Slashdot Mirror
UK Government Loses 15 Million Private Records
bestweasel writes "The BBC reports that a UK Government department has lost discs with details of 15 million benefit recipients, including names, addresses, date of birth and bank accounts. The head of the department involved, HM Revenue & Customs, has resigned and his resignation 'was accepted because discs had been transported in breach of rules governing data protection' so someone thinks it's not a trivial matter. The Chancellor will try to evade responsibility in the House of Commons at 3.30 GMT.
A similar leak of a 'mere' 15,000 records from the same department happened a month or so ago. At that time, they refused to say 'on security grounds' whether the information was encrypted." We just recently talked about Britain's consideration of legal penalties for situations like this. I imagine this incident will weigh on that decision.
Or so says The BBC...
We Build Beautiful Websites
And the government will give itself a nice fat getout clause so that it's immune when it loses everyone's data, but any company or individual outside the government is in trouble.
Just watch and wait.
With a nationwide DNA database? Please. They can't be trusted with anything.
15,000 records for the pension provider and now somewhat like a third of all peopl in the UK sent on what appears to be unencrypted discs. When I queried this with Standard Life they said that they had no choice but to accept the data like that and that the Govt refused to encrypt it. This being the same Govt that wants to hold all of our medical records in one national database, along with all of the ID card details. For the US peope reading, the National Insurance number is synonmous with your SSN, although not of quite as much use for fraud. It's still not something that you want to allow out into the wild.
The fact that 25million records were being sent via. post burnt on DVDs should give some idea of the level of technical competency in the public sector. Apparently they were being sent to the Audit Office, but why the Audit Office needed an off line copy of the data, and a complete copy at that, isn't addressed: no doubt some ridiculous bureaucratic idiocy that makes Brazil look sane.
The idea of burning an unencrypted copy of your sensitive data to a DVD and handing it to a random delivery company should horrify even the most incompetent sysadmin or DBA. Apparently no one in HM Customs & Revenue thought anything of it.
These are the sorts of people who want to build a massive database of all our personal details and tie them to ID cards. They tell us the data will be "perfectly safe". I wouldn't trust them to run a mail server.
Syllable : It's an Operating System
Didn't anyone learn ANYTHING from the last 5,000 years of record keeping?
He who knows best knows how little he knows. - Thomas Jefferson
We've been heading towards the totalitarian Peoples Democratic Republic of (formerly Great) Britain for some time now. This kind of thing is actually encouraging.
In a country where you are watched by security camera most of the day, and can be detained without charge for longer than anywhere on Earth, it is reassuring to note that the UK Government is so incredibly incompetent that there will always be a way to escape. No need for tunnels, gliders, or under the floor of a Trabant -- it should be pretty much possible to just walk through the border with a library card altered in crayon.
Camping on quad since 1996.
The real WTFs here are
Ok, it's probably worse than that though.
"The Chancellor will try to evade responsibility..." In what way could be held responsible? The data was copied and sent in clear breach of the agency's (and the Government's) rules. The last time I checked, it wasn't the Chancellor's responsibility to monitor personally all packages sent by Government agencies. Had the security breach happened due to actions which did NOT breach any rules then I might agree with you, however this is not the case here. Put it this way: If ministerial resignation (and that is what you are implying should happen) is to follow every breach of security then that is a green light to every ne'er-do-well and Tory malcontent working in Government to start posting confidential data left, right and centre.
Not offended old bean, we were more than pleased to get rid
of that bunch of God-bothering homophobic nutjobs. Enjoy the
Turkey.
Toodle pip!
Why are UK government IT projects always doomed to failure?
Because civil servants have no idea how to protect themselves from getting shafted by software suppliers, and no financial incentive to learn, essentially. Also, the government has an extreme aversion to suing its suppliers, so the same suppliers do the same thing every time.
Reality is the ultimate Rorschach.
At some point, if the UK government gets its way, everyone will have their DNA and fingerprints stored in a central database. How long will it be before some backup hard drive goes missing with all the data?
Did they look behind the couch?
That's where I always lose things.
