Slashdot Mirror
UK Government Loses 15 Million Private Records
bestweasel writes "The BBC reports that a UK Government department has lost discs with details of 15 million benefit recipients, including names, addresses, date of birth and bank accounts. The head of the department involved, HM Revenue & Customs, has resigned and his resignation 'was accepted because discs had been transported in breach of rules governing data protection' so someone thinks it's not a trivial matter. The Chancellor will try to evade responsibility in the House of Commons at 3.30 GMT.
A similar leak of a 'mere' 15,000 records from the same department happened a month or so ago. At that time, they refused to say 'on security grounds' whether the information was encrypted." We just recently talked about Britain's consideration of legal penalties for situations like this. I imagine this incident will weigh on that decision.
With a nationwide DNA database? Please. They can't be trusted with anything.
15,000 records for the pension provider and now somewhat like a third of all peopl in the UK sent on what appears to be unencrypted discs. When I queried this with Standard Life they said that they had no choice but to accept the data like that and that the Govt refused to encrypt it. This being the same Govt that wants to hold all of our medical records in one national database, along with all of the ID card details. For the US peope reading, the National Insurance number is synonmous with your SSN, although not of quite as much use for fraud. It's still not something that you want to allow out into the wild.
The fact that 25million records were being sent via. post burnt on DVDs should give some idea of the level of technical competency in the public sector. Apparently they were being sent to the Audit Office, but why the Audit Office needed an off line copy of the data, and a complete copy at that, isn't addressed: no doubt some ridiculous bureaucratic idiocy that makes Brazil look sane.
The idea of burning an unencrypted copy of your sensitive data to a DVD and handing it to a random delivery company should horrify even the most incompetent sysadmin or DBA. Apparently no one in HM Customs & Revenue thought anything of it.
These are the sorts of people who want to build a massive database of all our personal details and tie them to ID cards. They tell us the data will be "perfectly safe". I wouldn't trust them to run a mail server.
Syllable : It's an Operating System
Yes... destroy all the records! Leave 'em guessing!
Seriously, it's preposterous to talk of data retention strategies and forcing people to be part of national data banks when there's absolutely no talk about how you're going to make it secure. I would like to think a data center where personal data for users/citizens is kept would be run more like Fort Knox than the McDonald's Drive-Thru.
GetOuttaMySpace - The Anti-Social Network
Camping on quad since 1996.
The government department responsible is likely to be punished with a severe fine.
Three months later it will be discovered that the department is unable to provide the politician-promised and legally mandated level of service due to an unbudgeted severe shortfall of funds, so emergency funding will be provided.
The real WTFs here are
Ok, it's probably worse than that though.
"The Chancellor will try to evade responsibility..." In what way could be held responsible? The data was copied and sent in clear breach of the agency's (and the Government's) rules. The last time I checked, it wasn't the Chancellor's responsibility to monitor personally all packages sent by Government agencies. Had the security breach happened due to actions which did NOT breach any rules then I might agree with you, however this is not the case here. Put it this way: If ministerial resignation (and that is what you are implying should happen) is to follow every breach of security then that is a green light to every ne'er-do-well and Tory malcontent working in Government to start posting confidential data left, right and centre.
Yes.
And this is precisely the point that needs to be made. Whenever governments start throwing around words like "central" and "database," you need to point to events like this and ask "have we fixed this sort of thing yet?"
Until the answer is a resounding (and verifiable) "YES," I'd ask my government to keep their noses out of my personal information, thank-you-very-much.
"Programming is the fine art of making a machine that has absolutely no intelligence act as though it does."
Why are UK government IT projects always doomed to failure?
Because civil servants have no idea how to protect themselves from getting shafted by software suppliers, and no financial incentive to learn, essentially. Also, the government has an extreme aversion to suing its suppliers, so the same suppliers do the same thing every time.
Reality is the ultimate Rorschach.
You'd probably appreciate this bit of tinfoil hatterness... I'm willing to suggest that this is an end run to lock down the banks to prevent a bank run in the event of the US credit shit spilling over the seas.
Obviously, they'll have to block everyone from taking money out of their bank accounts in order to ensure that the bad guys who stole the account numbers can't take money out. What's that, your bank is going out of business because it bought billions in US mortgages? Well, give us 6 months for us to clear your identity, and then we'll let you draw a check... if your bank is still around.
That was my first thought. The one good thing about this kind of disaster is that there is now a strong concrete example of why it is a bad idea to give the government any more data than they absolutely need. Whenever someone suggests a massive central database we can say 'you lost 15 million private records, why should we trust you with any more?'
I am TheRaven on Soylent News
If anything, this is being announced now because you can't typically be retroactively prosecuted, not even in "the revolution failed and we're all subjects not citizens" Britain. So, by disclosing this now, they hope to avoid the harsher penalties later.
Loosening the tinfoil a bit... ah, there, feels much better... crawling out of basement... ah, there, the view is much clearer from up here... (but, what is that big glowing yellow/orange thing the sky - that is truly terrifying looking...)
Shutting down the ability to withdraw funds for six months for this reason would also require preventing transfers and check payments for the same supposed reason. Doing this would, by itself, probably destroy the entire economy of any modern commerce based society so it would make no sense. It would be like committing suicide to prevent getting a cold.
Why is there an "insightful" mod and why isn't it "-1"? If I wanted insight, I wouldn't be reading
as in "the post office(tm)" , this was an internal post service run by the courier TNT, no word on what TNT are doing about the loss
Obviously, they'll have to block everyone from taking money out of their bank accounts in order to ensure that the bad guys who stole the account numbers can't take money out.
IMHO part of a solution here would be to change things such that the only thing someone can do if they know the bank account details on these records is to put money into these accounts. i.e. that the information is insufficent to take money out of any accounts... Similarly that the only thing that someone can do with your National Insurance number is pay your income tax/state pension contributions.
Finally to stop treating such things as knowlage of mother's maiden name, data of birth, past/current addresses, etc as being proof of anything. Let alone "security questions". In all likelyhood alternative ways of doing things, otherwise you'd expect "celebrities" to be the most common victims of "identity theft".
No, the British government are considering a law to punish data loss.
Which IMHO is really the wrong approach. Far better to make the kind of information involved of little value to anyone else.
Which means rethinking the concepts of "identity" and "proof of identity". Such that knowing lots of facts about someone is of little use in impersonating them. There already appears to exist a group of people who's biographies are easily available who are not constantly plagued with impersonation.