UK Government Staff Caught Snooping On Citizen Data 120
An anonymous reader writes "More than 1,000 UK government staff have been caught snooping on citizen data — including criminal records, social security, and medical records. From the article: 'The U.K. government is haemorrhaging data — private and confidential citizen data — from medical records to social security details, and even criminal records, according to figures obtained through Freedom of Information requests.
Just shy of 1,000 civil servants working at the Department for Work and Pensions (DWP), were disciplined for accessing personal social security records. The Department for Health (DoH), which operates the U.K.’s National Health Service and more importantly all U.K. medical records, saw more than 150 breaches occur over a 13-month period.'"
Shocker (Score:5, Insightful)
Give someone access to people's private information and it will be abused. Here I'm giving you this box that contains pure awesomeness. Please don't open it.
Re: (Score:2)
Wouldn't you want to look up famous people in the database? See how much tax they pay, etc. I sure would!
Re:Shocker (Score:4, Informative)
And any half-decent auditing system would catch you very quickly indeed.
The thing is I'm absolutely sure in my own mind that despite the fact that the means to develop half-decent auditing systems has existed for years, I don't think they're terribly widely deployed. And if they are, I don't think very many organisations have processes in place to make sure that action is taken when the audit blows the whistle on someone.
This is based mostly on speculation rather than having any hard evidence, though. Would welcome comments from someone who does IT security professionally.
Re:Shocker (Score:5, Informative)
Auditing systems only work to stop legitimate users of a database from making inappropriate queries, the database and system administrators, and in most cases network administrators have carte blanche access to anything and everything they are responsible for, and it is always a simple procedure to bypass any audit traps that may be in place.
Take the example of an Oracle DB on a Unix system, it is a pretty trivial task to make a copy of the entire hard disk (and database contained therein) without leaving a trace of your actions. These systems are both too simple and too complex to prevent access from a lower level of abstraction.
We put a huge amount of trust in system operators, and there is really no other way. At the end of the day, someone needs lowlevel access to the system to run diagnostics and perform maintenance, even in some security enhanced configuration like IBM AIX or z/OS, there is going to be a hardware maintenance mode, if not accessible by the site admin, it will be accessible by someone at IBM.
Re: (Score:2)
However, a decent auditing system would limit the number of people able to abuse the data in this way.
It's one thing to know that there are sysadmins out there with the ability to leak my data. At least the sysadmins, are, well, people like me. Who read Slashdot and have read the same things I have about why it's important not to engage in or facillitate creepiness with databases.
But when the system is open to abuse by every halfwitted clerk in the government, that's when seriously bad shit happens.
Re:Shocker (Score:4, Interesting)
It's pretty easy to overcome audits. Open a trivial case against the person you want to snoop on (littering or something), pull the data, and then close the case with "no further investigation". So everything looks legitimate, and the audit doesn't ring any alarms.
Re: (Score:1)
This depends on the system. The system mentioned by parent I don't think classifies as `half-decent`, even though it is how many CRM based systems work.
Half decent systems hide nearly all information until the case/person is identified correctly. Also this is recorded in audit information, with the relevant information that is shown initially as a search and the reason for opening/closing the case/person.
Most rigorous system that I am aware are for Police National Computer (PNC) checks. Most commonly used f
Re: (Score:2)
And any half-decent auditing system would catch you very quickly indeed.
They might have database triggers on obvious famous people[1] to catch stupid[2] people being bribed by Rupert Murdoch but what about people who look up school friends or whatever. That's unlikely to raise an eyebrow.
[1] But don't bet on it: This is government, the very definition of IT incompetence.
[2] You can bet the smart people can get access without being logged by 'borrowing' a superviser's password or a backup disk or whatever.
Re: (Score:2)
And any half-decent auditing system would catch you very quickly indeed.
Indeed. For instance, over 1000 people working for the Government in the UK have been caught illegally accessing data - who'd have thought it, auditing systems working.
I don't think they're terribly widely deployed. And if they are, I don't think very many organisations have processes in place to make sure that action is taken when the audit blows the whistle on someone.
