UK Gov't Lost Personal Data On 4M People In One Year 163
An anonymous reader writes "The U.K. government has lost the personal information of up to four million citizens in one year alone.
The astonishing figures, calculated by the BBC, added up as Whitehall departments slowly released their annual reports for the year to April.
And the trend has not stopped — in the latest revelation, HM Revenue Customs, which infamously lost the details of 25 million child benefits claimants last November on two unencrypted discs, experienced 1,993 data breaches between 1 October last year and 24 June." (More below.)
"Earlier this week, the Ministry of Justice admitted it had lost 45,000 people's details throughout the year, on laptops, external security devices and paper, and that 30,000 of them had not been notified.
Before that, the Home Office announced it had lost the data of 3,000 seasonal agricultural workers on two unencrypted CDs.
In May, the Department for Transport lost the data of three million learner drivers. Other data losses occurred at the Foreign Office, which lost 190 people's data in five incidents.
In January, the Ministry of Defence said it had lost a laptop containing the details of 620,000 recruits and potential recruits, and some information on 450,000 referees for job applicants. The Liberal Democrats have called for 'data guardians' to be appointed to monitor the government's handling of information."
Another USB stick has gone missing (Score:3, Informative)
Re:Another USB stick has gone missing (Score:5, Funny)
Well obviously if those 4 million people have nothing to hide, then there's nothing to worry about, right?
Re:Another USB stick has gone missing (Score:4, Insightful)
As an alomst certain side effect, somewhere there's a very pissed off unemployed seasonal worker who's still trying to get his driving license...
Only 4 million? (Score:3, Informative)
I'm still trying to figure this 4 million figure out. The child benefit leak alone lost personal details relating to 25 million people, and that was in October 2007 so still comfortably within a year of today. There have since been numerous other leaks, with anywhere from a few hundred to many thousand people involved. Much of the information has been highly sensitive: not just names and addresses, but classified national security information, information about criminal records, information about people app
Re: (Score:2)
Re: (Score:2)
Was it 25 Million distinct people or just the details of people who filed 25 million claims. I'm not saying that the 4 million figure is correct, but I am saying that I don't think that those 25 million "claimants" are all distinct people
As Far as I know, you're not supposed to (legally) claim for child benefit multiple times.
Re: (Score:3, Interesting)
This is a great point, and it is a pity it is being modded "funny" rather then insightful.
Even if you think you have nothing to hide from the government, and thus they can collect what they will on you, they will loose that information.
And you don't want scammers, fraudsters, identity miss-users and other people to get hold of that information.
So even if you think you have nothing to hide from the government (the people whom you should trust the least (next to corporations) out of society), you certainly wo
Re: (Score:2)
Re: (Score:3, Informative)
Good work Slashdot.
I submitted this story hours ago and not even a mention of the recent case in this non-article.
http://yro.slashdot.org/firehose.pl?op=view&id=837685 [slashdot.org]
4000000? (Score:2, Interesting)
That's quite impressive, I assumed it was a much larger figure given all the stories. Mind you, that's just an estimate, so it probably is a larger figure. I do wish that people entrusted with this type of data, and any other type to be honest, would have to prove competence to be trusted with it.
Re:4000000? (Score:5, Interesting)
How do you propose that they "prove competence", as far as I can tell, that seems to be what's happening, some organizations, have proved their competence, others, such as this, have failed.
Granted, information distribution isn't exactly new, however the method and/or media used to transfer the information is/has changed, and is being increasingly adopted, so they all have to figure it out.
Besides, I don't think it's "humanly" possible to transport this amount of information with absolutely no spillage at all.
That said, I'm not really making excuses, as even 4 Million is much larger than it should be, that's what, 6 to 7% of the population? That's basically epidemic, and is certainly pandemic given that the UK isn't the only one.
Re:4000000? (Score:5, Interesting)
One suggestion would be to
Sure it is. You need proper procedures and regulations. Sure, if you put it on a laptop or memory-stick, and let your employees carry it around without any oversight, accidents will happen. But if you treat the information as valuables, all will be fine. Money-transports don't usually go around losing money.
