UK Government Loses 15 Million Private Records 339
bestweasel writes "The BBC reports that a UK Government department has lost discs with details of 15 million benefit recipients, including names, addresses, date of birth and bank accounts. The head of the department involved, HM Revenue & Customs, has resigned and his resignation 'was accepted because discs had been transported in breach of rules governing data protection' so someone thinks it's not a trivial matter. The Chancellor will try to evade responsibility in the House of Commons at 3.30 GMT.
A similar leak of a 'mere' 15,000 records from the same department happened a month or so ago. At that time, they refused to say 'on security grounds' whether the information was encrypted." We just recently talked about Britain's consideration of legal penalties for situations like this. I imagine this incident will weigh on that decision.
25 million now... (Score:5, Informative)
Re:25 million now... (Score:5, Funny)
Re: (Score:2)
And the results, as I'm forced to keep saying... "are very very visible, and completely predictable."
Re:25 million now... (Score:5, Informative)
Re: (Score:3, Interesting)
True in theory. The facts of the matter are these:
1. The UK parliament consists of two houses: Commons and Lords. By constitutional convention, the Lords cannot block legislation agreed by the Commons; they can only delay it for a while and urge them to think it through.
2. Because the British constitution does not separate the legislature from the executive branch, the Prime Minister is the leader of the party with a majority in the Commons. That means that the Commons becomes
Re: (Score:2)
Get your facts straight. HMRC enjoy crown immunity and cannot be prosecuted.
Personally I think it was honourable of Paul Grey (HMRC's Chairman) to resign. And in sharp contrast to the reaction of the Metropolitan police chief, Blair, how's organisation murders innocent members of the public and he feels no need to resign. Or the government in general who never resign regardless of their behaviour.
Re: (Score:3, Funny)
Even if they didn't since they are not a person it's kind of hard to put them in prison.
Personally I think it was honourable of Paul Grey (HMRC's Chairman) to resign.
It's not a good sign when doing the right thing becomes the exception rather than the rule. Wonder if he's taking good care of his P45 and UB40...
Re:25 million now... (Score:4, Funny)
Re: (Score:3, Insightful)
Shutting down the ability to withdraw funds for six months for this reason would also require preventing transfers and check payments for the same supposed reason. Doing this would, by itself, probably destroy the entire economy of any modern commerce based society so
Re: (Score:3, Insightful)
IMHO part of a solution here would be to change things such that the only thing someone can do if they know the bank account details on these records is to put money into these accounts. i.e. that the information is insufficent to take money out of any accounts... Similarly that the only thing that someone can do with your National I
Re: (Score:2)
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
Which IMHO is really the wrong approach. Far better to make the kind of information involved of little value to anyone else.
Which means rethinking the concepts of "identity" and "proof of identity". Such that knowing lots of facts about someone is of little use in impersonating them. There already appears to exist a group of people who's biographies are easily available who are not constantly plagued with impersonation.
Re:25 million now... (Score:4, Interesting)
Of particular interest is the fact that it was sent twice. Once again, by recorded delivery, after the initial package was lost in transit.
Re: (Score:3, Interesting)
How can you be shocked? This is government we're talking about... doesn't matter the country. As soon as you give one group of people anywhere the power to run the whole show, they break down into three categories:
Re: (Score:3, Informative)
Three times! (Score:5, Insightful)
The real WTFs here are
Ok, it's probably worse than that though.
Re: (Score:2)
Re: (Score:2)
Re:Three times! (Score:5, Funny)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:2, Informative)
Re: (Score:2, Funny)
Am I right to surmise that's another American expression with which I am unfamiliar, roughly equivalent to the contemporary British colloquial usage "twat" or "arsehole"?
Re: (Score:2)
Let them eat cake.
Re:Three times! (Score:4, Insightful)
Re: (Score:2)
Receiving child benefit you mean. ie. you have at least one child.
Irrespective, I wonder how long before we can expect to see the
Re:Three times! (Score:5, Informative)
Re:Three times! (Score:4, Informative)
It's Child Benefit, not 'the dole'. Child Benefit is paid to the primary carer of all children in the UK, and is not means tested. According to the article, 7.5 million families are affected, which from the figure of 25 million people, results in an average of 3.3333 people's details per family.