In the UK, they're deployed extensively, and if you don't work for DWP, it's often a sackable offence when the audit controls catch illicit access.
Forget the legal mandate to protect data, we have a duty of care to customers (and, cynically, to protect the company reputation).
Re: (Score:2)
"Disciplined" says it all (Score:5, Insightful)
Just shy of 1,000 civil servants ... were disciplined ...
WTF, how about sacking these people, they clearly can't be trusted in their position. Better still, make it a criminal offence (if it isn't already) and charge them.
I worked for the Ordnance Survey in Southampton after Uni. During training we were shown examples of where people had altered maps (someone wrote "HI" in land tiles in the North Sea, and a building was labled "Kate's cradle of filth"). It was explained to us that all work was logged. If caught we would be sacked. If we'd already left, we'd be chased up under the Official Secrets Act.
Whether it was all a threat, I don't know. But I certainly didn't risk finding out. Neither did any of my friends.
Re:"Disciplined" says it all (Score:5, Insightful)
This is the public sector we're talking about, you can't just fire people for gross misconduct, that would be discriminating against people who violate your policies.
I have personal experience of this, contracting for an NHS trust where one of the people in my team abused their access to snoop through peoples' emails, documents & web logs to try and find information that they could use to blackmail them into giving them perks & preferential treatment. We caught it within a couple of days and had witnesses and audit logs showing what they'd been doing (they weren't too bright when it came to covering their tracks) and handed the whole lot over to HR.
It took nearly 3 months before they even suspended him; almost 2 years later they had botched everything so badly that they had to pay this person off to leave quietly and not take them to an employment tribunal.
That anyone ever gets fired from a public sector role without having broken some pretty major laws is nothing short of a miracle.
Re: (Score:2)
*wink*
It's rife.
Re: (Score:3)
Re:Shocker (Score:5, Informative)
They had remote controllable ccd cameras all over the place to keep track of traffic flow etc.
Whenever I went in, one of the cameras would almost always be pointing at the girl who used to sunbathe in her back yard in a property very close to a major intersection.
Incredibly creepy.
Re: (Score:2)
And you didn't bother to figure out who it was and tell her? Or file a complaint with management?
Re: (Score:3)
And you didn't bother to figure out who it was and tell her? Or file a complaint with management?
Yeah, he might even have managed to make the superior glare in a very annoying way at the people controlling the camera!
Re: (Score:2)
That's what happens [bbc.co.uk] when you put minimum wage monkeys in charge of an incredibly boring bank of screens all day.
Re: (Score:2)
I work with folks who earn 200k+ per year and they would do the same. Its human nature, and we are very social gossipy animals.
Always write laws and grants of authority with the mindset that they will inevitably be abused.
Re: (Score:2)
Now picture someone making a database query to find the addresses of all the young girls in town so they can identify a bigger pool of girls who like to lounge in their gardens in summer clothing.
Probably already happened.
Re: (Score:2)
I had totally forgotten about that.
Re: (Score:1)
It depends on what you call abuse - I have in my possession, a database containing serious amounts of information on about 2 million UK housing association tenants. Names, email, date of birth, addresses, history, comments, disabilities, concerns, criminal records, complaints, dependants etc etc etc. There was no access control for this database, I could copy it at will. It would be a scammers dream to get hold if it.
Have I done anything with it? Nope, never will, sits on one of my archive backups. Would
Re: (Score:3)
Don't worry. The government leaves an up-to-date copy of that in the back of random taxi every few months to make sure the scammers don't miss out.
Nothing to fear... (Score:5, Insightful)
These people, though, were doing nothing wrong so they have nothing to fear from these unelected civil servants poking through their personal information, right?
...right?
Lack of information (Score:5, Interesting)
Were these all "I want to find embarrassing data on my ex or a celebrity!"? Were some of them just "staff member legitimately needed to access an account and should've waited for his boss to authorise first".
