Congratulations! 25 Million Peoples Personal Data is Lost in the Post!!

A junior HM Revenue employee has lost (in unrecorded post) two disc containing the: Names, addresses, bank details and National insurance details of about 25 million people. Furthermore though the information required a password it was unencrypted making it extraordinarily easy to hack and copy for whoever has the disks.

1.www.telegraph.co.uk.../news/2007/11/20/ncustoms620.xml
2. news.independent.co.uk...
3. politics.guardian.co.uk...

(The UK’s entire population is only about 60 million bye the way).

Our great Chancellor first learnt of the breach 11 days ago. However perhaps in the spirit of Gordon Browns promised “open-government”? Kept quite about it till now (as the police have been finally notified.
Coincidently? The Chancellor would obviously have had little choice about making it public anyway, now police have been notified.

However to his credit during those 11 days increasingly frantic searches were conducted of relevant departments; and so it would appear the information is well and truly in outer space (though obviously it would be safer there!).

My Opinion
The foul up could obviously have happened under any government. Therefore this merely conforms the “theory” that ID cards are a big risk to public security, even if they are of some benefit.
However a law demanding that every citizen contribute to another centralised database of public info (or loose their right to renewed-valid English passports) and which this time may also contain biological information; will surely be a gift to every foreign hostile intelligence, should they ever wish to e.g. civilianise spies.
And of course it’s even worse (for us ordinary folk) if or-when probability laws dictates info falls into criminal hands.

However maybe it’s difficult to blame Alistair Darling (being a new Labour politician) for keeping the public and the parliament-police in the dark for 11 days. After all much like when our Home Security (Jacqui Smith) learnt in July 5000 illegal immigrants were given clearance to work as security guards at some of most sensitive buildings:
www.thisislondon.co.uk...'s+most+sensitive+buildings/arti cle.do

She felt the need to hang onto the information for a few months until journalists (guardians of democracy) started to question her about it: www.telegraph.co.uk.../news/2007/11/13/nmigrants413.xml
However she defended not informing the Commons on the grounds of having to get the correct lines, and err… establish facts, and err… not mislead.
So maybe Alistair Darling (was in the same spirit of not causing panic-description) keeping both us and parliament in ignorance in the same sort of err… “well meaning” way?
Clearly some people need to realise (if they haven’t) that nothing misleads more than silence of ignorance.

Summary…
Perhaps under a more accountable government the police might have been called earlier, and therefore the resolving of this problem would be far more advanced.
A different government might offer less ammunition for the suspicion it is a “damn of problems”; because it daren’t let them pass yet; under either a very authoritarian, or perhaps very patronising view of the publics parliaments good of ignorance.

reply to post by Liberal1984


Darling didn't keep the police in the dark. He'd reported it to the police the same day he was told, and they asked for time to search for the missing data before the public knew (so that if the disks had indeed been stolen, the thieves wouldn't know they were being hunted). Nothing has been found yet, however. In addition, the banks wanted time to prepare their response (since bank details are amongst the missing information)... quite understandable after the panic with Northern Rock. It would have been completely unwise to ignore requests from both the police and the financial sector, both of whom have a key role in preventing any damage being done if (and I emphasise that deliberately) the CDs have fallen into criminal hands. There is no evidence to suggest that this has happened, though.

I mentioned this earlier.

My take on this is pretty straight-forward.

Part of the problem is an inherent risk we are all taking as we move towards an increasingly 'electronic identity' and vast amounts of data can be moved around in relatively tiny 'media'.

But as best as I can make out the Gov department handed over this sensitive information to their trusted courier service to deliver to another Gov department, as is the established custom & practise, and in a rush.

The courier then failed to deliver item.

Therefore surely any “incompetence” is on the part of the couriers?

Now unless Darling or Brown are moonlighting as bike/van couriers, then I’m struggling to see what else they could have done, bar walk the damn files to their delivery destination themselves.

Not securing personal data is an offence under tha Data Protection Act. You have to question the culture and management controls within the organisation that allows this.
But to hold the Chancellor of the Exchequer or the PM responsible is sheer opportunist political mischief-making.

