Incompetence and Systemic failure at the heart of this government

As the Shadow Chancellor, whilst commenting on the Poytner Report into the loss of Child Benefit data, said this afternoon the loss of data by HMRC is symptomatic of nothing less than

"incompetence and systemic failure at the heart of this government"
They were "a guide to how not to govern this country",

Alistair Darling called for a

"change of culture" across Whitehall so that "security is first and foremost in people's minds"

following a string of further data breaches, including officials losing lap top computers.

Darling also tried to say that private organisations were no better than HMRC this is refuted by a single line in the report which says

HMRC has completed an assessment of where it stands today vis-à-vis ISO27002(International Standard for Security Framework) and has concluded that it lags well behind the majority of large private sector organisations...

As usual this government tries to lie its way out of trouble that it has caused. Initially Mr Darling told us, when he briefed MPs on the loss in November,

a "junior official" had been responsible for posting the information "contrary to all HMRC standing procedures"

Then again Alistair Darling is not the root cause of the problem, we only have to look at who was responsible for HMRC for 10 long years, yes of course that man of courage Gordon Brown, who left Alistair Darling on his own to give this apology and statement.

The Poynter report on the Child Benefit data loss by HMRC has no less than 45 recommendations all of which have been accepted. This points to complete management breakdown and a total lack of responsibility in the department.

Let's look at some of the factors

• Some DSSM and IDG policies lacked sufficient detail and strength to guide staff.
• Inadequacy of removable media and encryption policies.
• Better implementation and enforcement of policy is required.
• Policy could be made more accessible and better communicated.
• Appropriate authorisation.
• Method of data transfer.
• Prioritisation of operational delivery over information security.
• Lack of policy awareness.
• Lack of training.
• Accountability for the ownership and guardianship of data.
• Lack of clarity surrounding authority requirements.
• Relations with the NAO.

Now that's a fair list and leads us to easily conclude that this was a disaster waiting for an opportunity. In fact as the report says, even after the loss of the 2 discs, staff still sent out essentially the same data with no protection.

The wider review makes it very clear what the problems are:

• Information security, at the time of the incident, simply wasn’t a management priority;
• Even had it been a priority, HMRC’s organisational design and the governance and accountabilities underpinning it would have made it extremely difficult for it to be felt as such;
• Even with a more suitable organisational structure, the fragmentation and complexity that has accompanied the changes that HMRC has had to absorb makes information security difficult to control;
• HMRC’s information security policies were inadequate and those that they had were unduly complex and not adequately translated into guidance or training for the junior officials who needed them;
• HMRC continues to operate processes that hark back to a paper-based, rather than a digital, world; and
• Morale is low in HMRC and management needs to continue to focus on engaging with staff as the department embarks on a period of further change.

In other words Information Security just wasn't part of the work ethic. This in an establishment that is handling secure data each and every day. Poynter says in his report

As regrettable as the Child Benefit data loss incident was, one positive may yet flow from it. It may provide the burning platform for these transformations, recognising it as an imperative rather than a luxury.

This is key to understanding why the whole sorry situation occurred. The whole HMRC system is so fragmented and so full of holes that the transfer of data between agencies and within its own systems is unbelievably complex. Only by transforming this system can it ever be truly secure. Until then the whole process needs to be tightly controlled to ensure a somewhat acceptable degree of security. Some facts that bring this to life. HMRC

• Operates some 650 different systems;
• Has a further 4500 Business Developed Applications (mostly Microsoft Excel & Access), of which 550 have been classified as business critical by Business Units;
• operates from some 900 sites/offices;
• Sends out some 300 million items of mail a year.

It is no small wonder then, that when the Director of Data Security imposed a ban on non-encrypted bulk data transfers following the data loss incident, several data transfers were uncovered that senior management in HMRC was not aware were happening, including at least three regular downloads of the entire child benefit database – the same information that was reported lost in November 2007. These were regularly downloaded onto non-encrypted media and put into internal mail.

The report also highlights some of the more inefficient waysand outmoded ways HMRC handles data such as

Although the volumes have declined a little, HMRC continues to rely heavily on paper-based communications. Last year, for instance, HMRC sent out around 300 million letters and mailings to its customers, an average of 8 per household and 68 per business. The media it uses for data transfer is similarly archaic. For example, the Magnetic Media Handling operation in Longbenton, Newcastle, accepts all media (reel to reel tape, cartridges, floppy discs, CDs etc.) on which employers submit their end of year returns and could be designated a museum if the criteria were variety of media no longer generally used (media, incidentally often associated with systems incapable of creating encrypted data). Whilst part of the reason for HMRC continuing to accept such media is in response to customer demand, I strongly believe that HMRC should be stronger about which media it will and won’t accept – particularly when this can drive whether or not data can be encrypted.

As well as the media and the channels that HMRC employs, its modus operandi similarly harks backs to a pre-digital era. For instance, HMRC never seems to start from the base of the information it has. Good examples are the self-assessment process for employees where the majority of people copy their information from the P60 and P11d given them by their employer – information that HMRC already has – and Tax Credits where the application form starts from scratch although HMRC nearly always has details on that customer. Both of these examples contribute to information security risk by requiring unnecessary exchanges of data and by creating islands of information that require additional exchanges to keep them synchronised.

So not only ancient ways of taking in data but also requiring data that they already have more than once which cannot lead to anything but problems.

The recommendations of the report are nothing less than a damning indictment of the HMRC. They are long and cover
Strategy, 14 recommendations.
People, 7 recommendations.
Process, 21 yes 21 recommendations.
New Direction, 3 recommendations.

