Data Interception and Theft

Data interception and theft is the capturing of data while it travels between devices, or the stealing of a device that holds data, in order to obtain that data. The attacker is after the information itself, not the equipment.

Interception

Interception means capturing data while it is being transmitted across a network, without the sender knowing. Picture a small printing company sending its monthly payroll file from the office computer to the accountant's computer over the office network. An attacker who has plugged a laptop into a spare network socket copies the traffic as it passes, so the salary figures in the file are seen. Nothing looks wrong — the file arrives as normal — so nobody realises it was also read on the way.

Theft

Theft means stealing a device that holds data, such as a laptop, a phone or a USB flash drive, so that the files on it fall into the thief's hands. A memory stick holding a media project, taken from an open bag on a train, hands every file on it to a stranger. Interception is not the same thing: no device is taken, because the data is copied while it is being sent.

Encryption and purpose

Encryption cannot stop interception — the packets can still be copied. It stops the captured data from being understood, because without the key it is scrambled into nonsense rather than a readable password.

The purpose is to obtain the data, which can then be read, sold or used to carry out further attacks. A captured password might open other accounts, and a stolen file might be sold to someone else.