.....and as far as the party political side of this goes IMO it simply beggars belief that the tory party are today claiming Gov cut-backs and savings are responsible for this problem
(particularly as they indulged in their usual 'dutch auction' of promising much more significant cuts themselves at the last general election).
It's just pure hypocrisy from the tory party & the light-weight sound-bite monger Cameron.

......and it is still worth pointing out that it is perfectly possible for the discs to have gone missing within the 'system' and be effectively lost (for now) without them actually 'falling into the wrong hands' at all.

(Has anyone actually seen the Newcastle complex? It's pretty huge)

[edit on 23-11-2007 by sminkeypinkey]

Part of the problem is an inherent risk we are all taking as we move towards an increasingly 'electronic identity' and vast amounts of data can be moved around in relatively tiny 'media'.

Ahem... Labours' ID card scheme springs to mind.

David Cameron was right... Why should we trust a government with 60 million peoples' details when they can lose a mere 25 million!!!

Oh, by the way, that is 60 million and counting. By the time this thread is finished we may have another million or so immigrants.

Originally posted by sminkeypinkey

The courier then failed to deliver item.

Therefore surely any “incompetence” is on the part of the couriers?

Do you understand the importance of a junior official being able to access a record, including bank details? I'm sure you do. You do not seem to understand the public importance of who can burn a disc of a whole 25 million of them. This is systemic failure, which if repeated with ID cards, as I'm sure the current bunch of clowns will balls up, would be a national catastrophy.

Actually the tale that a very "junior official" is solely responsible for all of this and was the only one involved turns out not to be true (as emails that came to light later showed).

It is also not even clear that the courier actually picked up the package and that it left the Gov offices.

Nor is it true that the material on the discs was completely unprotected (I have read several reports saying at least password protection was used).

The point remains, we don't know and all of those points are firmly 'operational' matters (of people either following, or not, the laid down day-to-day proceedures) and are not the responsibility of Gov Ministers.

So before running around like headless chickens I prefer to let the investigations run their course and some facts come to light before adding 2+2 and coming up with (a highly politically slanted) '5'.

In fairness, it is very important what the procedures are about data.

1. Who can access one record at a time, who many, or any.
2. When data of the magnitude here is left in open space, do you use password protection or full on encryption. Password protection is crackable quickly enough, encryption far less so.
3. Who witnesses people with the data, so they cannot take a copy, this is high security we are dealing with here, banks have things like safes.
4. When the data has been used, and has become a copy, is it destroyed or returned?
5. If it is destroyed, how? Data an a hard drive needs more than just an 'empty recycle bin' to completely eradicate it.
6. What happens with those hard drives after use?
7. How is this all recorded?

These are quite basic questions, but the government does not really have answers to any of these questions, though I would only stickle with them on points 1,2,3 & 7. 4, 5 and 6 are more for when they have sorted this mess out.

[edit on 26-11-2007 by redled]

Originally posted by Ste2652

Darling didn't keep the police in the dark. He'd reported it to the police the same day he was told

No, not true…
According to this source: news.bbc.co.uk... it was (according to Alistair Darling) 14th November when the police where called to investigate the missing disks. And to this source… 10th November when Darling first new of the disks going missing.
politics.guardian.co.uk...

The data went missing on October 18 but the loss was not reported to senior HMRC management until November 8, three weeks later.
Darling said he was informed on November 10, and told Brown within 30 minutes. He explained that the delay in telling parliament was partly due to banks requesting time to monitor potentially suspicious activity.

So I'm sorry about somehow thinking there was a delay of 11 days in calling the police when it was actually “only” 4.
However whilst not telling parliament for 6 days (after calling the police) may be justified on police terms, not calling them in the first place for 4 days doesn’t justify itself.
Especially when the issue dates back to 18th October, and the department had known about the disks being gone since October the 24th. news.bbc.co.uk...

Sminkey If a junior official “being responsible” is untrue; its surely worth noting it was Alistair Darling who first broke this untrue story to parliament!! news.bbc.co.uk...
No doubt some junior official will be to blame!!!