The trouble is that there is no real accountability for losing data. If someone loses 4 million euros, they know somebody will be pretty unhappy. But losing the private records of 400 people, which given todays identity-theft-plagued society could easily result in damages of 4 million euros, is somehow not taken as seriously.
Re: (Score:2)
The best answer is to attach some simple value to someone's simple private personal data - say £5000, and to be adjusted for inflation in future. Upon loss of their data, the victim must be paid out that amount, along with any future losses of income/monies that they are liable for "on the balance of probabilities".
The
Re:4000000? (Score:4, Insightful)
There is no point fining the government in these circumstances, because when they lose almost half the population's details, those people just pay themselves and everyone else effectively gets fined. I didn't vote for for the b*****ds in the first place, and neither did most other people, so I would consider such a fine to be rather unethical on several counts!
IMHO, the only effective response in cases like this is personal liability: someone in charge has to have personal consequences that directly and seriously affect them in the event of a breach. I'm not necessarily talking about jail time or million pound fines for accidental breaches, but something equivalent to barring them from holding any public office, or in the private sector from acting as a company director, for a significant period of time would seem appropriate. Deliberate breaches are a different matter, and I have no problem with major fines or jail time for anyone who deliberately and maliciously abuses access to personal information. Data protection is a serious issue, identity theft is one of the fastest growing crimes there is and also one that is deeply unpleasant and inconvenient for the victim, and it's about time our legal system stopped treating it like a minor misdemeanour.
I believe there should also be a law requiring that any government procedure that can compel a citizen to provide information and/or money or other material goods must come with a corresponding appeal procedure that provides for correcting errors quickly, easily and at no cost to the victim, under judicial oversight, and again with direct personal penalties for anyone responsible for setting up a system that gets things wrong without making adequate provision for correcting the inevitable mistakes.
Bottom line: heads have to roll at high levels before anything will change. As long as anyone who screws up still gets to go to work tomorrow and hide behind corporate responsibility or crown immunity, nothing will change.
Re: (Score:3, Insightful)
You sure seem to have a lot of faith in laws.
The reason they are not more careful with the data is they don't have to be. The government isn't hurt when it looses your data. They aren't even hurt when they loose your money. I forget what State it is now but they had peoples SSN numbers up on one of their web sites plain as day.
Government bureaucrats are NEVER accountable for anything. (even if they did loose 4 million euros) The best you can do is sue the branch of government and then they will pay that wit
YOU'VE WON AN XBOX 360! (Score:5, Funny)
During the employment screening process, have popup ads appear on a screen during the personality/background info/aptitude test. If the applicant clicks on one, a trap door in the floor opens and flushes them back out on to the street.
thay can and do keep data safe: when they want to (Score:3, Insightful)
Sure it is. the government (any government) produces thousands of times this amount of covert data each year. Whether it's surveillance, foreign intelligence or simply military planning information.
The point is, that almost none of this sort of stuff - the info that governments really care about - gets into the wrong hands. If they considered the loss of personal data to be important,
Re: (Score:2, Interesting)
almost none of this sort of stuff - the info that governments really care about - gets into the wrong hands
I wouldn't be so sure. From today's news [timesonline.co.uk]: "Confidential records [...] on tens of thousands of the country's most prolific criminals have been lost in a major breach of data security [...] Scotland Yard is investigating the loss of the information, which was taken from the Police National Computer and entrusted by the Home Office to a private consultancy firm"
And, how do you know covert data is never lost if you wouldn't even get news it was collected in the first place?
Re: (Score:2)
Besides, I don't think it's "humanly" possible to transport this amount of information with absolutely no spillage at all.
Rubbish. My company developed and supports a database system for the police that contains roughly 45 million records. In the several years that the system has been live, not one single dataset has gone missing - and yes, they are provided to us (encrypted) on physical media.
Re: (Score:2)
Besides, I don't think it's "humanly" possible to transport this amount of information with absolutely no spillage at all.
Amazon does it with their credit card info. Ever hear of a compromise of that data?
Re:4000000? (Score:4, Interesting)
Encryption (Score:4, Insightful)
Encryption nowadays is so damn easy to use. Why don't they?
