Printable View
HM Customs and Revenue (the British equivalent of the IRS) have lost the personal details of 25 million UK residents. They sent them in the mail, unencrypted!!!!!!!!!!!
Story here:
http://news.bbc.co.uk/1/hi/uk_politics/7104945.stm
And this is not the first time!
http://news.bbc.co.uk/1/hi/programme...ox/7076106.stm
:rolleyes::shocked:
So, are you keeping an eye on your Credit cards and Bank accounts Nihil?
:rolleyes::shocked:
Cheers:
No more than I normally do DjM. I am a cynic who believes that what actually comes to public attention is probably only the tip of the iceberg.
I know that I am not in either of those databases, but the fact that it can happen is rather worrying. Particularly as identity theft is now the most common crime in the UK.
What really annoys me is that this is a government department and the government have the cheek to legislate on data protection.
"Physician heal thyself" :eek:
The Wolfman doesn't understand why companies/departments with sensitive information won't use automated encryption on their email, CD's and USB/Floppy drives.
There are plenty of applications that automate this process.
I have been hearing about this on PRI [public radio international] lately... from what they said, they have no idea what happened to the discs, whether they were stolen, thrown away, etc.. the reporter even joked that they will probably find them behind the coffee maker in a year or so... they also refused to name the guy that actually misplaced the discs, but from the sound of it, his bosses were fired, and they were looking for even more heads to roll higher up the ladder, as it were. scary stuff...
I cannt believe in this modern world of technology
there is a case of such a important data loss
CD lost "OK"
Data lost "Thats amazing"
i think this is just a bullshit and a foul image
Disregarded Dishonoured
KK
glad to see the US isn't the only place losing important data.
nihil, its been ages and seeing that you are still around means this place hasn't gone totally balls up.
Hi, XTC46,
Good to see a "prodigal" return :DQuote:
nihil, its been ages and seeing that you are still around means this place hasn't gone totally balls up.
As for the lost data issue, I guess it is a question of management and the chain of command.
From what I can gather they were supposed to use couriers. Now, what happens is the actual task (procedure) is delegated to the lowest levels AO (administrative officer) and CO (clerical officer). At that level there is a high degree of staff mobility as people pass their exams, get promoted or get moved around departments to gain experience.
Unless you have a rigorous training programme, it is not surprising that deviations from the laid down procedures will start to creep in?
The irony of it all is that there is actually a branch of the Civil Service called the "Queen's Messengers" whose very job is to safely deliver confidential information. Trouble is that they work for the Foreign Office and not the Treasury :rolleyes:
Wolfie~ makes a very good point, automatic encryption is hardly rocket science these days. The trouble is that Civil Servants at the senior level tend to be "technologically challenged" :D
LMAOQuote:
The trouble is that Civil Servants at the senior level tend to be "technologically challenged"
good one Johnno ;)
Although it is not just civil servants
thats why we all have jobs
MLF
amen to that. :)
For one person to start using data encryption for every day stuff is fairly trivial. To make it common practice to do it for an entire government department, much less government, is a bit more drastic. It takes an incredible amount of resources to do efficiently and safely, and it can surprisingly make security worse (not to mention a false sense of security) if done poorly. Especially in cases like this, it is completely necessary.
However, this is irrelevant; it's not about security of the data, it's about the fact that someone was foolish enough to lose the data. Obviously, proper security measures would be greatly beneficial, but one should focus on the issue at hand first.
No, it doesn't. This is the concept of "politically correct" and not much more. The way I would see it is that if I send something in plaintext then I am a wanker............... if I force someone to decrypt it first, I ensure they get at least 10~20:xbones:Quote:
It takes an incredible amount of resources to do efficiently and safely, and it can surprisingly make security worse (not to mention a false sense of security) if done poorly
I am afraid that it is the old CYA concept, and if these guys can't even do that....................? :eek:
To use a full-quality encryption method on any and all data for an entire government organization is realistically a pretty large resource leap when you talk about its entirety. As easy as it seems for people like us, getting every single user of the network to have a perfect adherence record is a bit more challenging. To enforce it technologically is also moderately difficult.
To employ a means of encryption unsuited for the task, as well, lures the group into a false sense of security. On one hand, it is simply helpful to eschew data 'attackers,' but can equally so lull one into a sense of security that may dissuade one from using other means. This is, of course, no excuse not to do it. Any push forward is beneficial. However, given the manner in which the data is lost, encryption (or lack of) is not the root of the issue. It is a very powerful band-aid, but it still does not ail the viral stupidity and insecurity in all other forms of data handling on the user/employee end.
I do not believe that anybody is suggesting that. If your data isn't secure whilst it is on your site then you have a quite different problem. Encryption will not help resolve it.Quote:
To use a full-quality encryption method on any and all data for an entire government organization is realistically a pretty large resource leap when you talk about its entirety.
The purpose of encryption is to protect confidential data whilst it is in transit and offsite. That is relatively infrequent and would not be difficult to implement.
You do not seem to appreciate that within the British Government there is a very strict hierarchy. For example who can sign on behalf of a department or section, who can authorise the destruction or transfer of data and so on.
Ultimately it is the person who authorises the transfer of data who is responsible for its security. Obviously the chain of command has broken down in this instance.