Re: (Score:2)
Apparently, it was sent via normal post, without recorded delivery.
Not quite - it was sent by an internal courier service, provided by TNT. It seems however that the service did not include step-by-step tracing of the package's progress and TNT don't know what they've done with it.
Had it been sent by normal post, it would make absolutely no difference whether it had been sent by Recorded Delivery or not. Recorded Delivery just gets you a signature at the point of delivery, so that if there's a dispute at a later date you can prove (up to a point) that the item arrived.
Re: (Score:2)
(Obviously not yet... but I suspect a whole lot of ISOification, COBITisation and ITILement will heading their way real... soon... now. I wouldn't wish that on my worst ene
Re: (Score:2)
He's having a shit week, what with Northern Rock potentially costing taxpayers half a billion, and now this fiasco.
How do you lose 15 million sets of personal data in the post?
Don't the government have couriers for this sort of thing?
However, I don't think he'll be doing the honourable thing and resigning - none of these second-rate ministers ever seem to take responsibility for anything done under their 'leadership'.
The only time they resign is when they're caught shagging or with suspect fin
Re: (Score:3, Interesting)
"As we stand at present, every taxpayer in Britain has something approaching £900 of their money at stake in this small mortgage bank following the £24 billion loan (which excludes the less controversial £18 billion in deposit guarantees).
When Tony Blair was Prime Minister he was widely and rightly criticised for squandering £800 million on the Millennium Dome. This Prime Minister and this Chancellor have invested the eq
For crying out loud (Score:3, Informative)
heres what vince cable had to say:
"As we stand at present, every taxpayer in Britain has something approaching £900 of their money at stake[1] in this small mortgage bank following the £24 billion loan (which excludes the less controversial £18 billion in deposit guarantees).
You and Vince Cable need to go learn where money comes from.
It's a bank loan from the central bank. Not a penny of money you have paid in tax has been given to Northern Rock. Not a penny of government borrowing has been given to Northern Rock.
[1]I'm a LibDem supporter and I don't like Fractional Reserve Banking but this is just complete bollocks. Vince clearly has no clue where this money comes from, which I find almost as worrying as the fact that the Chancellor of the Exchequer also continually refers to
Re: (Score:2)
Re: (Score:2)
Or rather, these days, he typed it into a computer screen, so literally, from his finger tips.
Re: (Score:2)
I understand that tax doesn't get paid into a single large government bank account, from which they have removed this
Re: (Score:2)
Enlighten me please
The Bank of England simply created the money as an entry in a ledger. Then gave it to Northern Rock, they took NR's mortgages as collateral for the associated debt. This is what banks do.
They can just 'print' it of course but that's just devaluing the currency currently in circulation.
Yes, basically, that's what loans do. These £24 billion loans would be inflationary if they weren't primarily replacing already existing loans from other banks which are no longer willing to lend on the money markets.
At no point did any of this money pass through the government coffers, the taxpayer didn't contribut
Re: (Score:3, Informative)
I hear this bandied about time and again, but there is no way the BofE handed over £24 billion to Northern Rock. It doesn't have £24 billion of loose change for a start, and it isn't taxpayer's money. What will have happened is where the BofE
Re: (Score:2)
I dont find it the least surprising. I find it more amazing that anyone can actually believe this isnt an everyday occurance; they must never have worked in either IT or a government run organization.
The only surprising part is that a) it actually reached someone that high and b) that someone in the middle didn't immediately slap a 'national-secrets cover your ass and throw anyone blabbing in jail' order all over it. There must have been a drast
Re: (Score:2)
Re: (Score:2, Insightful)
And these are the clowns I'm supposed to trust with all my personal information in their joined-up-mega-database-and-ID-card scheme?
Yes.
And this is precisely the point that needs to be made. Whenever governments start throwing around words like "central" and "database," you need to point to events like this and ask "have we fixed this sort of thing yet?"
Until the answer is a resounding (and verifiable) "YES," I'd ask my government to keep their noses out of my personal information, thank-you-very-much.
Re:25 million now... (Score:5, Insightful)
Re: (Score:2)
But it's fairly easy to lose that amount of data. The actual amount of information for each person could easily be stored within 256 bytes. Even uncompressed, that would only be around 6 gigabytes of data, which could be stored on a couple of DVD's, which is probably what they lost.