Lazy? Incompetent? (Score:3, Insightful)
Re:Lazy? Incompetent? (Score:5, Insightful)
Or sending passwords over IM/Email/plaintext.
try to explain about packet sniffers and you'll get a reply along the lines of "oh security would be down like a ton of bricks on anything like that". Cause packet sniffers are easy to detect as we all know.
the standard here is "security handle that so I don't have to think about being secure" when in fact security can't handle that unless people take reasonable measures themselves.
Re: (Score:2)
Civil servants may not but I think the company involved here is the same one who's supposed to be running the goverments 'wonderful' ID card scheme so you really would hope they have the protection of data somewhere right at the top of their list of priorities. Obviously they don't.
Re:Encryption (Score:5, Interesting)
User resistance.
I've been involved over the last couple of months with implementing fixed disk, removable media & email encryption at an NHS trust in the UK and the amount of complaints and stupid problems we've had from users is astounding.
Most of them go straight to one of the directors to complain, before kindly informing IT that they've done it, so we'd better hurry up and fix the issue. Then staff go out of their way to find ways around the encryption, exerting far more effort than it would have taken just to use it in the first place.
Thankfully we've got a CEO & IT director who don't want to be the ones going on TV to explain how they lost X thousand unencrypted patient records and so are making sure the policy is enforced, but I can easily see how "weaker" management would allow lapses to keep staff happy and risk this kind of data leakage.
Re: (Score:3, Informative)
If what I half-heard on the radio last night was correct then the data *was* encrypted -- the government encrypted it when it gave it to the contractor. Then the contractor unencrypted it, dumped it onto a USB stick and lost that.
Time to press charges against the contractor (under the Data Protection Act, presumably).
Re: (Score:2)
Let's not forget the recent case where thousands of confidential patient records were simply left in a derelict hospital [bbc.co.uk]...
Re: (Score:2)
Because it's no loss to them if they don't.
Re: (Score:2)
It's not as easy to do as all that.
My PC at work actually has encrypted folders disabled: I couldn't create one if I wanted to (and I do want to). I assume that this is so that if I have some important information on my PC the company can still get at it if I drop dead.
To do the job properly something a bit more sophisticated than standard Windows tools is required: something that will let the employer gain access to the data if necessary.
Re: (Score:2)
Stupidity or Malice? (Score:5, Insightful)
That is almost 10 breaches a day. That is not a leak. That is a fucking river .
I am reminded of a pretty good saying. "Once is happenstance, twice is coincidence, and three times is enemy action". With data breaches this prevalent there needs to be investigations, firings, and serious consequences for all involved. At least fire everybody in charge at once.
Re:Stupidity or Malice? (Score:5, Insightful)
In the US, the Fed could leave to the states a vast swath of functions currently bogging down DC, making everyone more secure in a variety of ways.
Re: (Score:2)
How about not making information worth anything? Maybe the people who give out loans based on a 9-digit number should eat their losses?
Then this 'identity theft' nonsense will stop.
I'm currently responding to an RFP from a large health insurance company. They make the claim that a person's name and address is confidential information and hence should be encrypted,etc,etc.
How on earth are a person's name and address confidential? Or rathe
...are a person's name and address confidential? (Score:2)
For another, it strikes me that your application should not expose any information, except as part of the well-defined UI.
Just because you cannot connect the dots and do anything nefarious does not preclude a gang of thugs in Zambiniland from unsavory acts.
Re: (Score:2)
It's principally Government incompetence. (Score:4, Insightful)
This is the government that wants to have us give us our biometric data, impose the use of id cards and keep DNA records on us all.
Re: (Score:2)
Just a couple of thoughts.
Re: (Score:2)
Sounds like you're trying to blame this on pet issues. Is it really senior civil servant positions which are leaking all the data? Might the use of ID cards actually help decrease these data leaks by making the data more centralized, so they don't need to be carried on thumb-drives?
Just a couple of thoughts.
No, mainly because they've more or less dropped the idea of a central database; now they're focusing on the idea of just having existing databases talk to each other.
