Slashdot Mirror
UK Gov't Lost Personal Data On 4M People In One Year
An anonymous reader writes "The U.K. government has lost the personal information of up to four million citizens in one year alone.
The astonishing figures, calculated by the BBC, added up as Whitehall departments slowly released their annual reports for the year to April.
And the trend has not stopped — in the latest revelation, HM Revenue Customs, which infamously lost the details of 25 million child benefits claimants last November on two unencrypted discs, experienced 1,993 data breaches between 1 October last year and 24 June." (More below.)
"Earlier this week, the Ministry of Justice admitted it had lost 45,000 people's details throughout the year, on laptops, external security devices and paper, and that 30,000 of them had not been notified.
Before that, the Home Office announced it had lost the data of 3,000 seasonal agricultural workers on two unencrypted CDs.
In May, the Department for Transport lost the data of three million learner drivers. Other data losses occurred at the Foreign Office, which lost 190 people's data in five incidents.
In January, the Ministry of Defence said it had lost a laptop containing the details of 620,000 recruits and potential recruits, and some information on 450,000 referees for job applicants. The Liberal Democrats have called for 'data guardians' to be appointed to monitor the government's handling of information."
Encryption nowadays is so damn easy to use. Why don't they?
That is almost 10 breaches a day. That is not a leak. That is a fucking river .
I am reminded of a pretty good saying. "Once is happenstance, twice is coincidence, and three times is enemy action". With data breaches this prevalent there needs to be investigations, firings, and serious consequences for all involved. At least fire everybody in charge at once.
The magnitude of this crisis clearly indicates that the state urgently requires expanded powers and broader scope of co-operation with private sector stakeholders in order to secure these sensitive records.
Utterly, utterly, wrongheaded; but just plausible enough to work...
How do you propose that they "prove competence", as far as I can tell, that seems to be what's happening, some organizations, have proved their competence, others, such as this, have failed.
Granted, information distribution isn't exactly new, however the method and/or media used to transfer the information is/has changed, and is being increasingly adopted, so they all have to figure it out.
Besides, I don't think it's "humanly" possible to transport this amount of information with absolutely no spillage at all.
That said, I'm not really making excuses, as even 4 Million is much larger than it should be, that's what, 6 to 7% of the population? That's basically epidemic, and is certainly pandemic given that the UK isn't the only one.
No laptops, CDs, memory sticks, USB drives. Just a dumb terminal. That way the data can live in a secure data center. Until you piss off some rowdy geriatric mainframe hackers.
Well obviously if those 4 million people have nothing to hide, then there's nothing to worry about, right?
Code, Hardware, stuff like that.
The UK has all but handed over the handling of citizens data to lowest bidder IT companies.
I've experienced this first hand. I worked in a hospital where total access to everything on the hospitals network was available without even typing in a password if you used certain machines which were 'configured for ease of use'. You'd think those machines weren't reachable by member of the public, or externally, but you'd be wrong.
They aren't unique either.
A learning experience is one of those things that say, 'You know that thing you just did? Don't do that.' - D. Adams
Or sending passwords over IM/Email/plaintext.
try to explain about packet sniffers and you'll get a reply along the lines of "oh security would be down like a ton of bricks on anything like that". Cause packet sniffers are easy to detect as we all know.
the standard here is "security handle that so I don't have to think about being secure" when in fact security can't handle that unless people take reasonable measures themselves.
One suggestion would be to
Sure it is. You need proper procedures and regulations. Sure, if you put it on a laptop or memory-stick, and let your employees carry it around without any oversight, accidents will happen. But if you treat the information as valuables, all will be fine. Money-transports don't usually go around losing money.
The trouble is that there is no real accountability for losing data. If someone loses 4 million euros, they know somebody will be pretty unhappy. But losing the private records of 400 people, which given todays identity-theft-plagued society could easily result in damages of 4 million euros, is somehow not taken as seriously.
During the employment screening process, have popup ads appear on a screen during the personality/background info/aptitude test. If the applicant clicks on one, a trap door in the floor opens and flushes them back out on to the street.
They govt. also lost 25 million Child benefit records. Though it's possible/likely that there were some duplicates in all this - given that the UK population is "only" 61 million, that's still nearly half the people who live in the UK have had some personal data lost by the government
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
I don't hate my country, but I do dislike those aspects of the private school and class system which causes the people in power to be conformist and inward looking, and ready to believe any snake oil salesman in a Boateng suit. People mock Prince Charles, but at least he is prepared to get into trouble by listening to independent experts and then asking questions about the status quo and the desirability of corporatism. The Government appoints independent experts, and then when their conclusions conflict with those of the editors of tabloid newspapers, or McKinsey, they reject them. The inevitable result is pissed off staff and managerial incompetence. As one of my bosses used to say about organisations like McKinsey, when did you last hear of a great world manager? Taylorism takes no account of leadership, which is what gives morale and a sense of direction to organisations. And the only way to bring in things like data security is to bring back a spirit of public service - which means leadership.
From scarped cliff or quarried stone she cries "A thousand types are gone, I care for nothing, no not one."