The information was stored in the memory of a second-hand photo camera

Oct 1, 2008 12:03 GMT  ·  By

A deliveryman from Hertfordshire, UK, bought a camera for £17 (around $30) from eBay. After returning from a vacation in the US, the man tried to download his pictures only to discover  images of rocket launchers and photos of al-Qaeda terrorists along with their names and  fingerprints.

The records found by the 28-year-old man in the camera's memory were top secret documents belonging to the MI6, the British Secret Intelligence Service (SIS). He was planning a vacation in US with his ex, so he acquired the Nikon Coolpix from eBay particularly for this trip. Not little was his astonishment when he downloaded his holiday pictures on his computer and saw photos of missiles and people he hadn't taken.

Along with them, there was also a drawn diagram with names of terrorists linked to al-Queda, including one of its high ranking lieutenants, Abdul al-Hadi al-Iraqi. Captured by the CIA in 2007, he is presently held at the Guantanamo Bay prison.“He knew he hadn’t taken them so asked friends about it and they suggested going to the police,” commented for The Sun one of the deliveryman's friends.

When hearing the story, the policemen thought it was a joke, but the report alerted the Secret Service, as a few days later, intelligence officers showed up at his door steps. The officers were part of a special anti-terrorist team, called the Special Branch, and after interviewing him, the camera and his personal computer were seized. They spent around $1800 replacing the confiscated goods and explicitly asked the man and his family not to speak with the press about what they know.

Neil Doyle, terrorist books author, pointed out that "these are MI6 documents relating to an operation against al-Qaida insurgents in Iraq. It's jaw-dropping that they got into the public domain”. He also added that "not only do they divulge secrets about operations, operating systems and previously unheard-of MI6 departments, but they could put lives at risk".

This is just one of several recent cases that involve sensitive information being bought along with storage devices from eBay. Recently, a UK security researcher bought a VPN router from the same website for $2. The device connected directly to the internal network of the Kirklees Council in West Yorkshire, because its settings hadn’t been reset to the factory defaults. Two months ago, an IT manager bought a second-hand computer for $75 from eBay. The hard disk of the machine contained personal information of around a million British banking customers.

Graham Cluley, Senior Technical Consultant for Sophos, pointed out that “a clear message needs to be sent to everyone to always think very carefully of how you dispose of electronic equipment, and to make sure that any sensitive data has been securely wiped”.