What could possibly go wrong? You thought the no-fly list was bad, just think how much fun it would be when sharing the same date of birth and name as someone could give you a criminal record, a medical history which neglects to mention your violent allergy to penicillin, inform the taxman that you are paid three times as much as you really ar
Re: (Score:2)
Maybe they are in some areas, but the communications intercepts are going to be centrally housed - see this Register article [theregister.co.uk].
Looks to me like they're steaming ahead with the idea, but I can't work out whether they are evil or just plain stupid.
Re:It's principally Government incompetence. (Score:4, Insightful)
I don't expect senior civil servants would ever get their hands dirty enough to be in a position where they have any data to lose but it is there job to ensure everyone else reporting to them understands and is complying with sensible data security procedures. If they aren't doing this then it is their fault as much as it's the fault of the contractor who actually lost the USB stick.
The use of ID cards might stop this sort of data loss but I don't believe for a a second it will do. First of all I think the company who has just lost this data is one of the ones involved in the ID card scheme and they obviously don't have data security very high on their agenda. Secondly the actual database may be more centralised but the data its self is going to be available to virtually every single government employee in the country along with any private company who fancies it so the chances of that reducing the amount of data leaked out don't look very good to me.
Re: (Score:3, Insightful)
I think the point was that it's no longer civil servants doing the work, but short-term contractors. A civil servant who's expecting to stick around for a long time and pick up a very generous pension - and at the top end a knighthood or some other honour - might care more about doing a good job - or at least, not screwing up too badly - than someone who knows they're only going to be around for a year or two before moving on to something else.
I think that there's also more of a tendancy to try to bypass t
Re:It's principally Government incompetence. (Score:4, Insightful)
Sorry, but how can someone misplacing a USB stick be attributed to any of the things you listed?
If I.T. data security needs tightening (which it obviously does) then how about actually changing something in some way related to I.T. data security?
Rather than actually fix the problem at hand though, it seems - as always - everyone would rather copy the mainstream media's cries of wolf and descend into the typical "the world's going to the dogs and it's all someone-but-me's fault" farce.
That's a great attitude to take if you want viewers and readers (everyone wants to hear about problems with someone-else to blame) but it's not very good if you actually want to fix the problem at hand.
Oh well, that's just a humble engineer's opinion, it may be a little rational for the arena of politics & popular opinion.
Re: (Score:2)
So who's fault are you saying it is?
If it's not the governments fault and it's not the contractors fault then who's is it?
You seem to be trying to say that somehow it's my fault but that's a bit silly since I'm in no way involved. or possibly you're saying that the programmers should make the systems in such a way that no matter how stupid the Minimum wage monkey the contractor hires (how do you think they save money?) that it should be impossible for them to overcome.
Re: (Score:2)
Blame someone, fire someone, whatever; I couldn't care less. What I'm saying is it won't magically fix anything!
My point is that just saying the usual "it's because [name of whoever happens to be in charge] is incompentent, he should resign immediately!" mantra may help sell newspapers and help attack [name of whichever party is in office at the time] but it won't do much towards fixing the actual problem at hand.
Re: (Score:2)
the point isn't that whoever you replace him with will have magical "fix everything" powers.
It's because the guys at the top are the only ones with any real power to make much difference and they need to fear for their jobs.
If there's no chance of getting fired for not making sure the people bellow you follow security procedures then why bother?
Telling the other directors "Do a better job or be fired like that guy." will make a hell of a lot more difference than the mere act of replacing one man.
Re: (Score:2)
The two largest loss of data have been
Two CD's - Not encrypted and send through the mail
A USB stick - Not encrypted and lost
This is not an a problem with staff it is a problem with a total lack of security
What is the data doing on transportable media in the first place - they do have networks
What is it doing unencrypted
What is it doing away from the original database
In both cases it was either an outside consultant who lost it or it was being sent to an outside consultant - who are obviously not trusted eno
Re: (Score:2, Informative)
The UK civil service is a joke - and I say this having had many friends and family work in all branches from local government, through the NHS right up the houses of parliament.
Once you're a permanent employee it's near impossible to get fired for incompetence, but if you're actually good at your job they will let you quit and train up someone else rather than give you a pay rise or promotion. You can imagine the environment of operational excellence this fosters.