All of these recommendations have been accepted. It will take time to implement them all. Until then the security of HMRC data, our data can only be suspect.

Statement: CHX 250608

42 days may be illegal - Brown turns a blind eye

Seems strange that only the Scotsman has picked this up, but apparently MP's have ruled that the law changes proposed to the detention rules to extend them from 28 to 42 days may be illegal as they don't comply with the European Convention on Human Rights.

This is not the first time that a proposed new law has faced this problem but it does seem to be something that Labour keeps falling foul of.

The report says the longer period could be triggered too easily, noting that under the Convention this should happen only when there was a

"public emergency threatening the life of the nation".

There was no new judicial protection preventing suspects from arbitrary detention, and the government had failed to provide evidence that the terror threat was growing.

Andrew Dismore MP, the committee chairman, said:

"The proposed extension to 42 days would almost certainly not be lawful."

What this means to the Prime Minister is that even if he does manage to get these laws through the Common he may still face attacks on them from two other places as it is highly likely that the House of Lords will reject the changes as well.

What I don't understand is why the Prime Minister is fighting this fight. It does nothing for him. It does not show him being a man of "courage" or "strong" all it shows is an obstinate fool who can't take advice from others.

The Prime Minister just not have the courage to admit when he is wrong as we have seen on a number of occasions. This is a deeply worrying trait in a man who could be in charge of the country for a further two year. I worry that when the Tories do get elected to govern that this country will be in an almighty mess because of the rule of this deeply flawed supposed Leader.

John Kampfner writing in the Guardian puts it nicely

For all Brown's more emollient style, the end result will be the same. Britain will continue its sleepwalk to becoming one of the most policed, bugged, watched and imprisoned "democratic" nations on earth.

What is most tragic is that I have seen no evidence from people close to Brown that he actually believes any of this. He has been sucked into this position by fear, by his habit of media triangulation. Instead of standing up for what he believes to be right, he seeks to second-guess one or two influential media barons. In that respect he is indistinguishable from Blair, except that Blair's personal hubris gave him more leeway. Politicians who lack moral courage are rarely rewarded. Forget the policy; this is stupid politics.

MPs rule terror law changes are illegal - Scotsman.com News

Inheritance Tax takes blame

The Conservaties have bounced back to level with Brown according to an ICM poll in the Guardian which gives each party 38% of the poll.

According to Brown's spinners this is entirely due to the Tory announcement on inheritance tax and the promise that only millionaires would have to pay death duties.

Now if only life was this easy, you offer someone a tax cut and they immediately are your bosom buddy for life. If this was the case Gordon would have everyone voting for him as he has handed out so many (empty) promises over the years.

Gordon will now be faced with the quandary of how to back out of an election that he has been spinning and preparing for with the least damage.

He will have to settle for the remainder of the 2 1/2 years that Labour have and face the polls in 2010, possibly even resigning before the next election, if the polls look bad, stating he has finished the job he started, and wants to pass the reins to younger blood.

His problem is that his courage has failed him again like after the loss of John Smith and during the "phoney" war with Tony Blair.

If he had had some courage he would have announced the election today before the polls came out that make it obvious he will lose much or all of his majority in Parliament. Having had his courage fail him again all excuses will be null and void apart from the fact he might lose his majority.

Cameron bounces back | Special Reports | Guardian Unlimited Politics

Benedict says No Election

Benedict Brogan in the Daily Mail says there will be no election this year. He has spoken to the Labour spinners and they are indicating:

• Brown Central is convinced that George Osborne has given them all the ammunition they need for a protracted demolition campaign centred on the "fantasy" costings behind his tax cut proposals. Some are even seeing it as a Black Wednesday moment that will prove to be as disastrous for the credibility of the Cameron/Osborne generation as 1992 was for John Major and his lot.(Hmm from the figures seen so far anyone could be right, but it will not be a major factor)
  
• Labour polling in its key marginals has produced mixed results, and not the clear evidence of a big win some MPs suggested last week. (This will be key)
  
• I understand the CSR has been decoupled from an election announcement. Alistair Darling has been told he can go ahead, probably Monday, regardless of what Mr Brown does. The CSR no longer means there will automatically be an election. (Who Cares)
  
• Mr Brown's advisers believe that there is not enough time between now and November1/8 to persuade the public that Mr Osborne's inheritance tax giveaway is not what it's cracked up to be.(If they can't do it now no-one will believe them)
  
• They also believe that once they get past the initial "he's bottled out" jeering, politics will return to normal and within months the public will have forgotten the excitement we have been living through in Bournemouth and Blackpool. (They may be right but people will be reminded, whenever he has another Macavity Moment)
  
• Mr Brown has been keeping a keen eye on events elsewhere, no least the spread of foot and mouth, the political situation in Scotland, and the evidence that suggests the public is not clamouring for a contest. (Grasping at straws here, though the Scotland situation will be worrying Brown)
  

Reading through this we get the message, Brown has bottled it, the polls are against him, he knows he will struggle in a straight fight against Cameron for top billing and fears a top three entry in the charts for shortest reign as a Prime Minister or a loss of Prestige as Blair's majority is lost. Courage is not his middle name.

Brown will choose the easy option and wait as long as possible, he has already had to wait ten years to finally get where he wanted, why lose it all now.


Benedict Brogan's political blog

Lost Moral Compass

Brown loses grip

Lost Moral Compass, no reward for finding. Please return to Gordon Brown, last seen heading Middle-Eastwards. Courage is also reported as ready to desert as well. Conviction has well and truly been squashed.

Promises forgotten and Covenants broken a specialty.