Slashdot Mirror
UK Prisons Ministry Fined For Lack of Encryption At Prisons
Bruce66423 (1678196) writes The Guardian reports that the UK Information Commissioner has levied a fine of £180,000 on the Ministry of Justice for their failure to encrypt data held on external hard drives at prisons. The fine is nominal — one part of government fining another is rather pointless, but it does show that there's a little bit of accountability. Of course it's interesting to consider the dangers of this hopefully old way of storing backups; but the question of whether we do a lot better now is quite pointed.
To make matters worse, one of the unencrypted backup hard drives walked away.
I can't imagine the identities of a bunch of ex-cons are that valuable.
The fine is nominal — one part of government fining another is rather pointless, but it does show that there's a little bit of accountability.
It seems like the two clauses of that sentence are contradicting each other. How does a "pointless" fine show any accountability at all?
Of course it walked away. Thanks to Hitachi, they can even dance.
Get free satoshi (Bitcoin) and Dogecoins
outsource IT makes stuff like this more likely and can leave tech people in a place where they can't do stuff needed to make it work and or need to disable it to be able to get work done as some outside vendor picked something that does not work that well.
Outsource all of the government functions - put it all out for bid.
Right. Just outsource IT to Oracle, SAP, or Microsoft. That is a wonderful solution.
They have a tendency to walk away in Britain...being in a prison maybe someone hid it away in a dark place, who knows. Pity they havent invented yet backup servers...Who are providing the IT services? The felons?
No matter how incompetent civil servants you have, they will save you a lot HELL more money than those money grabbing machines now as Oracle, SAP or Microsoft. By a couple of orders of magnitude.
The prisoner's will win with the low-bid...they'll watch themselves for the low-low fee of 10 pounds/hr [well, for 8 hrs a day, after that it's overtime, and then working on weekends and holidays].
Sleep your way to a whiter smile...date a dentist!
I can attest that the British MoJ is a Gilliamesque farce. It was as if an overzealous technocrat saw 'Brazil' and rebuilt the Civil Service in its image.
I was an temp admin-monkey for 6 months after things went to shit in 2008/9, in what we called the 'Ministry of Paperwork'. The HR offices for the MoJ. Holders of 60k+ complete records of everyone who ever applied to work in the UK courts. Right up to the top judges and bigwigs.
At this point we were using WinNT on boxes with XP CoAs and paying meeeelions for the privilege. All to run a bespoke Oracle client that topped out NTs user profile limits with excessive caching and borkt the windows session. All built and supported by one of the most predatory firms in the UK, affectionately known as Twatos.
The decision-makers were in another city and were clueless about the day to day running of a computerised office. Let alone data protection.
This sort of incompetence runs to the core of the Civil Service and they get fleeced at every turn. Including by the recruitment agency supplying staff to the HR department.
The idea of the government fining itself is preposterous. Terry Gilliam must be laughing in his grave.
--
This perpetual motion machine Lisa made is a joke, it just keeps getting faster and faster. - Homer
There is no such thing as absolutely secure encryption. A good policy is to not have secrets. But secrets are a fact of life. Even then, security through obscurity is often better than off the shelf things.
High-strength industry standard encryption, properly implemented, is currently believed to be completely unbreakable. It's extremely unlikely any government agency can crack modern cryptography, as evidenced by the lengths they go to in order to try to regulate it (historically), or circumvent it at the source. You can't *prove* it's unbreakable, of course, but we've seen zero evidence to the contrary, with many, many people looking, so I won't be hypocritical and say "it's unbreakable", but "for all practical purposes, it's unbreakable".
I can't think of worse advice than "security through obscurity". You definitely want "off the shelf" solutions, because those solutions have been vetted by many experts - some friendly, some hostile - all trying very hard to break that security. The quickest way to create a security disaster is to roll your own security solution. Remember WEP?
Irony: Agile development has too much intertia to be abandoned now.
Look, you misunderstood: sillybilly secures his data via the Bennett Haselton algorithm.
Step 1. Procedurally generate a wall of text that is incoherent but is syntactically valid, vaguely related to the general topic, and is filled with irrelevant personal opinion, bemused speculation, and random misconceptions.
Step 2: Embed data to be secured in the middle of said text.
