Government loses 15m people's personal data

[Saracen]

I wonder how much I can sell this disk for?

About 5 years under current criminal penalties.

[mycarsavw]

I have to ask what your occupation is Saracen, feel free to PM me if you'd rather not say out "in the open"

[Saracen]

I have to ask what your occupation is Saracen, feel free to PM me if you'd rather not say out "in the open"

I'm a professional cynic and card-carrying opinionated malcontent.

But I will say I'm not a lawyer, or any form of politician or political activist.

[usxhe190]

Darling/Brown: "I would like to emphasise that there is no evidence of misuse or that it had fallen into the wrongs hands."

UK People: "Can there ever be evidence?"

Monkeys: "Yes, when a person steals all your money from your account, we will then have the evidence to tell you that there is now evidence of misuse."

UK People: "That would already be too late..."

Bunch of monkeys....

[mycarsavw]

For those worried about the data, there's a helpline. No idea what they're going to tell you, but I'll find out soon.

0845 302 1444

What has just hit me is, children's names and details are on there too.

Quoting myself here.

The helpful chap I spoke to gave the following advice;

Read the information here - Home Office Identity Theft Home Page and here Welcome to CIFAS Online - CIFAS Online about ID theft and what to do (and not do).

And he went on to echo Saracen's earlier quote;

The missing information contains details of all child benefit recipients: records for 25 million individuals and 7.25 million families. Those records include the recipient and their children’s names, addresses and dates of birth, child benefit numbers, national insurance numbers and, where relevant, bank or building society account details. I regard this as an extremely serious failure by HMRC in its responsibilities to the public.

If you receive a Child Benefit of any sort, you're on the list/disc

EDIT:

I'm a professional cynic and card-carrying opinionated malcontent.

But I will say I'm not a lawyer, or any form of politician or political activist.

And witty to boot

[Saracen]

....


And witty to boot

I do try. I know that because my wife keeps telling me I'm very trying.


I think I got the bug early. When I was about seven, my rather staid grandmother asked me what I wanted to be when I grew up. I told her I wanted to be a professional layabout.

I think what impressed me was the way she sprayed the cup of tea she was drinking (I do pride myself on my sense of timing) all over the room. When she stopped spluttering, her colour faded from that funny blotchy red and her blood pressure came back down from the stratosphere, I hastily reassured her I was just kidding.

Then I told her I wanted to be a politician.

I didn't sit down for days. God she might have been ancient but that woman could run! I never thought she could catch me.

[mycarsavw]

I don't know if you watch Eastenders, (and I only do because the wife does (honest, guv)) but I'm getting a picture of that guy with the big dog, and the unkempt appearance.

Keith I think his name is, he sits in his armchair watching documentaries every day, has no job, but has an opinion/slant on everything and anything. Full of knowledge he is.

[Saracen]

Can't stand the program. The wife watches it and I leave the room when it comes on.

Now, what did I do with my "ban" button.

Hey, who paddlocked it?

[iranu]

This whole fiasco raises an awful lot of questions not just about the HMRC's systems, personnel, procedures, security (or lack there of) but every other government department that relies on personal data too.

I get the impression that inter-department governmental requests for data happen all the time and that these requests are sloppily handled simply because the requisite security is not built into the system. I bet the junior official's PC has a dvd/cd writer and usb ports. HMRC have almost certainly broken the Data Protection Act.

As for the illegal use of the data itself then this would be a gold mine. Whilst the government say there's no evidence it has fallen into the wrong hands they would never have that evidence unless there was a serious run on thousands of bank accounts. Criminals are not that stupid. If I had the disks I'd just sit tight for a couple of years whilst I gathered more information on the people I would target. Infact the info is so comprehensive that you could use it for all sorts of fraud, money laundering etc without ever causing the person whose data you are using to even know that their details were being used.

I'm secretly hoping that an awful lot of government ministers and their NuLiabor lackies have their info used. It would serve them right.

[G4Z]

I have to ask what your occupation is Saracen, feel free to PM me if you'd rather not say out "in the open"

I'm a professional cynic and card-carrying opinionated malcontent.

But I will say I'm not a lawyer, or any form of politician or political activist.

You know I always thought he was an unemployed gladiator....

[Koolpc]

Looks like it is time i changed my bank then! I must be on that list too!

[Stoo]

Umm, this is nothing particularly surprising to me to be honest, when I was on my sandwich year at uni I had a placement with the then Employment Service via EDS, and I had access to data on anyone who had claimed JSA in the last 3 or more years.

There was literally nothing to stop me wrong writing a SQL query, download the lot and either burn it to disc, email it somewhere, or slap it on some other form of data transit and walk off with it.

Some of this easily pre-dates Labour's 1997 return to power (I was there in 2000, and I couldn't see any evidence of it being any different in the previous years.), so it's hardly a problem unique to this particular government..

[Saracen]

......

