Slashdot Log In
UK Gov't Lost Personal Data On 4M People In One Year
Posted by
timothy
on Fri Aug 22, 2008 04:36 AM
from the of-which-they-are-aware dept.
from the of-which-they-are-aware dept.
An anonymous reader writes "The U.K. government has lost the personal information of up to four million citizens in one year alone.
The astonishing figures, calculated by the BBC, added up as Whitehall departments slowly released their annual reports for the year to April.
And the trend has not stopped — in the latest revelation, HM Revenue Customs, which infamously lost the details of 25 million child benefits claimants last November on two unencrypted discs, experienced 1,993 data breaches between 1 October last year and 24 June." (More below.)
"Earlier this week, the Ministry of Justice admitted it had lost 45,000 people's details throughout the year, on laptops, external security devices and paper, and that 30,000 of them had not been notified.
Before that, the Home Office announced it had lost the data of 3,000 seasonal agricultural workers on two unencrypted CDs.
In May, the Department for Transport lost the data of three million learner drivers. Other data losses occurred at the Foreign Office, which lost 190 people's data in five incidents.
In January, the Ministry of Defence said it had lost a laptop containing the details of 620,000 recruits and potential recruits, and some information on 450,000 referees for job applicants. The Liberal Democrats have called for 'data guardians' to be appointed to monitor the government's handling of information."
Related Stories
Firehose:UK gov't lost personal data on 4M people in 1 year by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Another USB stick has gone missing (Score:3, Informative)
Re:Another USB stick has gone missing (Score:5, Funny)
Well obviously if those 4 million people have nothing to hide, then there's nothing to worry about, right?
Parent
Re:Another USB stick has gone missing (Score:4, Insightful)
As an alomst certain side effect, somewhere there's a very pissed off unemployed seasonal worker who's still trying to get his driving license...
Parent
Re: (Score:3, Informative)
Good work Slashdot.
I submitted this story hours ago and not even a mention of the recent case in this non-article.
http://yro.slashdot.org/firehose.pl?op=view&id=837685 [slashdot.org]
Encryption (Score:4, Insightful)
Encryption nowadays is so damn easy to use. Why don't they?
Lazy? Incompetent? (Score:3, Insightful)
Re:Lazy? Incompetent? (Score:5, Insightful)
Or sending passwords over IM/Email/plaintext.
try to explain about packet sniffers and you'll get a reply along the lines of "oh security would be down like a ton of bricks on anything like that". Cause packet sniffers are easy to detect as we all know.
the standard here is "security handle that so I don't have to think about being secure" when in fact security can't handle that unless people take reasonable measures themselves.
Parent
Re:Encryption (Score:5, Interesting)
User resistance.
I've been involved over the last couple of months with implementing fixed disk, removable media & email encryption at an NHS trust in the UK and the amount of complaints and stupid problems we've had from users is astounding.
Most of them go straight to one of the directors to complain, before kindly informing IT that they've done it, so we'd better hurry up and fix the issue. Then staff go out of their way to find ways around the encryption, exerting far more effort than it would have taken just to use it in the first place.
Thankfully we've got a CEO & IT director who don't want to be the ones going on TV to explain how they lost X thousand unencrypted patient records and so are making sure the policy is enforced, but I can easily see how "weaker" management would allow lapses to keep staff happy and risk this kind of data leakage.
Parent
Stupidity or Malice? (Score:5, Insightful)
That is almost 10 breaches a day. That is not a leak. That is a fucking river .
I am reminded of a pretty good saying. "Once is happenstance, twice is coincidence, and three times is enemy action". With data breaches this prevalent there needs to be investigations, firings, and serious consequences for all involved. At least fire everybody in charge at once.
Re:Stupidity or Malice? (Score:5, Insightful)
In the US, the Fed could leave to the states a vast swath of functions currently bogging down DC, making everyone more secure in a variety of ways.
Parent
It's principally Government incompetence. (Score:4, Insightful)
This is the government that wants to have us give us our biometric data, impose the use of id cards and keep DNA records on us all.