Step 3: Back up the data to the cloud (aka "troll Slashdot with your post")
That's it! Both Bennett and sillybilly could post their SSNs, credit card numbers, etc in plain view on Slashdot and no one would be the wiser!
Outsourcing is the main problem with modern British government, you stupid fuck. Profit motive means doing the MINIMUM work for the MAXIMUM personal gain - it is the very opposite of what you need in a prison system, where pretty much none of the humans are informed, rational, voluntary actors.
And changing providers every few years just to suit your stupid ideology eliminates the efficiency of experience.
There is almost no British government function that has been improved by outsourcing, and IT projects are the worst in this respect, reaching insane budgets and always under-delivering (in some cases this is good because the citizens would not benefit from the project, e.g. Universal Credit or shared health records). Please take your religion and find a sound-proofed church to preach it in.
I can picture a scenario that if they were encrypted, the recovery key would be lost, or the person holding it would die or resign or quit and suddenly all the backups are unrecoverable. You can say ok, so the key should be kept somewhere secure, but where? When you answer that question, then why not put the actual backups there? It's not like you could have just one key forever either. That would be insecure to never change it. But to change it means having some filing system to keep the whole list of them from years and years back and storing them so people can find them. Then how are you going to encrypt THAT?
It's only unbreakable through a computer science approach, it's still vulnerable to social engineering.
They just have to work shifts, taking turns being the guards.
" The fine is nominal — one part of government fining another is rather pointless, but it does show that there's a little bit of accountability"
in the voice of Sir Humphrey Appleby.
No minister it is not pointless at all. You get to show that their is some accountability at no cost to the government in monetary terms. The error will be shown to be a problem with a contractor that is following his original contract instead of the new updated rules so no one in the civil service will be held responsible and in the end nothing really will change and we can get on with the business of running the government.
See my blog http://ilovecookes.blogspot.com/ for light hearted technical information.
This is just another example of the way the UK government and Civil Service, as institutions, do not understand IT. Down at the bitface, there may well be some very competent IT people - but their voices do not reach up to the levels that have control. The people who actually make the decisions, both politicians and civil servants, have no gut fel for IT. The assume that if you had over enough money to a plausible contractor, you will get something that works. The contractors, of course, are building something that meets the spec. The idea that "something that works" and "something that meets the spec" are not the same thing completely escapes them. On a large scale, the NHS IT fiasco.
In this case, they bought drives specified as encrypted, and assumed the job done. Anybody who thought through the problem would have realised that there is a second, administrative phase: who sets they keys, who holds them, what happens if they are ill or leave, should we change the keys if people who know them leave... A side effect of this thinking would have been to decide when to turn on encryption, who to do it etc. But because they had bought a box with "encrypted" on the side, they assumed that the technology fairies would do the rest.
Consciousness is an illusion caused by an excess of self consciousness.
No. It's not illegal, or even remotely so,
In many business situations, it's pretty close to mandatory. For the rest of us, encryption has caught on because of dodgy newspapers and Nigerian street markets.
In a lecture, a couple of years ago, I was asked what the best way of removing data from old drives. My answer was "a 10 year old with a lump hammer". Once that has been done with gusto, no spook or criminal News International employee will get much out of your stuff!
I'll see your Constitution and raise you a Queen.
I think encryption is the key here. Doesn't matter so much where you store it as how encrypted it is. However, if you put it onto a device that can fit very easily into someone's pocket, then you'd better make damn sure that it's encrypted.
You're a temporary arrangement of matter sliding towards oblivion in a cold, uncaring universe
I like how he/she automatically assumes private business doesn't have incompetent can't-be-fired-because-they're-the-boss'-son-in-law idiots working for them that make the average civil servant look like Albert Einstein..
Never underestimate the power of stupid people in large groups.
I don't believe fining it the correct punishment. I mean go ahead fine me, its not my money anyways. I really think that was travesty of justice the person in charge should be suspended or fired. One government office fining another is a slap in the face of the taxpayer who pay the fine.
Jack of all trades,master of none
sorry for the butchered title. I was like mannnnnnnnnnnnnnnnnnnnnnnn.lol
Jack of all trades,master of none
Idiots far more expensive too, btw.
Answered too fast sadly. Besides the possibility of having idiots far more expensive outsourced from the private sector, the fact is that public sector often gets assigned second or third rate consultants because the best ones are assigned to private sector customers.