How many of them were procedural mistakes and how many were genuine cases of snooping? A high number of the former would paint a very different picture and asks different questions to a higher number of the latter. But then Dispatches is a horribly sensationalist program so I doubt they care.
Re: (Score:1)
How many of them were procedural mistakes and how many were genuine cases of snooping?
This question alone shows a big flaw in the system. It is set up in way that makes it impossible for the taxpayers to check if the government workers are doing their job.
They can basically waste millions of £ without actually doing anything that benefits society at all and there is no way for you to make sure that they do their best to work effeciently.
I think it is safest to assume that all of them were genuine cases of snooping, at least that encourages them to improve the transparancy slightly.
Re: (Score:2)
0% procedural, 100% Murdoch (Score:5, Insightful)
These are disciplinary actions, not administrative errors. Verbal ticking offs don't get listed. So they'll all real breaches.
“unauthorised disclosures of official, sensitive, private and/or personal information”,
I wonder how many of these are civil servants handing data over to Murdoch's newspapers & TV interests, given we know his newspapers even hacked telephones, buying info from civil servants about celebrities and politicians seems extremely likely. I wouldn't be surprised if a large percentage of those leaks were to Murdochs lot.
But the big revelation is that there are 200,000 civil servants approved to access the databases. That's an insane number! What did they expect, 200,000 possible leak points, the system is designed to leak private data like a sieve.
Most likely these are only the leaks that CAN BE CLEARLY IDENTIFIED as leaks. I think that's the TIP OF THE ICEBERG, since most of the data leakers would NEVER GET CAUGHT.
Re: (Score:2)
It came out during the Levison Inquiry that News Corp's papers had access to people's medical records. It seems likely that somoene with access to them handed them over in exchange for cash, since no evidence of hacking has emerged.
Fining local authorities is stupid. (Score:2, Insightful)
TFA:
The penalties for a criminal offence go up to £5,000 ($7,900) in a lower magistrates court, or an unlimited fine in a higher Crown court. Some British politicians even called for some extreme data breaches to result in prison sentences — something dismissed by other parliamentary committee members. Rarely does the fine rise to five-figures, let alone six. Only recently, one Scottish local authority was fined £140,000 ($220,000) for five separate data breaches — the highest fine imposed by the courts to date.
When you fine the government, they just increase taxes. We need some personal accountability here.
Re: (Score:3)
Re: (Score:2)
You mean like staff being disciplined?
Only if by "disciplined" you meant something along the lines of 100 very brisk strokes of a cane to their naked body in the public square while being nationally televised, ending with a distinctive hot-iron brand to the middle of the criminal's forehead along with a lifelong ban on holding any public job or political office ever again.
If you meant the more typical docking of salary and/or temporary suspension, then, no.
I hope that clears things up for you. :)
Strat
Re: (Score:2)
When you fine the government, they just increase taxes. We need some personal accountability here.
Yep. The government 'fining' itself only moves money from one place to another, nobody feels terribly punished afterwards (unless they were planning to 'divert' it for their own use). It should be automatic firing (for minor offenses) or prison (for bigger offenses).
Human nature (Score:2)
This sort of thing always happens. The only way we could even begin to reduce it is to automatically fire anyone caught doing it, followed by criminal prosecution. Even then people will try to get away with it.
The only sane solution is to just accept that it can't be prevented and not allow data to be made available in this way.
Re: (Score:2)
Some of those breaches would be done by people who were being bribed to get dirt on other people. Firing somebody won't prevent the breaches, it just raises the price of the bribe.
Like it will just be civil servants... (Score:4, Insightful)
The FOI request revealled the number of civil servants who had done it but private enterprise is not subject to that act. The same thing will go on but it will never be publicised.
And I'm not going to buy any arguments that private enterprise security procedures would prevent it.
England != UK (Score:3, Informative)
Re: (Score:3)
If you read the linked article you will see:
Furthermore the summary was quoting the original article, hence the quotation marks, so don't take it out on the summary.