Re: (Score:2)
You receive child benefit if you have a child. That's it, not about being poor.
Re: (Score:2)
If you let people have a tax break, people who don't deserve it will fake it, whereas it is harder to be a benefit fraud.
yeah, it'll weigh on them (Score:3, Interesting)
Just watch and wait.
Re:yeah, it'll weigh on them (Score:5, Funny)
That should read 'on job security grounds'
Re: (Score:2)
Re: (Score:2)
It makes me worry about who else has access to which servers co
And they expect us to trust them... (Score:5, Insightful)
Re:And they expect us to trust them... (Score:5, Funny)
Re: (Score:2)
And one of these? [badscience.net]
15 or 25? (Score:2)
Anyway, Names and phone addresses aren't really that hard to get, but to have your bank account information compromised must SUCK.
Of course, banks should require more than that to allow a withdrawal. Its a lot easier to put money into an account than to take it out.
Re: (Score:2)
Eh? The English have been using the metric system for a very long time now - do you mean Imperial to Metric conversion?
~Pev
Re: (Score:2)
For all practical purposes, the English are still using the Imperial (that's Imperial England mind you, so your correction is rather indistinct anyway) system, and will likely continue for the foreseeable future. In the past few years they've declared that certain types of trade go
Trust them with the national ID card program now? (Score:3, Insightful)
Was this data loss deliberate? (Score:2)
Trust the Government (Score:5, Insightful)
The idea of burning an unencrypted copy of your sensitive data to a DVD and handing it to a random delivery company should horrify even the most incompetent sysadmin or DBA. Apparently no one in HM Customs & Revenue thought anything of it.
These are the sorts of people who want to build a massive database of all our personal details and tie them to ID cards. They tell us the data will be "perfectly safe". I wouldn't trust them to run a mail server.
Re: (Score:2, Informative)
Re: (Score:2)
Actually I'd say it's representative of the competency of large organisations in general. Just think about how easily your email address gets around once you've given it to a few companies who say they'll never disclose it. The fact that government entities tend to deal more with information about people whom the government governs, that they're not suppo
Re: (Score:2)
I worked at a large software corporation a few years ago, and was amazed to discover that master CD images were sent to the duplication plant by courier. To this day, I do not know why. The duplication plant was owned by the same corporation and was connected to their global intranet along with the office I was working at. Sending the files electronically w
Re: (Score:2)
At least the data was encrypted this time - or at least 'password protected' according to the Beeb article.
"two password protected discs" does not necessarily imply the use of encryption.
...or at least crackable b
What we do know is that the individual(s) that sent the discs weren't overly concerned about the security of the data they contained. Pure speculation, but if the same individual(s) also chose the password, it probably isn't very strong either (and probably wasn't delivered to the recipient in a safe way).
Odds are its one of these:
http://www.eribium.org/wp-content/uploads/2007/01/common_passwords.txt [eribium.org]
Re: (Score:3, Insightful)
But the fact that the whole fecking database went out in the mail is utterly inexcusable. This is akin to me emai
Re: (Score:3, Interesting)
Thanks for pointing this out, which I entirely agree with. I also agree with the first response to your post, which is that it's like this all through the private sector, too. The difference is that government organisations actually have to be directly accountable to people sooner or later, and in that sense they have a much harder time. It's not really a surprise that a lot of people don't want to work for them.
Lately I've been doing IT work for a government department (in New Zealand in my case) which i
EpicRaidGet (Score:2)
Where's the Backup? (Score:3, Funny)
Re: (Score:3, Insightful)
Yes... destroy all the records! Leave 'em guessing!
Seriously, it's preposterous to talk of data retention strategies and forcing people to be part of national data banks when there's absolutely no talk about how you're going to make it secure. I would like to think a data center where personal data for users/citizens is kept would be run more like Fort Knox than the McDonald's Drive-Thru.
Re: (Score:2)
Not quite as bad, but still very careless and possibly in violation of data security laws.
This give us hope (Score:4, Funny)
In a country where you are watched by security camera most of the day, and can be detained without charge for longer than anywhere on Earth, it is reassuring to note that the UK Government is so incredibly incompetent that there will always be a way to escape. No need for tunnels, gliders, or under the floor of a Trabant -- it should be pretty much possible to just walk through the border with a library card altered in crayon.
