Slashdot Log In
Losing Personal Info On A Laptop Could Get You Charged
Posted by
Zonk
on Mon Nov 19, 2007 07:10 AM
from the going-to-need-handcuffs dept.
from the going-to-need-handcuffs dept.
E5Rebel writes "The UK's data protection watchdog has called for legislation that would punish corporate or government officials with access to the public's personal data ... who lose it. Unencrypted laptops with this personal information which are lost or stolen will see their owners facing criminal charges. 'HM Revenue and Customs is among the organisations that have recently suffered high profile data security breaches as a result of laptops being lost or stolen. The HMRC laptop containing taxpayer data was encrypted - but other organisations have often failed to encrypt their machines.'"
Related Stories
[+]
UK Government Loses 15 Million Private Records 339 comments
bestweasel writes "The BBC reports that a UK Government department has lost discs with details of 15 million benefit recipients, including names, addresses, date of birth and bank accounts. The head of the department involved, HM Revenue & Customs, has resigned and his resignation 'was accepted because discs had been transported in breach of rules governing data protection' so someone thinks it's not a trivial matter. The Chancellor will try to evade responsibility in the House of Commons at 3.30 GMT.
A similar leak of a 'mere' 15,000 records from the same department happened a month or so ago. At that time, they refused to say 'on security grounds' whether the information was encrypted." We just recently talked about Britain's consideration of legal penalties for situations like this. I imagine this incident will weigh on that decision.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
About Bloody Time (Score:5, Insightful)
Re:About Bloody Time (Score:4, Insightful)
However, I believe a lot of the cases where sensitive data is lost, happen because the person losing them wasn't educated enough about the risks involved and the security needed to lower the risks. In this case their employer is fully responsible and they should be held fully accountable for their actions. By paying huge sums of money to the people who's data they lost for example!
Countries should extend exisiting laws and create new ones that make this a very serious crime, as the implications of losing sensitive data can be quite tremendous to the person who's data is lost in today's world.
Parent
Re:About Bloody Time (Score:5, Insightful)
Parent
Ignorance as a defence (Score:5, Informative)
The problem with the whole "ignorance is not a defence" argument is that, as convenient a sound-bite as it makes, it's still an unreasonable cop-out.
No-one knows what every law in the country that applies to them says. Even if they did, many people could not understand the legalese without assistance. There have been demonstrations that show that even MPs who approve our legislation can't complete their own tax return correctly. Our own government frequently fails to follow its own laws because some official didn't know what some other official was doing — and that's their full-time job!
It may be a legal convenience to say that ignorance is not a defence, but ethically it is a very dubious principle if it isn't matched with an effective education policy that makes it a reasonable assumption that everyone should know and understand all the laws that apply to them. If you construct a system where no-one can know it, and then say that not knowing it is no defence, then you are simply criminalising arbitrarily, and that is universally the mark of a legal system gone too far.
Parent
Re:About Bloody Time (Score:5, Informative)
What a vague rant. Near as I can tell, you disagree with punishing people who break the law, think that when people break the law there's "no recourse", and confuse media hysteria over gun crime with the actual facts (the whole of the UK has about fifty fatal shootings per year, hardly a crime wave).
Did you actually have a point, or did you just want to rant against the English? Do you even know the difference between England and the UK? I see no reason to single out the English for UK policies.
Parent
Re:About Bloody Time (Score:5, Insightful)
Oh what, you don't like protection money rackets? If only there were a group of people who could protect you from injustices like that...
Parent
Re: (Score:3, Insightful)
To respond to your point about "fine-working legislation", we are doing quite nicely thank you very much. Crime has in fact fallen, but you would never know it from the hysterical media reporting, and for that reason, crime is, alas, perceived to be on the rise. It is in fact thes
Re:About Bloody Time (Score:4, Insightful)
Parent
Somewhere it it's odd.. (Score:5, Funny)
Surely we should take intent into consideration (Score:5, Insightful)
But what I can't fathom is the animal-like need for vengeance against the poor government employees who lost the data as the result of one of these accidents. Unless we can show that the person was deliberately taking the information off-line and then staging the theft, how can we possibly in good conscience ruin this person's life just because he forgot a rule. These aren't the Queen's guards, we're talking about. These are people who work for the government (take that in any way you want).
Why are we not holding banks liable for having a system that encourages identity theft by making it as easy as stealing a laptop? Or holding wallet makers responsible for not securing wallets with anything stronger than a clasp? The reason is because we realize that there are limits to the abilities of these companies that can't be stretched much further. Government employees are mentally stretched to their breaking points. How dare we threaten them with jail time when we can't expect any more from them in the first place?
Might as well squeeze blood from a stone.
