UK Government Staff Caught Snooping On Citizen Data

An anonymous reader writes "More than 1,000 UK government staff have been caught snooping on citizen data — including criminal records, social security, and medical records. From the article: 'The U.K. government is haemorrhaging data — private and confidential citizen data — from medical records to social security details, and even criminal records, according to figures obtained through Freedom of Information requests. Just shy of 1,000 civil servants working at the Department for Work and Pensions (DWP), were disciplined for accessing personal social security records. The Department for Health (DoH), which operates the U.K.’s National Health Service and more importantly all U.K. medical records, saw more than 150 breaches occur over a 13-month period.'"

Comments

Shocker

[trout007]

Give someone access to people's private information and it will be abused. Here I'm giving you this box that contains pure awesomeness. Please don't open it.

Re:Shocker

[Anonymous Coward]

Auditing systems only work to stop legitimate users of a database from making inappropriate queries, the database and system administrators, and in most cases network administrators have carte blanche access to anything and everything they are responsible for, and it is always a simple procedure to bypass any audit traps that may be in place.

Take the example of an Oracle DB on a Unix system, it is a pretty trivial task to make a copy of the entire hard disk (and database contained therein) without leaving a trace of your actions. These systems are both too simple and too complex to prevent access from a lower level of abstraction.

We put a huge amount of trust in system operators, and there is really no other way. At the end of the day, someone needs lowlevel access to the system to run diagnostics and perform maintenance, even in some security enhanced configuration like IBM AIX or z/OS, there is going to be a hardware maintenance mode, if not accessible by the site admin, it will be accessible by someone at IBM.

Re:Shocker

[niftydude]

Not just private information. I used to consult to a roads authority that I'll keep nameless for now.

They had remote controllable ccd cameras all over the place to keep track of traffic flow etc.

Whenever I went in, one of the cameras would almost always be pointing at the girl who used to sunbathe in her back yard in a property very close to a major intersection.

Incredibly creepy.

"Disciplined" says it all

[oobayly]

Just shy of 1,000 civil servants ... were disciplined ...

WTF, how about sacking these people, they clearly can't be trusted in their position. Better still, make it a criminal offence (if it isn't already) and charge them.

I worked for the Ordnance Survey in Southampton after Uni. During training we were shown examples of where people had altered maps (someone wrote "HI" in land tiles in the North Sea, and a building was labled "Kate's cradle of filth"). It was explained to us that all work was logged. If caught we would be sacked. If we'd already left, we'd be chased up under the Official Secrets Act.

Whether it was all a threat, I don't know. But I certainly didn't risk finding out. Neither did any of my friends.

Re:"Disciplined" says it all

[Spad]

This is the public sector we're talking about, you can't just fire people for gross misconduct, that would be discriminating against people who violate your policies.

I have personal experience of this, contracting for an NHS trust where one of the people in my team abused their access to snoop through peoples' emails, documents & web logs to try and find information that they could use to blackmail them into giving them perks & preferential treatment. We caught it within a couple of days and had witnesses and audit logs showing what they'd been doing (they weren't too bright when it came to covering their tracks) and handed the whole lot over to HR.

It took nearly 3 months before they even suspended him; almost 2 years later they had botched everything so badly that they had to pay this person off to leave quietly and not take them to an employment tribunal.

That anyone ever gets fired from a public sector role without having broken some pretty major laws is nothing short of a miracle.

Nothing to fear...

[yotto]

These people, though, were doing nothing wrong so they have nothing to fear from these unelected civil servants poking through their personal information, right?
 
...right?

Lack of information

[abigsmurf]

The problem I have with these figures is that they give no details of the nature of the offences.

Were these all "I want to find embarrassing data on my ex or a celebrity!"? Were some of them just "staff member legitimately needed to access an account and should've waited for his boss to authorise first".

How many of them were procedural mistakes and how many were genuine cases of snooping? A high number of the former would paint a very different picture and asks different questions to a higher number of the latter. But then Dispatches is a horribly sensationalist program so I doubt they care.

0% procedural, 100% Murdoch

[Anonymous Coward]

These are disciplinary actions, not administrative errors. Verbal ticking offs don't get listed. So they'll all real breaches.

“unauthorised disclosures of official, sensitive, private and/or personal information”,
I wonder how many of these are civil servants handing data over to Murdoch's newspapers & TV interests, given we know his newspapers even hacked telephones, buying info from civil servants about celebrities and politicians seems extremely likely. I wouldn't be surprised if a large percentage of those leaks were to Murdochs lot.

But the big revelation is that there are 200,000 civil servants approved to access the databases. That's an insane number! What did they expect, 200,000 possible leak points, the system is designed to leak private data like a sieve.
Most likely these are only the leaks that CAN BE CLEARLY IDENTIFIED as leaks. I think that's the TIP OF THE ICEBERG, since most of the data leakers would NEVER GET CAUGHT.

The arrival of Big Brother, finally ?

[Taco Cowboy]

Many decades ago I read that book "1984", I have to admit that I were scared shitless at the thought of the all-knowing big brothers controlling every single bit of my life.

But at that time, - decades ago, - even the worst government (East Germany, North Korea, China, Russia, to name just a few) just couldn't have the mean to know everything about every single citizen under their control

Oh yes, those bastard governments employed a lot of spooks and collected volumes of data, but determined citizens always found ways to defeat even the most draconian measure

No more

With the advent of computers and high speed network, not only they (the governments) get to collect all types of data, they can data-mine the data so much so that they can get to understand us more than we understand ourselves

We might not know where we might go, or what we might do, tomorrow, for example - by simply referencing our daily/weekly/monthly routines, our health data, our financial data, the people that we are in contact with, etc, - the government might be able to predict, with a certain degree of accuracy, what we might do, where we might go, a few days from now

This is scary !!

Way more scary than the scenario outlined in "1984"

Re:The arrival of Big Brother, finally ?

[TheRaven64]

The Stasi, like the Gestapo, relied on informers. They both worked in a situation where everyone was doing something illegal and an accusation was about all the evidence that was required. If they wanted to intimidate or eliminate someone, they just needed to pressure a neighbour or acquaintance into informing on them. This meant that they were intrinsically limited. Both were relatively small organisations and it would take several weeks of several agents' time to get one person. Their power came from the fear that they generated: everyone knew someone who knew someone who had been arrested on trumped-up charges and never seen again. It was unlikely to happen to you, but it could.

The problem with this kind of database and monitoring is that it means that any Stasi-like organisation can be run efficiently. Want to eliminate everyone in a certain category of political undesirables? There's an app for that...

Re:ugh

[TheRaven64]

But it would have to be taken away with the consent of the electorate. I suspect a speech by the queen about why she refused to sign RIPA would have resulted in a lot of MPs looking for a new career...