Slashdot Mirror
UK Prisons Ministry Fined For Lack of Encryption At Prisons
Bruce66423 (1678196) writes The Guardian reports that the UK Information Commissioner has levied a fine of £180,000 on the Ministry of Justice for their failure to encrypt data held on external hard drives at prisons. The fine is nominal — one part of government fining another is rather pointless, but it does show that there's a little bit of accountability. Of course it's interesting to consider the dangers of this hopefully old way of storing backups; but the question of whether we do a lot better now is quite pointed.
To make matters worse, one of the unencrypted backup hard drives walked away.
I can't imagine the identities of a bunch of ex-cons are that valuable.
then they can just hide all of the abuses they don't report.
The fine is nominal — one part of government fining another is rather pointless, but it does show that there's a little bit of accountability.
It seems like the two clauses of that sentence are contradicting each other. How does a "pointless" fine show any accountability at all?
What's the point of this? If the ministry is unable to operate due to lack of money, they'd just have to ask it back again, from the *earnings* of UK Information Commissioner.
Am I the only who found this ridiculous and idiotic?
From the article:
"But the ICO's investigation into the latest loss found that the prison service did not realise the encryption option on the new hard drives needed to be turned on to work correctly"
"To work correctly"?
Could you expand on how your identity is more important, your holiness?
What an outrage
Of course it walked away. Thanks to Hitachi, they can even dance.
Get free satoshi (Bitcoin) and Dogecoins
Outsource all of the government functions - put it all out for bid.
Outsource the management too.
Have elections to select which management firms are eligible to be in the random drawing for the next 1,2,4, or 5 year cycle...
This issue is a bit more complicated than you think.
outsource IT makes stuff like this more likely and can leave tech people in a place where they can't do stuff needed to make it work and or need to disable it to be able to get work done as some outside vendor picked something that does not work that well.
What's the new way of storing backups? On someone else's hard drive over the internet? How is that better?
Jamie Archer: When did you start smoking?
Castor Troy: You'll be seeing a lot of changes around here.
[blows smoke rings at Jamie]
Castor Troy: Papa's got a brand new bag. OW!
I can attest that the British MoJ is a Gilliamesque farce. It was as if an overzealous technocrat saw 'Brazil' and rebuilt the Civil Service in its image.
I was an temp admin-monkey for 6 months after things went to shit in 2008/9, in what we called the 'Ministry of Paperwork'. The HR offices for the MoJ. Holders of 60k+ complete records of everyone who ever applied to work in the UK courts. Right up to the top judges and bigwigs.
At this point we were using WinNT on boxes with XP CoAs and paying meeeelions for the privilege. All to run a bespoke Oracle client that topped out NTs user profile limits with excessive caching and borkt the windows session. All built and supported by one of the most predatory firms in the UK, affectionately known as Twatos.
The decision-makers were in another city and were clueless about the day to day running of a computerised office. Let alone data protection.
This sort of incompetence runs to the core of the Civil Service and they get fleeced at every turn. Including by the recruitment agency supplying staff to the HR department.
The idea of the government fining itself is preposterous. Terry Gilliam must be laughing in his grave.
--
This perpetual motion machine Lisa made is a joke, it just keeps getting faster and faster. - Homer
I can picture a scenario that if they were encrypted, the recovery key would be lost, or the person holding it would die or resign or quit and suddenly all the backups are unrecoverable. You can say ok, so the key should be kept somewhere secure, but where? When you answer that question, then why not put the actual backups there? It's not like you could have just one key forever either. That would be insecure to never change it. But to change it means having some filing system to keep the whole list of them from years and years back and storing them so people can find them. Then how are you going to encrypt THAT?
...for a country where encryption is more or less illegal.
" The fine is nominal — one part of government fining another is rather pointless, but it does show that there's a little bit of accountability"
in the voice of Sir Humphrey Appleby.
No minister it is not pointless at all. You get to show that their is some accountability at no cost to the government in monetary terms. The error will be shown to be a problem with a contractor that is following his original contract instead of the new updated rules so no one in the civil service will be held responsible and in the end nothing really will change and we can get on with the business of running the government.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
This is just another example of the way the UK government and Civil Service, as institutions, do not understand IT. Down at the bitface, there may well be some very competent IT people - but their voices do not reach up to the levels that have control. The people who actually make the decisions, both politicians and civil servants, have no gut fel for IT. The assume that if you had over enough money to a plausible contractor, you will get something that works. The contractors, of course, are building something that meets the spec. The idea that "something that works" and "something that meets the spec" are not the same thing completely escapes them. On a large scale, the NHS IT fiasco.
In this case, they bought drives specified as encrypted, and assumed the job done. Anybody who thought through the problem would have realised that there is a second, administrative phase: who sets they keys, who holds them, what happens if they are ill or leave, should we change the keys if people who know them leave... A side effect of this thinking would have been to decide when to turn on encryption, who to do it etc. But because they had bought a box with "encrypted" on the side, they assumed that the technology fairies would do the rest.
Consciousness is an illusion caused by an excess of self consciousness.
Well, why do you have keys, as in physical ones? Because they're easier to lug around than the secured object. Even something as simple as a money box: You lug it around locked and perhaps have someone else carry the key. And in large institutions you (have to) have key management that keeps track of who has which keys. There are interesting parallels with gobs of data.
One of the first things you have to ask is whether it is more desirable to lose access to the data by losing unencrypted storage devices holding the data on the bus or by losing the keys and so ending up with encrypted devices that hold data you cannot do anything with... and neither can anyone else. The outcome here can easily be different to what's a desirable failure mode for losing the key to some inmate's cell door. The procedures and processes around it, though, are similar.
And with data encryption you have many more options of storing the data and managing the keys. You could, for example, encrypt the keys using public key crypto and send the results to a key management facility. That one person quits, you get their work key back at the cost of a bunch of paperwork. Something like that. It's not difficult, you just have to organize it within your organisation.
I don't believe fining it the correct punishment. I mean go ahead fine me, its not my money anyways. I really think that was travesty of justice the person in charge should be suspended or fired. One government office fining another is a slap in the face of the taxpayer who pay the fine.
Jack of all trades,master of none
sorry for the butchered title. I was like mannnnnnnnnnnnnnnnnnnnnnnn.lol
Jack of all trades,master of none
There are systems where x of n keys (say 2 out of 3) can be used to decrypt for exactly this scenario.