Parent
Re:It's principally Government incompetence. (Score:4, Insightful)
Sorry, but how can someone misplacing a USB stick be attributed to any of the things you listed?
If I.T. data security needs tightening (which it obviously does) then how about actually changing something in some way related to I.T. data security?
Rather than actually fix the problem at hand though, it seems - as always - everyone would rather copy the mainstream media's cries of wolf and descend into the typical "the world's going to the dogs and it's all someone-but-me's fault" farce.
That's a great attitude to take if you want viewers and readers (everyone wants to hear about problems with someone-else to blame) but it's not very good if you actually want to fix the problem at hand.
Oh well, that's just a humble engineer's opinion, it may be a little rational for the arena of politics & popular opinion.
Parent
Re:It's principally Government incompetence. (Score:4, Insightful)
I don't expect senior civil servants would ever get their hands dirty enough to be in a position where they have any data to lose but it is there job to ensure everyone else reporting to them understands and is complying with sensible data security procedures. If they aren't doing this then it is their fault as much as it's the fault of the contractor who actually lost the USB stick.
The use of ID cards might stop this sort of data loss but I don't believe for a a second it will do. First of all I think the company who has just lost this data is one of the ones involved in the ID card scheme and they obviously don't have data security very high on their agenda. Secondly the actual database may be more centralised but the data its self is going to be available to virtually every single government employee in the country along with any private company who fancies it so the chances of that reducing the amount of data leaked out don't look very good to me.
Parent
incompetance and money 'saving' (Score:5, Informative)
The UK has all but handed over the handling of citizens data to lowest bidder IT companies.
I've experienced this first hand. I worked in a hospital where total access to everything on the hospitals network was available without even typing in a password if you used certain machines which were 'configured for ease of use'. You'd think those machines weren't reachable by member of the public, or externally, but you'd be wrong.
They aren't unique either.
Parent
Re:Stupidity or Malice? (Score:5, Insightful)
No offense, which I am not sure goes both ways here, but your statement is the one that is a little naive and uninformed. The person responsible is the CIO, or director if you will. If you are going to have computers, databases, and information processing in any organization you need a CIO and an IT department. It is the responsibility of those people to create and enforce sensible data handling policies and to comply with any governmental regulations governing that data. Now CIO may not be the proper term, but I am sure there must be some sort of department that deals with this. There usually is, and if not, then the UK's problems are a lot bigger than I thought.
Your assertion that I am stupid, or that my recommendation to fire the CIO is stupid, is just inflammatory and does not support your position that these people should escape unscathed.
This is not the loss of a single USB stick, but rather the pervasive problem of data loss throughout the entire government of the UK . As I stated, that is about 10 incidents per day. The CIO (or equivalent) is wholly responsible. After the first couple of incidents, the CIO should of taken action through the implementation of security and data handling technology and policies.
Whether or not it is popular to blame the government for problems is irrelevant here. The government is responsible for safe guarding the data and it failed, and it is a spectacular failure at that. Blame is required here, and in fact, the lack of blame here would be as bad the problem itself. Your claim that is irrational to assign blame to those responsible is astonishingly irrational in of itself.
You really must be kidding here. You are not serious are you? This is a huge disaster. You are attempting to downplay the potential for harm here, while completely ignoring the massive scope and scale of the problem. Evidence of any consequences has nothing to do with problem itself. My reaction is not unique, and to say it is over the top is indicates an indifference and apathy on your part to the problem itself.
:) Do better or next time we might get more serious". Why would you want to treat this lightly and keep the same people, responsible for such widespread breeches, in their positions?
There needs to be a review of all the policies and laws pertaining to the handling of sensitive data like this. This is a big deal considering it's scale, and the "directors" do need to be removed and policies have to be created with consequences for failure.
Otherwise, as you seem to be suggesting, we just give them a slap on the wrists and say, "naughty little directors! You little buggers
Parent
Just you wait... (Score:5, Insightful)
Utterly, utterly, wrongheaded; but just plausible enough to work...