The biggest problem is that they aren't subj
Re: (Score:3, Insightful)
Once you're a permanent employee it's near impossible to get fired for incompetence, but if you're actually good at your job they will let you quit and train up someone else rather than give you a pay rise or promotion.
I can testify to this. My local NHS trust advertises jobs internally but apparently has a policy of deciding who to promote based purely on how well they present themselves at the interview - little or no attention is paid to references, line manager's opinion or past performance. A confident person who's relatively inexperienced and crap at their job is more likely to be promoted than a less confident person who's really very good.
Follow this to its logical conclusion, and you realise that the people at
Re: (Score:2)
apparently has a policy of deciding who to promote based purely on how well they present themselves at the interview - little or no attention is paid to references, line manager's opinion or past performance.
I think you're not allowed to discriminate based on experience these days. In case people without much experience find it hard to get a job. Which is a problem, because experience is all I have. No degrees, no college, no nothing. Didn't waste time with all that.
Re: (Score:2)
apparently has a policy of deciding who to promote based purely on how well they present themselves at the interview - little or no attention is paid to references, line manager's opinion or past performance.
I think you're not allowed to discriminate based on experience these days. In case people without much experience find it hard to get a job. Which is a problem, because experience is all I have. No degrees, no college, no nothing. Didn't waste time with all that.
I think that's wrong. You're not allowed to discriminate based on age but that's not quite the same thing. (ICBW, IANAL etc etc)
Re: (Score:2)
I think you're not allowed to discriminate based on experience these days.
Please god let that be a joke...
Re: (Score:3, Insightful)
incompetance and money 'saving' (Score:5, Informative)
The UK has all but handed over the handling of citizens data to lowest bidder IT companies.
I've experienced this first hand. I worked in a hospital where total access to everything on the hospitals network was available without even typing in a password if you used certain machines which were 'configured for ease of use'. You'd think those machines weren't reachable by member of the public, or externally, but you'd be wrong.
They aren't unique either.
Re: (Score:3, Interesting)
"At least fire everybody in charge at once."
That's the sort of stupid, over-the-top thinking which will likely cause much, much bigger problems.
So even if a director is doing an excellent job he should be fired because some guy lost a USB stick which is most probably behind the back of some filing cabinet?
I realize it's popular these days is to always blame everything on those "incompetent" people in charge of governments. But a little rationality is required.
Despite all these "data breaches" there is yet t
Re:Stupidity or Malice? (Score:5, Insightful)
No offense, which I am not sure goes both ways here, but your statement is the one that is a little naive and uninformed. The person responsible is the CIO, or director if you will. If you are going to have computers, databases, and information processing in any organization you need a CIO and an IT department. It is the responsibility of those people to create and enforce sensible data handling policies and to comply with any governmental regulations governing that data. Now CIO may not be the proper term, but I am sure there must be some sort of department that deals with this. There usually is, and if not, then the UK's problems are a lot bigger than I thought.
Your assertion that I am stupid, or that my recommendation to fire the CIO is stupid, is just inflammatory and does not support your position that these people should escape unscathed.
This is not the loss of a single USB stick, but rather the pervasive problem of data loss throughout the entire government of the UK . As I stated, that is about 10 incidents per day. The CIO (or equivalent) is wholly responsible. After the first couple of incidents, the CIO should of taken action through the implementation of security and data handling technology and policies.
Whether or not it is popular to blame the government for problems is irrelevant here. The government is responsible for safe guarding the data and it failed, and it is a spectacular failure at that. Blame is required here, and in fact, the lack of blame here would be as bad the problem itself. Your claim that is irrational to assign blame to those responsible is astonishingly irrational in of itself.
You really must be kidding here. You are not serious are you? This is a huge disaster. You are attempting to downplay the potential for harm here, while completely ignoring the massive scope and scale of the problem. Evidence of any consequences has nothing to do with problem itself. My reaction is not unique, and to say it is over the top is indicates an indifference and apathy on your part to the problem itself.
