]

I see the Irish Times is also taking at face value, the assurance that the data was never decrypted. What would be the point of the employee having the data on his laptop, if he couldn't use it? There are two possibilities here:

1) The data was encrypted only for the purpose of sending it through the post, in which case, it almost certainly was decrypted on the laptop. Otherwise, it would be completely useless.

2) The software being developed uses the encrypted files directly, but even in this case, the software has to decrypt the data to be able to use it. So the keys have to be on the laptop to be able to use the data. They could be stored on a smartcard possibly, and/or they could be protected by passwords, but the media reports aren't clear about this at all.

Even in case 2) it strikes me, that it wouldn't be unusual for the software developer to have the decrypted data available as well, as a way of verifying the work he was doing.

Of course, since this was more than likely an opportunistic theft, the data will probably not be accessed, but it's a bit frustrating that the media aren't asking the right questions to the people in New York.