Some of this easily pre-dates Labour's 1997 return to power (I was there in 2000, and I couldn't see any evidence of it being any different in the previous years.), so it's hardly a problem unique to this particular government..

Well, yes and no.

I take your point, and agree, but the context has changed a bit in the 10 years of Labour. For a start, the level of aggregation of data either has changed, or is being pushed HARD by the current administration. It's the serious push towards integrating systems and providing massive levels of access that has permitted the level of threat if and when things go wrong.

But personally, I'm not making a party political point. I have no reason to suppose the Tories would not be aggregating this data like crazy, just as Labour are, if they were in power, or that they'd be doing a better job of computer security, processes and controls. I'm not really bothered whether it's Labour or Tories at fault, but more that it's being done at all, unless there's an overwhelming reason for doing it. Just because technology means we now can do things that weren't feasible or cost-effective 20, 30 or 40 years ago doesn't mean we should do them, especially when it really helps the government's grasp on power over our daily lives.

But the focus of the political hot potato now seems to be moving on a bit.

Gordon Brown today at PMQs tried to argue that whilst a calamitous cockup, this security breach was all about the single error and breach of rules by a junior official. It now seems that may not have been the case.

The Chairman of the Public Accounts Committee now says that the NAO claim they requested names and NI numbers ONLY and that they specifically requested that sensitive data, including not only bank details but the parent's details too, should be removed before the data was sent to them. The NAO assertion is that this was rejected by a senior business manager at HMRC because it was not "cost-effective" and was "unduly burdensome" to do so, because the request would have to go to the private contractor doing the data management and that this was not included in the contract with them.

So, if that's true, it seems that this junior was only doing this and sending this at all because a senior manager had refused to comply with NAO requests to remove sensitive data before sending the data and it was refused on cost grounds. Bearing in mind that it was Gordon Brown that personally drove through the Revenue and Customs merger, and personally drove the cutbacks that resulted in some 12,500 staff already having lost their jobs, including a high proportion of managers and experienced staff, then it would certainly seem that this lapse appears to be a direct result of his policy decisions.

I seriously wonder if we're done with the revelations over the background to this story yet?

[acrobat]

They were sent via HMRC internal mail .... but in these days of outsourcing, that proved to be TNT. Maybe it's a dedicated delivery, maybe not.

So a public courier... with 3 letters =P

but it shouldn't have been sent over a WAN either, let alone a internet connection.

This is a case where the mountain shouldn't have been posted to Mohammed, but rather Mohammed should have gone to the mountain. The data should not have left the secure building it was in. If the NAO want to audit it, they go to the data.

I dunno about that. Theres no reason why they couldn't make a nice secure connection to transfer super encrypted data. If they cared..

And the real issue is not that some pleb did this, or that he ignored procedure to do it, but that he had the physical access to the data to be able to do it.

Someone has to have access to it though. The important thing is that they do their job properly. This evidently happened 4 times before, this just happened to be the first time it was lost. So its not even a one off skipping of procedure, but a complete rejection of it. The whole point of a procedure is that its tried and tested and safe, and as long as whoever responsible, follows that procedure, then it should be ok. But with these government departments... I wonder if there even is a procedure. All these government departments are so badly managed, I wouldn't be surprised if they didn't even know who was responsible for all this.

The first step in preventing that data getting into the wrong hands is to restrict who has physical access to it, and if it's not on the computer in the first place, an unauthorised person at the other end of the country can't copy it onto a disc and lose it in the post.

With all the mismanagement, incompetence and everybody's lack of caring though, that piece of paper is just as likely to end up put in a bin and left out back by the bins for someone to rummage through and uncover all kinds of goodies.

[Saracen]

So a public courier... with 3 letters =P

Huh?

I dunno about that. Theres no reason why they couldn't make a nice secure connection to transfer super encrypted data. If they cared..

There may be no reason why a nice secure connection can't be made, but there's good reason not to make it, or at least, not to transmit this type of data over it. For a start, no matter how secure the connection, transmitting anything over a connection is a reduction in security over not transmitting it at all from that secure building, for the simple reason that whoever has control of and responsibility for that data loses that control as soon as it goes into someone else's physical control. You are then relying on THEIR systems, security and integrity. If, on the other hand, you don't relinquish that control in the first place, you rely on your security. Of course, that does imply you actually have some in the first place, which seems to have been sadly lacking at HMRC. Their policy seems to have been that having a rule that says you can't do something is sufficient. That's a bit like expecting a burglar to not burgle somewhere because of the "keep out" sign. It's fine if he sees the sign and obeys it, and naff all use to anyone if he doesn't.

The point, acrobat, is not whether the connection can be made secure or not. Modern encryption can certainly do that, at least until either computer power gains several orders of magnitude of some bug is found in the maths it's based on ... if such a bug actually exists. The point is about basic access control.