List of UK data loses (Score:4, Interesting)
WIkilink to list of UK data loses we know about http://en.wikipedia.org/wiki/List_of_UK_government_data_losses [wikipedia.org]
http://news.bbc.co.uk/1/hi/7103566.stm [bbc.co.uk]
We know the goverment can track cars in real time, intercept sms and phone calls in real time, and after the centerized commications they will be able to cross ref that with your internet habbits. All in one super database to stop terrorisum.
I wrote to my MP who is a tory, I had a bit of a rant about the Goverment U-turning on this retraining data as it is one of the reasons i personally voted for them. The guy replied but it was like reading BBC news, a sales pitch that was all fluff and no content. It was all about stopping terrorisum it was just pure propaganda to push an ageneder that I personally did not think this MP was even aware of, it just seemed he was given a press release, told this is what he is going to be doing and refusing to look at anything else. The funny thing was I also wrote to my councilers and they also sent him letters along the same lines as mine all to be met with the same reply. Everyone is against this, and MPs are not even listening to their own people to pushing their own agenders.
L
Re: (Score:3)
You realise that absolutely everything the Tories said to get elected was a lie, not just that? Same old Tories.
Re: (Score:2)
Friend = Police Officer x 2 (Score:1)
Would be interesting to know (Score:2)
if any of these breaches can be linked to articles that have appeared in the British press.
and that's just the breaches... (Score:3)
...that we already know about, never mind the ones they've so far managed to bury.
The simple fact of the matter is, there is no system-level security. It's a system of trust where the ones with access cannot be trusted. They are, to put it mildly, and without exception, un-trust-worthy.
Austerity measures (Score:1)
Just picture that the austerity measures taken by different European governments means that they will have completely dissatisfied government employees who will still have access to the same data that they had before.
The creative ways in which they use that power is a problem that will only get bigger.
For example, in Romania they have a system in which government employees feed information about pre-communist owners of buildings to their business partners so that they can buy the building rights from people
Re: (Score:2)
oh your fucking God, austerity measures in Greece? Joke. Italy? Beyond a joke. Spain? Don't even go there. Never mind the rest of Europe, who are all in the exact same mess. The Euro is going down the pan and it's dragging the Dollar and Sterling with it. The plug hole is gurgling and gagging on the shit sandwich of which we'll all soon have to take a HUGE bite.
Move Along (Score:3)
Yawn... this happens in the USA too. Anywhere you have personal records, there will be an employee who will access them for purposes other than intended. Do you think the people at the DMV haven't used their access to check on people that they have no business checking? How about the people that manage passports? There was that mess a few years ago.
Re:ugh (Score:4)
Re: (Score:1)
The United Kingdom, apparently!
Re: (Score:2)
Re:ugh (Score:4, Insightful)
US: Jump!
UK: How high?
That's how "special" the relationship is...
Re: (Score:2)
Re: (Score:2)
Very true
Re: (Score:2)
You are aware that the Tories in the UK are most definitely not Liberal. Right? That would be like describing Rick Santorum as a Liberal and a socialist.
Re: (Score:3)
Re: (Score:3)
Re: (Score:2)
Re:ugh (Score:5, Insightful)
Re: (Score:2)
MP == Member of Parliament
Re: (Score:1)
Re: (Score:2)
No - MP == Member of Parliament
And more like a congress critter than a senator.
The House of Lords is more like the Senate.
Re: (Score:2)
The House of Lords is more like the Senate.
Except it's not much like it at all. The second-chamber systems in the UK and US are really very different. In particular, the UK system is all appointed, with both political members and experts nominated.
Re: (Score:2)
They are difficult comparisons as in the UK the equivalent of president (the Prime Minister) sits in the Houses of Parliament. My comparison was derived from the fact that the House of Lords is the second house - much like the Senate. Just about there, the comparisons end.
Re: (Score:2)
Maybe the poor guy or gal takes the "Leader of the Free World" thing too literally?
Re: (Score:2)
Re: (Score:3)
Mrs May, you and your departments can piss off if you think you getting any more my info!
How are you going to stop them?
