UK Government Loses 15 Million Private Records

bestweasel writes "The BBC reports that a UK Government department has lost discs with details of 15 million benefit recipients, including names, addresses, date of birth and bank accounts. The head of the department involved, HM Revenue & Customs, has resigned and his resignation 'was accepted because discs had been transported in breach of rules governing data protection' so someone thinks it's not a trivial matter. The Chancellor will try to evade responsibility in the House of Commons at 3.30 GMT. A similar leak of a 'mere' 15,000 records from the same department happened a month or so ago. At that time, they refused to say 'on security grounds' whether the information was encrypted." We just recently talked about Britain's consideration of legal penalties for situations like this. I imagine this incident will weigh on that decision.

25 million now...

[Sirch]

Or so says The BBC [bbc.co.uk]...

Re:25 million now...

[bloobloo]

It WAS sent by courier.

Re:Three times!

[Anonymous Coward]

This is 25 million people who receive child benefit, which is a small amount paid to people with children under the age of 16. So what it really means is that nearly half the population has children.

Re:Three times!

[amw]

I know such a thing would require effort, but if you were to read TFA you may notice that the loss covers _child_ benefit, not _unemployment_ benefit. Take a step forward. And then note that when the information was first lost, they simply sent a second copy ...

Just wait till it's our DNA and Fingerprints

[MrSteveSD]

At some point, if the UK government gets its way, everyone will have their DNA and fingerprints stored in a central database. How long will it be before some backup hard drive goes missing with all the data?

Re:25 million now...

[Bloke down the pub]

Weren't these the same idiots who just passed a law to "punish irresponsible data loss"?

No, that would be Parliament. The people who lost the data were HM Customs & Revenue. These are two different bunches of idiots.

Re:Trust the Government

[catmandi]

The audit office specifically asked that they be sent only the national insurance numbers - with ALL personal data removed. This was very clearly stated in the debare in parliament. Their requirements for the data apprear to have been in order to set up an auditing algorithm that would allow them to then go on site and inspect the records. They felt (quite fairly I would argure) that the only impartial way to set up the audit would be to pick numbers at random, without any other information about what the numbers related to). The problem here is the fact that one, or at most a handful of people took it upon themselves to contravene exsiting rules (which are obviously unenforceable, since you'd expect the system to refuse to download a non-encrypted copy of the entire database) and deal with the request without actually doing any work (i.e. by dumping all the information).

Whether that is criminal or simply irresponsible is for a smarter person than me to answer.

Re:Three times!

[jonbryce]

Child benefit is paid to everyone who has a child regardless of how much other income they have.

For crying out loud

[Colin Smith]

heres what vince cable had to say:

"As we stand at present, every taxpayer in Britain has something approaching £900 of their money at stake[1] in this small mortgage bank following the £24 billion loan (which excludes the less controversial £18 billion in deposit guarantees).

You and Vince Cable need to go learn where money comes from.

It's a bank loan from the central bank. Not a penny of money you have paid in tax has been given to Northern Rock. Not a penny of government borrowing has been given to Northern Rock.

[1]I'm a LibDem supporter and I don't like Fractional Reserve Banking but this is just complete bollocks. Vince clearly has no clue where this money comes from, which I find almost as worrying as the fact that the Chancellor of the Exchequer also continually refers to this money as "taxpayers money". This 24 billion pounds worth of money and the taxpayer have never crossed paths. Vince is in theory highly qualified as an economist. I'm beginning to wonder just how bad the education at Cambridge and Glasgow Universities really are.

Re:Three times!

[EnglishTim]

You want worse than that? Take a step back... If 25 million records were lost and the entire population of the UK is 60 million, that means darn near half the population is "on the dole."

It's Child Benefit, not 'the dole'. Child Benefit is paid to the primary carer of all children in the UK, and is not means tested. According to the article, 7.5 million families are affected, which from the figure of 25 million people, results in an average of 3.3333 people's details per family.

Re:25 million now...

[segedunum]

"As we stand at present, every taxpayer in Britain has something approaching £900 of their money at stake in this small mortgage bank following the £24 billion loan (which excludes the less controversial £18 billion in deposit guarantees).

I hear this bandied about time and again, but there is no way the BofE handed over £24 billion to Northern Rock. It doesn't have £24 billion of loose change for a start, and it isn't taxpayer's money. What will have happened is where the BofE says "OK, we think you will be solvent and 100% OK and we think you're viable. We're going to create some money that you are then going to pay back to us at a penalty rate."

This is exactly what the lender of last resort system is for, so please, don't give me any of that media-oriented bollocks about how many Millenium Domes you could get for this, OK?

Why refuse to tell if it was encrypted or not?

[ewhenn]

Look... It's not going to help prevent authorized access by keeping it secret.

If it's not encrypted, when the files are opened it will look like (or something really obvious):
Joe Public DOB: xx-xx-xxxx 12345 Main Street .... balh blah blah..

If it is encrypted it will look like:
982n5o39y8h5014u9m9p!#$`15235098h14n12#$!@3476bwfSFR2387rn@!#12987ksafdkjD

It doesn't take a fucking genious to figure out if a file is encrypted or not. And its not like they are going to told what alog it is encrypted with if it is encrypted. I can see no reason NOT to tell the public if the data is encrypted or not, so the public knows what kind of precautions or steps may be needed to protect their identity.