Re:Surely we should take intent into consideration (Score:5, Insightful)
Parent
Something *everyone* needs education in. (Score:5, Insightful)
A couple of examples ;
My wife wanted to use my credit card (she doesn't have one) to pay the fees for a educational conference. The conference organisers had a system for collecting payment ; just email all your credit card details (in plaintext) to the secretary! She looked a bit surprised when I refused. When I explained that it would be like writing my card information on a postcard, with a postal service composed of, well, anyone, who would be at liberty to take "photocopies" of the postcard anywhere along it's journey, she was a little more understanding. (I made her telephone the person concerned instead). Perhaps if the iconography of email programs was more "postcardy" instead of "envelopy", this would happen less.
Our office VPN is secured at the concentrator by two-factor authentication. Each user is issued an RSA SecureID token. Last year, they issed the PIN correctly ; the administrator pushes a button and says "NOW" and you remember the first four digits the token is showing - and then you are only person who knows it. This year, they preset them all and mailed them out. Email, that is. In plaintext. This undermines the basic security of the system ; anyone who gains access to those emails now has a list of PINs, most people clip them to the same lanyard as their security pass, identifying the token user. Or even easier, they can do what I did, walk into the office, say "Hi there, can I have my new token...." only to be waved towards the table where they ALL sat, in named envelopes, without my ID even being checked. And this is from people who are supposed to know about information security.
Hopefully the stick of criminal penalties will be wielded diffidently. But people have to shift their perceptions ; data on paper is treated with reverence and locked in a safe, when the data on the computer is left lying around for literally anyone to get hold of. Perhaps this attitude comes from the ease with which computers generate the data in the first place ; it feels cheap and thus "disposable". Which seems silly to a person who knows that a properly managed digital signature is MUCH more secure and reliable than its paper equivalent, but is counter-intuitive to anyone else who still thinks the gold standard is a notary.
Parent
Re:Surely we should take intent into consideration (Score:4, Insightful)
The government department has the responsibility for making sure the systems are secure enough for the data they are processing. That includes providing encryption on laptops that process privileged data.
If the employee turns encryption off, or uses a bog standard laptop for convenience when they should have used an approved hardened laptop, then the employee should face the consequences. Too many times employees put their own convenience above the public, or try to say they are too busy to find out what kind of obligations they have when handling confidential data.
Parent
Why should we? (Score:5, Insightful)
Why are we not holding banks liable for having a system that encourages identity theft by making it as easy as stealing a laptop? Or holding wallet makers responsible for not securing wallets with anything stronger than a clasp? The reason is because we realize that there are limits to the abilities of these companies that can't be stretched much further. Government employees are mentally stretched to their breaking points. How dare we threaten them with jail time when we can't expect any more from them in the first place?
Perhaps they should have thought of that before legally compelling me to disclose sensitive private data that could be used to ruin my life if it was abused or fell into the wrong hands?
If the situation is reversed, and a member of the public fails to follow procedures that have been shown to be too complicated for the average citizen to get right, the government has no trouble with imposing instant fines instead of allowing people to fix honest mistakes.
I have absolutely no sympathy for the government here. They make the rules. No-one is forcing them to make laws like this, and no-one is forcing anyone to work for departments with lax security. If you make a pact with the devil, expect to go to hell.
Parent
Charges for stupidity... (Score:3, Insightful)
I'm not saying the punishment should be high, but just as killing someone by not being careful enough is homicide, I think this same idea should be applied in this case.
In any case, if the loss of data has been purely accidental, with no lack of carefulness by the perpetrator, there should be no punishment at all.
Enforcement? (Score:5, Insightful)
Good idea (Score:5, Interesting)
Re: (Score:3, Insightful)
Re:Good idea (Score:4, Insightful)
Agreed. It's not that people don't think about it; I work in IT, and we think about it all the time. But it's very difficult to actually enforce meaningful security if nobody understands the point of it. It simply gets seen as a hassle imposed by IT because they're control freaks trying to make themselves look important to the rest of the organisation. The top management doesn't care; all they hear is the hassle it's causing their Executive Directors when IT won't let them log on to the VPN while they're at the airport because they left their RSA token at home.
Unfortunately, if you set up good security and the users don't understand it, they'll circumvent it: the private key used to unlock the laptop's encrypted drive will be stored on a USB stick with the laptop, along with a sticky note with the user's password and their RSA SecureID token. So not only do people resent you when you try improve security standards, but they actively seek to undermine it. Even a single crappy password like "Wednesday1" is better than having everything you need to access sensitive data neatly packed with the laptop.
Therefore, to get proper security, everyone needs at least an intermediate level understanding of computer security. That's a massive undertaking for most organisations, where people's main job function isn't anything to do with computers. Most people don't want to understand computers at all, they just want to use them. Kind of like telephones: most people don't even consider for a moment if their phone is secure or not, and have no interest in learning how the call they make from their office phone gets from their desk to the other side of the country.