:) Do better or next time we might get more serious". Why would you want to treat this lightly and keep the same people, responsible for such widespread breeches, in their positions?
There needs to be a review of all the policies and laws pertaining to the handling of sensitive data like this. This is a big deal considering it's scale, and the "directors" do need to be removed and policies have to be created with consequences for failure.
Otherwise, as you seem to be suggesting, we just give them a slap on the wrists and say, "naughty little directors! You little buggers
Re: (Score:2)
Well sure, the blame does likely lie with the CIO. You said however ""At least fire everybody in charge at once.""
I fail to see what the CFO or the director of human resource etc. have to do with the incident. For all you could know, they may be the best ones to have ever graced their positions. So an automatic, immediate firing of "everybody in charge" is stupid in my opinion.
Re: (Score:2)
I think you are being deliberately obtuse here, or perhaps cleverly Trolling. Maybe, and if not, I apologize.
When I say in "charge", most people would wonder, "in charge of what?". Since we are talking about data handling and it's policies I think it would be clear that I am referring to those specifically in charge of handling said data. The CFO and Director of Human Resources could never be thought to be in charge of information systems by any reasonable person. You make it sound like I am demanding to
Re: (Score:2)
Blame is required here, and in fact, the lack of blame here would be as bad the problem itself.
You really don't want to know about a certain NHS trust.
An enshrined policy stating "no blame". Ostensibly this is to prevent scapegoating - which would otherwise be a real problem because senior management are generally very good at finding some sort of a policy breach which would result in it being perfectly reasonable to sack someone lower down the pecking order for causing the problem.
Of course, such a policy has an unfortunate side effect - if the consequences of a mistake are unlikely to lead to a pr
Re: (Score:2)
So even if a director is doing an excellent job he should be fired because some guy lost a USB stick which is most probably behind the back of some filing cabinet?
odd...
whenever I get into a converstion about why directors get paid such insane ammounts the argument is always "because they have to take responsibility for everything that happens below them" but when it comes to the excrement hitting the rotary air impeller and it's sugested that the directors should take the responsibility and be fired it becomes "oh but you can't actually hold them responsible for what some low paid twat did, just fire the low paid twat"
Re: (Score:2)
Such a river means there may be structural problems.
My best guess is that the policies are so rigid that they will not work in the real world (and therefore cannot be enforced). USB sticks? Why don't they use truecrypt? (Maybe because USB sticks are banned altogether, and there is consequently no checks in place for whether the data is encrypted or not?)
I agree that firing those responsible for the status quo is a good idea, but the first thing to do is to determine who is responsible. Well - the senior off
Re: (Score:2)
I completely agree. I don't think that firings should be the only response to this problem. As part of the investigations it would be quite prudent to look into the "structural problems". The creation of new policies would also help immensely, I am sure.
As for your ideas about the policies being so strict they cannot be enforced, that would be untrue
Re: (Score:2)
By "too strict to be enforced" I should have made it clear that I meant "so strict that enforcement would mean an unacceptable drop in productivity". I think we're in the same chapter here (maybe even on the same page).
Re: (Score:2)
The answer to that is amazingly simple. When you do something with your own personal data, the only person you answer to is yourself. When you do something with someone else's data, you have to answer to your boss.
Proper policies regarding data handling can and will solve this problem. The employees that get caught not taking care of the confirmation simply need to be disciplined accordin
Don't worry it's only 0.7% of the population (Score:2)
I think we can trust the government with an all powerful, all knowing national ID database hooked up to an slightly psychotic artificial intelligence now.
Just you wait... (Score:5, Insightful)
Utterly, utterly, wrongheaded; but just plausible enough to work...
Re: (Score:3, Insightful)
Close your eyes and imagine John Hurt from V for Vendetta screaming that at the top of his lungs in a speech. Gives you tingles up your spine right?
Back to dumb terminals (Score:5, Insightful)
Re: (Score:2, Funny)
It almost sounds like you're suggesting that the UK government needs some kind of information security strategy.
Madness, sheer madness.