Re: (Score:3, Insightful)
Close your eyes and imagine John Hurt from V for Vendetta screaming that at the top of his lungs in a speech. Gives you tingles up your spine right?
Back to dumb terminals (Score:5, Insightful)
It was actually 29 million, not 4 million (Score:5, Informative)
Re:4000000? (Score:5, Interesting)
How do you propose that they "prove competence", as far as I can tell, that seems to be what's happening, some organizations, have proved their competence, others, such as this, have failed.
Granted, information distribution isn't exactly new, however the method and/or media used to transfer the information is/has changed, and is being increasingly adopted, so they all have to figure it out.
Besides, I don't think it's "humanly" possible to transport this amount of information with absolutely no spillage at all.
That said, I'm not really making excuses, as even 4 Million is much larger than it should be, that's what, 6 to 7% of the population? That's basically epidemic, and is certainly pandemic given that the UK isn't the only one.
Parent
Re:4000000? (Score:5, Interesting)
One suggestion would be to
Sure it is. You need proper procedures and regulations. Sure, if you put it on a laptop or memory-stick, and let your employees carry it around without any oversight, accidents will happen. But if you treat the information as valuables, all will be fine. Money-transports don't usually go around losing money.
The trouble is that there is no real accountability for losing data. If someone loses 4 million euros, they know somebody will be pretty unhappy. But losing the private records of 400 people, which given todays identity-theft-plagued society could easily result in damages of 4 million euros, is somehow not taken as seriously.
Parent
Re:4000000? (Score:4, Insightful)
There is no point fining the government in these circumstances, because when they lose almost half the population's details, those people just pay themselves and everyone else effectively gets fined. I didn't vote for for the b*****ds in the first place, and neither did most other people, so I would consider such a fine to be rather unethical on several counts!
IMHO, the only effective response in cases like this is personal liability: someone in charge has to have personal consequences that directly and seriously affect them in the event of a breach. I'm not necessarily talking about jail time or million pound fines for accidental breaches, but something equivalent to barring them from holding any public office, or in the private sector from acting as a company director, for a significant period of time would seem appropriate. Deliberate breaches are a different matter, and I have no problem with major fines or jail time for anyone who deliberately and maliciously abuses access to personal information. Data protection is a serious issue, identity theft is one of the fastest growing crimes there is and also one that is deeply unpleasant and inconvenient for the victim, and it's about time our legal system stopped treating it like a minor misdemeanour.
I believe there should also be a law requiring that any government procedure that can compel a citizen to provide information and/or money or other material goods must come with a corresponding appeal procedure that provides for correcting errors quickly, easily and at no cost to the victim, under judicial oversight, and again with direct personal penalties for anyone responsible for setting up a system that gets things wrong without making adequate provision for correcting the inevitable mistakes.
Bottom line: heads have to roll at high levels before anything will change. As long as anyone who screws up still gets to go to work tomorrow and hide behind corporate responsibility or crown immunity, nothing will change.
Parent
YOU'VE WON AN XBOX 360! (Score:5, Funny)
During the employment screening process, have popup ads appear on a screen during the personality/background info/aptitude test. If the applicant clicks on one, a trap door in the floor opens and flushes them back out on to the street.
Parent
Re:4000000? (Score:4, Interesting)
Parent
McKinsey hates freedom (Score:5, Insightful)
I don't hate my country, but I do dislike those aspects of the private school and class system which causes the people in power to be conformist and inward looking, and ready to believe any snake oil salesman in a Boateng suit. People mock Prince Charles, but at least he is prepared to get into trouble by listening to independent experts and then asking questions about the status quo and the desirability of corporatism. The Government appoints independent experts, and then when their conclusions conflict with those of the editors of tabloid newspapers, or McKinsey, they reject them. The inevitable result is pissed off staff and managerial incompetence. As one of my bosses used to say about organisations like McKinsey, when did you last hear of a great world manager? Taylorism takes no account of leadership, which is what gives morale and a sense of direction to organisations. And the only way to bring in things like data security is to bring back a spirit of public service - which means leadership.
Parent