Re:Mrs May you're useless! (Score:5, Informative)
I have come to the conclusion that it isn't the politicians that are the problem. Its the Civil Service. Governments are just a passing inconvenience to them, all the policies floated by the last government that were called out as being hated by the people are steadily being re-introduced by the current government. It seems that the reforming Tories in power actually have no power at all. So there is no point ranting at an individual politician because they may as well not be there for all the good it will do.
Re: (Score:1)
I have come to the conclusion that it isn't the politicians that are the problem. Its the Civil Service. Governments are just a passing inconvenience to them, all the policies floated by the last government that were called out as being hated by the people are steadily being re-introduced by the current government. It seems that the reforming Tories in power actually have no power at all. So there is no point ranting at an individual politician because they may as well not be there for all the good it will do.
Of course, Yes Minister!; and Yes, Prime Minister! showed us this in satire 30 years ago.
Re: (Score:2)
Has it been that long....
Trident submarines and everything?
Bernard Woolley: What if the Prime Minister insists we help them?
Sir Humphrey Appleby: Then we follow the four-stage strategy.
Bernard Woolley: What's that?
Sir Richard Wharton: Standard Foreign Office response in a time of crisis.
Sir Richard Wharton: In stage one we say nothing is going to happen.
Sir Humphrey Appleby: Stage two, we say something may be about to happen, but we should do nothing about it.
Sir Richard Wharton: In stage three, we say that
Re:Mrs May you're useless! (Score:4, Insightful)
Re: (Score:3)
Re: (Score:2)
Same exact thing in Ireland too, word for bloody word. What do you call it when the regulators are the ones doing the regulatory capture?
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
At which point the managers will be the first up against the wall? I'd be all for that!
The arrival of Big Brother, finally ? (Score:5, Insightful)
Many decades ago I read that book "1984", I have to admit that I were scared shitless at the thought of the all-knowing big brothers controlling every single bit of my life.
But at that time, - decades ago, - even the worst government (East Germany, North Korea, China, Russia, to name just a few) just couldn't have the mean to know everything about every single citizen under their control
Oh yes, those bastard governments employed a lot of spooks and collected volumes of data, but determined citizens always found ways to defeat even the most draconian measure
No more
With the advent of computers and high speed network, not only they (the governments) get to collect all types of data, they can data-mine the data so much so that they can get to understand us more than we understand ourselves
We might not know where we might go, or what we might do, tomorrow, for example - by simply referencing our daily/weekly/monthly routines, our health data, our financial data, the people that we are in contact with, etc, - the government might be able to predict, with a certain degree of accuracy, what we might do, where we might go, a few days from now
This is scary !!
Way more scary than the scenario outlined in "1984"
Re:The arrival of Big Brother, finally ? (Score:5, Interesting)
The Stasi, like the Gestapo, relied on informers. They both worked in a situation where everyone was doing something illegal and an accusation was about all the evidence that was required. If they wanted to intimidate or eliminate someone, they just needed to pressure a neighbour or acquaintance into informing on them. This meant that they were intrinsically limited. Both were relatively small organisations and it would take several weeks of several agents' time to get one person. Their power came from the fear that they generated: everyone knew someone who knew someone who had been arrested on trumped-up charges and never seen again. It was unlikely to happen to you, but it could.
The problem with this kind of database and monitoring is that it means that any Stasi-like organisation can be run efficiently. Want to eliminate everyone in a certain category of political undesirables? There's an app for that...
Re: (Score:2)
Of course, here in the US, this kind of thing would never happen.
Because under CISPA, any and all information shared, even the nature of the information shared, is completely and totally exempt from the Freedom of Information Act (FOIA).
Unlike the UK, we'd never even hear about the abuses, because we'd never even be able to ask the question...
http://www.isights.org/2012/05/uk-government-staff-caught-snooping-on-citizens-data.html [isights.org]
Re: (Score:2)
While I thank you for your kind gesture of explaining to that name-calling AC, I do not think that fella has enough brain cell to grasp whatever that you were trying to say
But anyway, thanks again !