Re: (Score:2)
Re: (Score:2)
Absolutely, the very idea of USB drives being used to cart around sensitive data in government agencies scares the hell out of me. How about they do away with windows and office and introduce some encryption for a start, suddenly workstations would become less vulnerable to the user's incompetence (and that's heavy duty incompetence in government).
If a stolen laptop is running a locked down installation of linux then the thief in question is far more likely to reformat, install windows and flog the laptop than attempt to recover the data from it.
I think you're trolling, and I'm far from an MS fanboi, but you're throwing the baby out with the bathwater there.
Truecrypt (or for that matter PGP if you want a supported commercial solution with centralised key management - probably a wise idea if you're a government department) both allow you to encrypt the whole damn disk and leave nothing clear apart from a rather small bootloader.
Further, Windows domain policy can easily block the use of removeable drives.
Just doing that (which, assuming you already h
Fuck this shit (Score:3, Insightful)
Our government hates freedom. Its desire to turn society into a perfect little machine to optimise a bunch of meaningless metrics leaves no room for free will, or dissent from the middle-class, middle-of-the-road lifestyle that we are supposed to lead.
There is no priority for this government than maintaining the status quo, at any cost. Our internet connections must be monitored, our lives recorded in minute detail, our rights before the law curtailed, just so the City can continue to gamble peoples pensions and walk home rich whatever happens.
I hate my own country.
McKinsey hates freedom (Score:5, Insightful)
I don't hate my country, but I do dislike those aspects of the private school and class system which causes the people in power to be conformist and inward looking, and ready to believe any snake oil salesman in a Boateng suit. People mock Prince Charles, but at least he is prepared to get into trouble by listening to independent experts and then asking questions about the status quo and the desirability of corporatism. The Government appoints independent experts, and then when their conclusions conflict with those of the editors of tabloid newspapers, or McKinsey, they reject them. The inevitable result is pissed off staff and managerial incompetence. As one of my bosses used to say about organisations like McKinsey, when did you last hear of a great world manager? Taylorism takes no account of leadership, which is what gives morale and a sense of direction to organisations. And the only way to bring in things like data security is to bring back a spirit of public service - which means leadership.
Re: (Score:2)
I hate my own country.
You attitude has been logged for future reference.
Oh bugger. Lost the disk it was on. What did you say again?
And they keep doing it (Score:2)
Home Office contractor loses entire prison population [theregister.co.uk]
Just do what I do (Score:2)
I always give false names and information on government forms just to protect myself against this kind of data loss. ;-)
The pedants are revolting (Score:2)
The government haven't 'lost' the data; to have done that they would have to be in a situation where they did not have the data anymore. What they have done is lost media carrying copies of the data meaning that the data is potentially in the public domain or in the hands of someone who will misuse it.
I actually find it reassuring that all this data is apparently so freely available. It would be much more sinister if it were only available to a secret, select few. Publish the lot I say.
Sounds like a job for FLOSS (Score:2)
This is one area in which FLOSS software has a major opportunity to grow. With open protocols and standards you could set up a system where applications , per default, store and comunicate information securely. At pressent things like encryption and mandatory access control is hard to implement, and worse, difficult to get people to use. If you on the other hand had a standardised system for tagging and encrypting sensitive documents, then you could make it significantly easier to set a policy to use those
Re: (Score:3, Insightful)
No it doesn't you OSS junkie.
You spat out that long paragraph of "Free the Panda's", but encryption, plug-ins, and OSS or not, this wouldn't solve the problem, the main problem here, is data LOSS, as in "whoops, I dropped it down the drain" (stolen/lost laptops, CDs, USBs, etc) about half of the data was encrypted, which means that there is probably a 75% chance (random pseudo-statistic) that the information is secure, but that has nothing to do with the fact that they lost all that data, although identity
Re: (Score:2)
lol, although true with some organizations, in most if neither was allowed, it wouldnt function.
What should be done, is specialized equipement, like Secure Universal Serial Bus Sticks (various patents pending), or something that functions basically the same, (hotplugging and such) but has a modified connection so it doesnt use the normal USB one, and looks different without having to really inspect it to tell, and always encrypted.
Ontop of that, well layed-out and mandatory procedures for handling the data
And they can't do maths either! (Score:2)
Since when was :
25 million (child benefit records) + a positive value of X 25 million?
