Stewart Twynham's IT security diary - The tip of the iceberg

What amazes me the most at the moment is that the 'it was only a junior official' bit is being defended as though it makes everything less worrying. For me it would be infinitely more reassuring if it had happened due to the actions of a senior official - at least that might mean there were some procedures in place to stop anyone getting at the data. The fact that a junior official could apparently do what they did has far greater implications for the data security procedures and culture throughout government.

One of the most important points Stewart (and others) have made is that if it could be done, how do we know it hasn't been done on a similar or smaller scale many times before? How do we know criminals are not currently cultivating links with staff at key government establishments now they know for sure how easily they might be able to get at very valuable data? Is anyone checking the contents of staff's MP3 players as they leave each evening....

Simon Hurst

I absolutely agree that when things go badly wrong it is (almost) invariably not the result of one error, it is the coming together of a whole series of errors.

To argue the opposite is like saying England were eliminated from Euro 2008 because Croatia scored the winning goal in the last 20 minutes of the final game. The problem goes much deeper than that.

If you look at cases of accountants or solicitors convicted in relation to money laundering (as I do) or even at investigations into aircraft crashes, these things do not happen as a result of a single error. They happen after several opportunities to avoid disaster have been missed and a number of rules have been broken.

Have HMR&C been re-engineered too much over the past few years in the name of efficiency and have intangible and non-measurable assets, like the relevant knowledge, experience and common sense of their staff, been lost along the way?

As for the risk of future losses due to fraud, those of us in the 'fraud community' (perhaps I should say fraud prevention community) know that it is all too common for call centre staff to leak confidential information to criminals (either in return for payment, or accidentally, or in response to threats, or because they took the job for the purpose of obtaining and misusing the information). Why should HMR&C be immune from the risk of ID theft via its employees?

David

The police do not take data protection seriously either.

Some time ago some personal information was misused by an agency, I notified the police who were able to find the relevant identifying phone number via BT.

But they then refused to take matters further since they believed a prosecution was unlikely, and refused to let me chase it up by denying me access to the phone number for reasons of ... data protection.

The Data Protection office did not want to take it up due to lack of help from the police.

I think just a shot across the bows of the agency would have helped them put their house in order, as it is they remained unaware that abuse of information was occurring.

I gave up with this story the moment it described the data loss as "catastrophic".

Serious, yes. Needing action, definitely.

Catastrophic. Never, and to say so is to live in a world of fantasy.

No one has died. No one has lost a penny. No one even knows that anything has been lost.

Please, to use the vernacular, "get real" and deal with the issue, but drop the hyperbole.

Richard Murphy

@Richard:
Ovum principal analyst Graham Titterington : "If the data has fallen into the hands of identity thieves, which is unlikely, the entire national identity ecosystem is undermined for two generations."

So, not exactly a catastrophe, just a potential one ...

95% of the lost data is publicly available

Try the census, for starters

Richard

Headlines in today's edition of the Huddersfield Daily Examiner advise 45,000 Kirklees claimants' details- on two CDs! - are missing in transit to DWP by TNT. The CDs were sent in August as part of the normal information which every council is obliged to send to DWP each month and includes names, addresses,dates of birth, NI numbers etc. A review by Kirklees of its communications with government departments following the revelation of the missing Child Benefit data elicited the information from DWP that these discs were still missing. Kirklees council has now ordered a freeze on data transfers to all government departments until they are satisfied that information sent is secure and confidentially received. Quite how they intend to achieve this is unclear.

This does support Mr Twynham's point regarding the vast amount of confidential data which is apparently moved regularly between different government departments with blatant disregard for a basic level of security. It does beg the question that exactly how much lost information is out there? And we are moving towards a national ID card? Perhaps the hackers, forgers and criminals will soon be able to provide us with a cheaper version than Mr Brown's.

Erica

There's a common thread

Outsourced carriers

Stop using TNT

Richard Murphy