Slashdot Mirror
In UK, 12M Taxpayers Lost With USB Stick
An anonymous reader tips a piece from the UK's Daily Mail that recounts another sad tale of the careless loss of massive amounts of private user data. "Ministers have been forced to order an emergency shutdown of a key Government computer system to protect millions of people's private details. The action was taken after a memory stick was found in a pub car park containing confidential passcodes to the online Government Gateway system, which covers everything from tax returns to parking tickets. An urgent investigation is now under way into how the stick, belonging to the company which runs the flagship system, came to be lost."
I've got a better question. I'd like to know how this memory stick came to be in the first place!
Putting aside the question of whether such a database of private information has any reason to exist, what possible excuse is there for putting the information to access that database on a portable USB device? It was not a question of if such a device would be lost, but when.
Good security policy demands redundancy for just this reason. A verification system should require--at the very least--a combination of something you know (your personal pin), and something you have (for example, a SecurID or in this case, a USB key with the passcodes on it). That way, if the physical token is lost, security isn't immediately compromised.
This kind of careless attitude towards security wouldn't fly in the corporate world. It's only because it's the government doing it that security is so lax. After all, nobody's job is on the line over this. It's next to impossible to fire a government employee in most countries, epic incompetence--or even outright misconduct--notwithstanding. So expect to see more of this, because there's no incentive to change.
"An urgent investigation is now under way into how the stick, belonging to the company which runs the flagship system, came to be lost." I dont particularily care how it was lost, people will always manage to lose things and expecting otherwise is very niave. What I really want to know is how the hell that much sensitive data was doing on a USB stick in the first place.
I will bet $100 AUD (Or about 50 UK pounds) that there will be absolutely no jailtime served by anyone involved in the loss of this data, with the possible exception of the poor soul who found it.
Not the first time it's happened by far, and it certainly won't be the last... would you trust a surveillance society that can't even keep track of its own inventory?
Check out my sci-fi book "Lacuna" at http://goo.gl/MVxX8
What, again?
At the same time, the government wants us to let them to store personal details of all citizens in the interest of national security.
This USB stick with sensitive/valuable data got returned and appropriate actions could be taken to minimize damage. But the number of incidents like this we've seen lately raise the question how many other lost USB sticks and other storage media with passwords, personal data etc that are floating around unknown to the people whose integrity and personal finances quite possibly are at stake.
"I have downloaded hundreds and hundreds of records, why would I care if somebody downloads ours?" Robin Pecknold
Your libertarianism is showing - it was a private entity that lost the data.
For a government that collects so much surveillance on their citizens you would expect an outcry for some accountability when private data is lost.
My ism, it's full of beliefs.
To an extent it's just because that's what sells papers. There are always kids being stabbed and planes crashing and data being lost. It's just if kids being stabbed becomes a hot topic, you print more stories on stabbed kids.
I really don't think much has changed, but the Mail is keen to point out that the world is ending, and it's probably Johnny Foreigner's fault.
jh
I have witnessed how strict, inflexible security rules force people to break the security in order to get their job done.
Stop the brainwash
The way I read it, there was no information about taxpayers on the USB stick itself.
But there was authentication and access information about the citizen/taxpayer database, which is probably accessible over the Internet, with the correct VPN credentials, etc.
It was these VPN credentials and passwords that was on the USB stick.
Imagine the average user who writes their password on a post-it and sticks it to the bottom of their keyboard.
Now make that post-it into a giant animated billboard in Times Square, and you've kind of got the idea.
(No cars. Fsck. My analogy sucks!!)
"City hall" in German is "Rathaus" Kinda explains a few things......
I carry a memory stick attached to my key ring, which includes encrypted copies of SSH and PGP keys, the passphrase to decrypt them is memorised...
Anyone who stole it would be more interested in stealing the car for which the key is on the same ring, or breaking into the house using the keys and stealing stuff...
Or they could just take the unencrypted episodes of tv shows from the usb key.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
That's what reading a "newspaper" like the Daily Mail will do to you. If you read tomorrow's copy you'll find out it's all 100% due to immigrants, the EU and Gordon Brown (who "according to a source", was seen carrying out the stabbings himself).
In reality though, looking at the police stats, there's actually only been a single 14 year-old (and no one younger) who's been murdered this year in the UK. There was a clump of teen stabbings in London at the start of the year but this has reversed to actually being slightly below average over the year.
The murder rate in the UK currently stands at 1.4 per 100,000 which is only about 1/4 the US murder rate of 5.5 per 100,000 (which itself is extremely low by historical standards).
So clearly the actual statistics and reality aren't coming out in the media. My problem with this is that it's pretty hard for a rational and correct solution to be engineered when everyone's being told irrational scare stories everyday by newspapers with a clear finnancially vested interest in exaggerating facts.