So the way I see it, it’s not just the Service idiots.
Darling and Brown also need to be blamed for their delay in calling the police, and perhaps whoever is responsible for the "junior official" “spin” should also be traced? Only because it's a statement to parliament, as opposed to simply the press.
Apart from that Darling-Brown have done nothing wrong; however some would argue what they’ve done wrong is quite enough.
Darling in particular, since to be fair; one can understand Brown thinking the police issue “was is in Darlings hands”.

[edit on 090705 by Liberal1984]

Sorry but I see nothing unusual in the so-called '4 day delay'.

It strikes me as perfectly normal that a Minister would 'order' further extensive searching
(in addition to it also being perfectly normal to be watching out for any suspicious activities) before calling in the Police.

The original claim (in the press at least) was that this had all happened due to a single junior official.
That part is untrue.

You can be certain Darling did not mislead Parliament on this (otherwise the opportunist tory gang would be going on and on and on about it 24/7 in the media).

It's also worth pointing out that in the PMs monthly press conference (an innovation introduced by this Gov ) Gordon Brown made it clear that existing procedures had not been followed in this matter (in terms of the handling of sensitive data).
These are patently 'operational matters' and the Gov can hardly be blamed when people do not follow the proper existing laid-down procedures.

Brown says it was the procedures not being followed that led to the loss of the child benefit data.

link

[edit on 27-11-2007 by sminkeypinkey]

Well Sminkey you might think 4 days to call the police is ok, but for me this is not expectable. The big question is at what point did they know (roughly) how long the disks had been missing? Because if they knew from the beginning then a 4 day delay could never have served anyone, other than the possibility the government could find the disks and not therefore have such embarrassment by reporting them as an ongoing disappearance.

You can be certain Darling did not mislead Parliament on this (otherwise the opportunist tory gang would be going on and on and on about it 24/7 in the media).

4. Sminkey follow this link: news.bbc.co.uk... which summarizes Darlings statement to parliament.
You’ll get this:

He said it now appears that at a junior level, in October, two password protected discs containing a full copy of HMRC's entire data in relation to the payment of the child benefit was sent to the NAO in October.

So if the junior official thing is untrue, it follows that what Darling said to parliament is untrue. Who’s responsible for that seems to be unclear; which is why I suggested another junior official.

Personally I don’t believe the Tories are good enough at spin. They get it right sometimes (like when they’ve had a chance to think it out in advance). But when Cameron’s asked directly he tends to do stupid things like blame the summer flooding on global warming; rather than simply government infrastructure spending.

[edit on 090705 by Liberal1984]

Originally posted by Liberal1984
Because if they knew from the beginning then a 4 day delay could never have served anyone, other than the possibility the government could find the disks and not therefore have such embarrassment by reporting them as an ongoing disappearance.

- Er sorry what are you saying now?

Is it reasonable to you that once this kind of thing comes to light that the Minister ought not to order extensive searching?

I find that hard to understand.

Are you also saying that keeping the news out of the public domain was also wrong and that their watching for signs of unusual activity in that period was wrong too?

Originally posted by Liberal1984
So if the junior official thing is untrue, it follows that what Darling said to parliament is untrue. Who’s responsible for that seems to be unclear; which is why I suggested another junior official.

- I think you're wriggling.

Darling was correct to say the actions were carried out by a junior official.

It was not correct (as some media outlets reported it) that a junior official was the only official involved in deciding the form the data transfer was to take.

Those are not mutually exclusive points.

Originally posted by Sminkeypinkey

Is it reasonable to you that once this kind of thing comes to light that the Minister ought not to order extensive searching?

I'm saying he should order extensive searching as well as notify the police, espically if others than can tell him it's been missing far longer than when they told him about it.
At no point did I say extensive searching was wrong.
I believe the only thing Darling could have gained by not calling the police was the possibility of not having to report an on going missing data crisis to parliament.
But I think it's unwise as the delay could only have decreased the probability of finding the disks.

Let's just hope they're at the rubbish dump!! This is the best possibility as then they're completely safe, and because they'll almost certainly never be found it'll continue to put a major spanner in the works of any I.D card data base.