Someone has to have access to it though. The important thing is that they do their job properly. This evidently happened 4 times before, this just happened to be the first time it was lost. So its not even a one off skipping of procedure, but a complete rejection of it. The whole point of a procedure is that its tried and tested and safe, and as long as whoever responsible, follows that procedure, then it should be ok. But with these government departments... I wonder if there even is a procedure. All these government departments are so badly managed, I wouldn't be surprised if they didn't even know who was responsible for all this.

Indeed, someone does have to have access to it. But any half-decent security protocol starts from the premise of locking everything down tight against any practical and economically feasible threat, and then only opening up access to those that need it, and even then, only the type of access that they need. The ability to copy an entire departmental database onto CD simply should not be available to "junior officials". Yes, you put in place processes and procedures that define what sign-off you need to get to do this, but you lock it down so that people that shouldn't have access beyond a given level can't access it beyond that, regardless of whether they follow or break rules.

Those at a systems level, such as those creating backups, didn't ought to be liaising with other departments and copying data, and extremely tight physical controls and auditing procedures ought to be in place to control the creation, management and storage of those backups.

There is certainly a procedure, acrobat. Some of it, and some of the stipulations, have been read out. They include the requirements that any such data transfers must be encrypted, and must be sent via secure courier. Those procedures were ignored. That's why systems should be designed to prevent such breaches happening. Where's the lockdown, or physical removal, of optical drives. Where's the monitoring software, that alerts a system manager of an attempt to breach that security? Where's the monitoring, by management, of copies made and sent out?

Whoever specified the basic design of a system designed to carry data as important as 25 million people's personal records and bank account details either didn't have the first notion of what they were doing, or were grossly, and probably criminally, negligent in how they did it.

With all the mismanagement, incompetence and everybody's lack of caring though, that piece of paper is just as likely to end up put in a bin and left out back by the bins for someone to rummage through and uncover all kinds of goodies.

Clearly, there's a risk. But it's nowhere near of the same order. But nothing is entirely safe.

But look at the comparison. On the one hand, you have a handful of surgery office staff dealing with these paper records, and on the other hand, you have 300,000 people in offices all over the country with access to vast quantities of computer data that they have either no need to have access to, or very little need indeed to. I don't know about you, but I'd much rather risk a security breach by one of half a dozen local office staff and a bit of paper than 300,000 anonymous workers not knowing or caring how to handle computer data.




Note: I said above that basic security requires locking down against again practical and economically feasible threat. Nothing can be 100% secure. For example, if armed intruders raid the place and physically remove PCs, you have a level of threat that would require sufficient security resources as to be totally disproportionate to be risk. So as not to be picked up in a pedantic way by someone pointing out the implications if I'd just said "locked down totally securely", I'm pointing out that there's no such thing.

So, stage 1. Consider the data you're securing, and how valuable and at threat it might be. Step 2. Evaluate and implement sufficient security to meet that level of threat for that level of data sensitivity. You do not just make up a rule, stick it in the staff manual and tell staff to "read that", and assume everything will be done properly. That's PART of the process, but for data of such sensitivity as this, it's woefully inadequate against simple error, let alone any malicious intent.

Consider, we now have an entire criminal class that's fully aware there's vast amounts of extremely sensitive data sitting on PCs in government buildings wholly unsecured. How long is it going to be before some "junior official" gets offered £100,000 to run off a CD or two on the quiet, and succumbs to the temptation? I'd put money on it that unless the government get a grip on this, and fast, that it WILL happen - if it hasn't already.

And it isn't just this one Child Benefit office that'll be a target. It'll be every benefit office in the country, every HMRC office, every local housing department, every community charge department, all sorts of offices in town halls all over the country and every central government function holding these colossal data collections. How long is it going to take to audit security on all these, let alone implement any necessary upgrades. If at least some data doesn't get misused in the meantime, I'll be flabbergasted. Gordon Brown's much-vaunted review is either, like most such reviews, a PR exercise primarily intended to make it appear the government is doing something until attention fades and we all forget about this in the light of the next cockup, or it'll be a pointless exercise in reviewing just how wide open the stable door was, some considerable time after the last escaping horse faded over the horizon.

[Stoo]

I've spoken to a friend who works for the same agency, but elsewhere in the country, apparently it is a dedicated collection and separate processing, and *never* gets mixed with the public's mail..

The discs were placed in the internal post which is picked up by a dedicated courier and taken to a dedicated sorting centre. The only place it will be is another HMRC or government office. It was not run down to the post box on the corner with a stamp stuck to it and cast into the abyss. I'd lay odds it's at Audit Office somewhere as they seemed remarkably casual about reporting it not received in the first place. It's not going to have got into the hands of the criminal underworld unless the courier knew exactly what it was and sold it *NOT LIKELY*.

So the whole "in the post" thing has been blown completely out of proportion, but as you say, the system is obviously missing some checks and balances if an office junior can have full unrestricted access to so much private data without someone batting an eyelid..