Really, before you even have a shot at putting in place meaningful, consistent security, you need a long-term commitment from all levels of management to establish and maintain strong security and train the staff to use it properly, even when it causes inconveniences. Given how much trouble we have getting people to use the records management system properly, this actually seems like a very high mountain to climb.
The possibility of being embarrassed because of data theft isn't anywhere near a strong enough motivation for most organisations. Therefore, legislation like this is probably a good move -- though I think it should apply to any organisation that collects personal information, government or not. But you have to start somewhere.
Furthermore, it shouldn't require actually losing data before there's a possibility of punishment. One should be able to report agencies and companies that aren't taking their duty of care seriously, and report them. Otherwise it's still easier for a lot of organisations to say "it won't happen to us" and only pay lip-service to information security. So, if your bank is using dubious client-side "security", report them!
There'd be a lot of short-term pain, but long term gain. It might even slow down the pace at which computers take over the world, and maybe us folk that program and administrate them can catch the fuck up with what users are expecting from it all.
Parent
There's negligence and there's no choice (Score:5, Insightful)
1) Create sensible security rules that should keep the data safe, even when on a notebook. Current notebooks are fairly easy to secure to the point where theft of the notebook doesn't mean theft of data. That includes, but is not limited to, choosing secure hardware and software, limiting laptop use to work, reducing user rights to the minimum for operation.
2) Train people and give them a fairly heavy "or else" to follow those rules.
3) If they follow the rules and still have their notebook stolen, no problem. If they're careless, throw the briefcase at them.
What I want to see is the government as a whole to react to the threat. Not finding a scapegoat to take the blame, sack him and go on with the same shit.
Holy motherboard of IT gods... (Score:5, Insightful)
I believe that you will find that in more than 90% of such cases, the end user was following the given policies for the data they were using. We ALREADY have laws for how that data is to be treated. Breaches of those laws must be processed before we look for new laws. I cannot cite any specific regulations, but financial institutions and basic corporations now have legal requirements on how to treat privacy information. SarBox law in the US, and I'm sure that the UK has similar regulations. The fact that the information is getting 'lost' to someone in the public is not indication of criminal activity, but lax processes in the organization for which they work. Laptop theft is rampant, some would say, because they are easy to take. Often because the theft is easy, and done by someone who has no idea what is on the laptop hard drive.
So, lets just have guidance on how to process the legal side of such breeches. Find out what safeguards were in place, if they were being used, if the end user was obviously ignoring them etc. There is seldom need for new laws, simply better processes or guidelines for using what currently exists. Remember, tax evasion was used to get some mobsters? Misuse of government equipment? How about dereliction of duty? There are tons of ways to punish someone without creating new laws. I sometimes think that people would enact a law to prohibit large turds if it would stop the problems with the outdated treatment plants. Look at all the silly laws that are still on the books. Do we really need a new law that will be useless in 5 years?
Politicians and the Internet.... oil and water.
let's make it illegal to get a virus, too (Score:4, Insightful)
If a PC (or laptop, or a server)that holds confidential data is audited and shown to be vulnerable to external attack, then this is just as negligent as leaving unprotected data open to theft and should be treated in the same way.
It's not actually their fault anyway... (Score:4, Insightful)
Securing and encrypting the drive is a job for the organisation's IT infrastructure team, not the end employee. Given that government officials are generally not the most tech-savvy people around, it seems crazy to punish them for something that should already be pre-installed on their machine when they receive it.
Parent
Companies not the Employees (Score:4, Interesting)
Let's face it. I'm sure *a lot* of employees don't even know much about encryption software, let alone which ones to use and how they work. I don't see the sense in blaming an employee that "should have known better" when it's possible that the company didn't provide the tools/training to allow employee to know what to do.
That being said, the employee has some responsibility to bear as well. If they take it to a restaurant and accidentally leave it there, that's their fault. If the company *does* have a policy about encrypting private information and the employee doesn't follow it, then it's the employee's negligence. If the company says, "No private data offsite," and the employee leaves with it on his/her laptop. It's that employee's own fault.
What if the loss is NOT your fault? (Score:4, Insightful)
Ok... hypothetical (but realistic) situation:
What about if your job calls for you to take a laptop that you don't necessarily "want", but it's now part of your job (as a travelling salesman, a consultant, or whatever)? And what if the lunkheads who image that laptop don't bother to put any encryption or other data protection software on it? And you're not allowed to add any "unauthorized software" to help protect yourself?
Guess what? Your employer has made you the IT equivalent of a soft target.
Under the above scenario, it seems enormously unfair to become subject to criminal charges due to the negligence of your employer. Easy for all you critics to say "go get another job"... while that certainly would be the ultimate solution, that's hard to do in an economy where consolidation and right-sizing still rule the day.