They might be there.
Breaking Into the Industry - A development log about starting a game studio.
"As we stand at present, every taxpayer in Britain has something approaching £900 of their money at stake[1] in this small mortgage bank following the £24 billion loan (which excludes the less controversial £18 billion in deposit guarantees). You and Vince Cable need to go learn where money comes from.
It's a bank loan from the central bank. Not a penny of money you have paid in tax has been given to Northern Rock. Not a penny of government borrowing has been given to Northern Rock.
[1]I'm a LibDem supporter and I don't like Fractional Reserve Banking but this is just complete bollocks. Vince clearly has no clue where this money comes from, which I find almost as worrying as the fact that the Chancellor of the Exchequer also continually refers to this money as "taxpayers money". This 24 billion pounds worth of money and the taxpayer have never crossed paths. Vince is in theory highly qualified as an economist. I'm beginning to wonder just how bad the education at Cambridge and Glasgow Universities really are.
Deleted
Thankyou for responding to my the very generous proposal. The money will be put into your bank accounts very soon, but please to be sending password for this 'zip file' which you have sent. Or please to be sending me the sum of $30 for a shareware for opening this files. I await your happy response with great anticipations and to look forward to putting the monies into bank accounts. Yours, Mr Ongbgudgbu Bungongdgogi
Although this is a monumental cock-up, I am not that surprised. HMRC is a recent merge of two big heavyweight Government agencies - Inland Revenue and Customs and Excise. If that wasn't hard enough to deal with, during the last year or so, the Government has decided that there are too many civil servants (might well be true) but has simply decided to lay off huge numbers of employees with little consultation of forethought as to how the work would continue under the same pressures and targets. Let's not even talk about the implementation of the IT systems which far from helping automate or compliment the workload, it has generally increased it. I find it hard to believe that in 2007, an agency like HMRC continues to correspond with other Government agencies by courier when we are talking about such sensitive and massive quantities of UK citizen data. Even if it were sent by secure FTP or something, it wouldn't have been very much trouble to do. It's a dark day for everything British.
Thanks for pointing this out, which I entirely agree with. I also agree with the first response to your post, which is that it's like this all through the private sector, too. The difference is that government organisations actually have to be directly accountable to people sooner or later, and in that sense they have a much harder time. It's not really a surprise that a lot of people don't want to work for them.
Lately I've been doing IT work for a government department (in New Zealand in my case) which is actually run well. The entire government sector here was overhauled in the early 1980s with the Official Information Act, which has had at least one really good review from over the Tasman. The law says that anyone can request any information from any department at any time, and the department has to provide it within a specific timeframe (about twenty-something working days), or it'll get into a lot of trouble. The only exceptions are if the request is unreasonably complex, or if there's a good reason to withhold it (such as privacy, etc), in which case the department has to explain why it's withholding the info, and often convince an external auditor that it's justifiable to do so.
After 25 years of working with it, the whole government sector has adapted. We have a full time team of people which is specifically dedicated to receiving official information requests from the public and journalists, delegating them to appropriate managers or other staff, and then making sure the queries actually get answered appropriately.
Everyone knows they could be accountable at any time, any they take it seriously, and contrary to what it sounds like your experiences have been, the management actually supports the whole thing, which as an employee is very encouraging. It's not perfect and people do make mistakes, but the whole system does seem to be a lot more accountable than what I've heard of something like the US Federal Government, for instance.
Look... It's not going to help prevent authorized access by keeping it secret.
.... balh blah blah..
If it's not encrypted, when the files are opened it will look like (or something really obvious):
Joe Public DOB: xx-xx-xxxx 12345 Main Street
If it is encrypted it will look like:
982n5o39y8h5014u9m9p!#$`15235098h14n12#$!@3476bwfSFR2387rn@!#12987ksafdkjD
It doesn't take a fucking genious to figure out if a file is encrypted or not. And its not like they are going to told what alog it is encrypted with if it is encrypted. I can see no reason NOT to tell the public if the data is encrypted or not, so the public knows what kind of precautions or steps may be needed to protect their identity.