Re: (Score:3, Funny)
Those who ignore history.... (Score:2)
I wonder how they'll ever figure out how to punish the offenders.... [slashdot.org]
Offering 100,000 - 1 odds it was clear text (Score:5, Insightful)
Re:Offering 100,000 - 1 odds it was clear text (Score:4)
Although, considering that the government is using the time taken to break decryption as an excuse to raise the time they can hold 'terrorists' without charge, they probably want to avoid mentioning that.
Re:Offering 100,000 - 1 odds it was clear text (Score:5, Funny)
Of course (Score:2)
http://www.channel4.com/news/articles/society/health/exclusive+junior+doctors+details+exposed+online/469137 [channel4.com]
and that's currently £6.2bn over budget on implementing a medical record database:
http://www.theregister.co.uk/2006/06/16/nhsit_budget_overrun/ [theregister.co.uk]
Why are UK government IT projects always doomed to failure?
Re: (Score:3, Insightful)
Because civil servants have no idea how to protect themselves from getting shafted by software suppliers, and no financial incentive to learn, essentially. Also, the government has an extreme aversion to suing its suppliers, so the same suppliers do the same thing every time.
Re: (Score:2)
Re: (Score:2)
Oh please. (Score:4, Insightful)
Just wait till it's our DNA and Fingerprints (Score:3, Informative)
Just trying to help (Score:5, Funny)
That's where I always lose things.
They might be there.
wrong, wrong, wrong (Score:2)
Speaking as a security professional, this is fantastic news. I seriously doubt anyone's data is really at risk (the discs are almost certainly down the back of the metaphorical sofa, not in the hands of Dr Evil.) However
Incompetent fools (Score:2)
Moron.
He should have to pay for what it takes to help these 25 million or 50 million or however many people get their lives back in order.
Himself.
No accident, these are (Score:2)
some sh*t is happening. so many 'coincidence' in a small time period means there are no coincidences involved.
Thankyou please to send password (Score:2, Funny)
More to this than incompetence (Score:2)
Why refuse to tell if it was encrypted or not? (Score:3, Informative)
If it's not encrypted, when the files are opened it will look like (or something really obvious):
Joe Public DOB: xx-xx-xxxx 12345 Main Street
If it is encrypted it will look like:
982n5o39y8h5014u9m9p!#$`15235098h14n12#$!@3476bwfSFR2387rn@!#12987ksafdkjD
It doesn't take a fucking genious to figure out if a file is encrypted or not. And its not like they are going to told what alog it is encrypted with if it is encrypted. I can see no reason NOT to tell the public if the data is encrypted or not, so the public knows what kind of precautions or steps may be needed to protect their identity.
Re: (Score:2)
Re: (Score:2)
Of course one can point out that if they didn't take the money, via taxes, from the hard working families in the first place they wouldn't have to give it back, as benefits, and side effects such as this data loss, fraud, etc. could never happen... Such consid
Re: (Score:2)
The debate in parliament was using the words "encrypted" and "password protected" but at no time was the lost data ever accused of being "encrypted". This suggests that they are aware of the correct usage and that the data concerned was not encrypted using any strong algorithm.
Re: (Score:2)
~Pev
Re:Listen up, Brits (Score:4, Funny)
of that bunch of God-bothering homophobic nutjobs. Enjoy the
Turkey.
Toodle pip!
Re: (Score:2)
Re: (Score:2)
And, as an Englishman, I am absolutely delighted with the crown on hearing this news. I couldn't have created a better argument about a national ID database if I'd tried.
Re:Another reason for the bank account monitoring (Score:2)
I think the clue is in the question.
Secure identification? (Score:2)
The solution isn't more government regulation, it's not tying the concept of identity to a couple commonly known pieces of information like date of birth or SSN.
Oh, no, I think heavy regulation is still in order. Regardless of what personal information is being kept about you, anyone with legitimate access to it has a responsibility to keep it safe.
The problem with your argument is that people simply can't remember lots of unique, strong passwords, which is why despite all these secret words and "memorable" numbers all the financial services use, they'll still talk to you when you've forgotten yours as long as you know a handful of obvious (to you) facts that i
Re: (Score:2)
Not a solution to the problem, of course - only a solution to the blame.