The 'up to' 4 million headline is WAY off.
Re: (Score:2)
drat, that removed the less than symbol :(
it should have read :
25 million (child benefit records) + a positive value of X < 25 million?
How many people in total? (Score:2)
Seriously, how many people in total have been affected by this? I don't mean "well, Johnny has had his stuff lost 500,000 times total, so it's only 3½ million" - just how many people have been affected, including the redundant ones?
The CIA World Factbook [cia.gov] says the UK has a population of 60,943,912 (July 2008 est.) people. In just one year, 6 percent of the total population have been affected by this. That's an insane number!
If that percentage is applicable to the US, that's 18 million people. In the EU
Re: (Score:2)
After the first six months, government offices grind to a halt because three quarters of their senior staff are in prison.
Re: (Score:2)
Because the first time it might only be their name and SSN.
The next time it might be all their bank account information, detailing everything they've done over the last 10 years, including the times they've been dumb enough to pay for dinner with their mistresses with a credit card.
Besides, some of the stuff can be fixed once published. Shut down credit cards etc, get new ones. Next time it'll be the new ones disclosed.
Sooner or later they won't be allowed to have a credit card.
It was actually 29 million, not 4 million (Score:5, Informative)
Department of Justice? (Score:2, Insightful)
Re: (Score:2)
Except that in the UK, it's not called the Department of Justice, it's called the Ministry of Justice [justice.gov.uk]. Doesn't that have a nice, warm ring to it?
Data Protection (Score:3, Informative)
It's all well and good to poke fun at the British Government for their consistent negligence. But the only reason this is being reported is because of the data protection laws in the UK - which basically means that if you lose someone's data, there is someone going to come down hard on you and that they have the legal capacity to do it.
Data protection, however, is not ubiquitous - so before railing hard on these guys, ask yourself if you're protected and is there someone looking after your interests? If not, then you're data could be being lost on a daily basis without you ever having any knowledge of it - and with no recourse even if you did.
Re: (Score:2)
While that's true, knowing that my data may well have fallen into the wrong hands (they lost a copy of the child support records, and I have a child) doesn't actually make me feel any better than not knowing...
Luckily, the NSA had backups. (Score:2)
It's allways handy to have an elder sibling of the male gender.
The good side of this... (Score:2)
I believe the good thing that can be reflected upon is that the departments are made to disclose this loss data. If they weren't nobody would know the scale and nobody would be pressing for solutions.
Um,.. the really evil solution... (Score:2)
If you want the truly lazy evil solution, the government could reclassify all the data that it collects on people open public documents and try to post it publicly ASAP. This everyone would believe would be the lazy incompetent solution, but on the bright side its actually easy to implement though it might not currently be legal. The big benefit to the government is that they can then say that have no farther problems with data breaches since its all open public data any way. ;)
For even your most evil gove
waiting for the Big One: IRS loses data (Score:2)
Panopticon (Score:2)
Does the Panopticon still work, even if it's a result of unintentionally building a prison so shoddy that one of the walls fell down?
Guess we'll find out.
Just once ... (Score:3, Funny)
Re: (Score:3, Interesting)
Data guardians? Who guards the guardians?
The data guards the data guardians. Simply put all their personal info in there, including credit card numbers, and suddenly the guardians will be Nazis about keeping it safe.
Re: (Score:2)
Actually in the current case in the media today... it has been lost in the proper sense.
The USB stick containing details of all the current UK prison population has been lost (or if I am generous misplaced) by the contractor who had the data for analysis.
So yes the original data is intact but this copy of the data has been lost.
Way Offtopic (Score:3)
Currently, if you log off of Slashdot, and go to the front page, you get to see a picture of "Little Hitler", a two year old dressed up to look like Hitler. What in the hell is wrong with Slashdot. There isn't even a story to go with it, just the freaking picture. Posted in the idle section, of course.
Has the management of Slashdot put their head so far up their ass that they have oxygen deprivation in the brain?
Re: (Score:2)
Build social systems that do not need personal information to be kept secret or do not need personal information to be transmitted.