BBC List of missing data misses out MP'S expenses

The BBC has put out a list of data missing in recent months from various Government systems. The list itself is already large enough without also adding the biggie that they have missed of all the data from MP's Expenses or Scamalot that was also strangely mislaid. This data, as I have said before, is not just a little extract but the complete contents of a database or system and should be hugely worrying to both the authorities and the general public.

Add to this list all the data that the NHS so regularly loses and we have a prospect of chaos as more and more data is stored by the government.

DO NOT TRUST THEM WITH ANY OF YOUR DATA. THEY WILL LOSE IT.

Here are other cases to emerge in the recent past:

MAY 2009: RAF PERSONNEL DATA

It emerged that data lost from RAF Innsworth in Gloucestershire the previous September included 500 highly sensitive files, containing details of individuals' extra-marital affairs, debts and drug use.

An internal MoD memo passed to the BBC warned that the material "provides excellent material for Foreign Intelligence Services and blackmailers".

On the same day, a report from the Information Commissioner told the NHS to improve its data security, after the watchdog took action against 14 NHS organisations in the last six months.

JANUARY 2009: PRISONER MEDICAL RECORDS

A health worker in Lancashire lost a memory stick containing the medical details of more than 6,000 prisoners and ex-prisoners from HMP Preston.

The data was encrypted, but the password had been written on a note which was attached to the stick when it was misplaced.

NOVEMBER 2008: GOVERNMENT COMPUTER PASSWORDS

A memory stick - holding passwords for a government computer system - was found in the car park of a pub in Staffordshire.

The Gateway website gives access to services including tax returns and child benefits. The memory stick was lost by an employee of a subcontractor called Atos Origin.

OCTOBER 2008: MINISTRY OF DEFENCE DATA

A computer hard drive containing the personal details of about 100,000 of the Armed Forces was reported missing during an audit carried out by IT contractor EDS.

It is thought to contain more than 1.5m pieces of information, possibly unencrypted, including the details of 600,000 potential recruits, a small amount of information about bank details, passport numbers, addresses, dates of birth, driving licence details and telephone numbers.

The Ministry of Defence police said it was investigating the disappearance but it is not yet known whether or not it was stolen.

SEPTEMBER 2008: JUSTICE AND RAF EMPLOYEE DETAILS

The government confirmed that a portable hard drive holding details of up to 5,000 employees of the justice system was lost in July 2007.

The details of employees of the National Offender Management Service in England and Wales, including prison staff, were lost by a private firm, EDS.

Officials only realised the data was missing in July of this year. Justice Secretary Jack Straw launched an inquiry.

Also this month, the MoD admitted that tens of thousands of personnel files had been lost from RAF Innsworth in Gloucestershire.

Hard disks containing the data, which included names, addresses and some bank account details, were taken from a secure area.

AUGUST 2008: DATA ON CRIMINALS

Home Office contractor PA Consulting admitted losing a computer memory stick containing information on all 84,000 prisoners in England and Wales.

It also held personal details of about 10,000 prolific offenders.

The Home Office suspended the transfer of all further data to the private firm pending the outcome of an investigation.

An Information Commissioner's investigation later ruled that the Home Office had broken data protection laws over the incident and must sign a formal undertaking to improve its procedures in future.

JULY 2008: MEMORY STICKS AND LAPTOPS

The Ministry of Defence confirmed that 121 computer memory sticks and more than twice as many laptops than previously thought have been lost or stolen in the past four years.

Armed Forces Minister Bob Ainsworth gave a written statement to parliament saying 121 USB memory devices had gone astray - five of which contained secret data.

And in a parliamentary written answer, Defence Secretary Des Browne said 747 laptops had been stolen - 400 more than originally reported. Of those, 32 have been recovered so far.

JUNE 2008: TERROR DOCUMENTS

A senior intelligence officer from the Cabinet Office was suspended after documents were left on the seat of commuter train from London Waterloo. A passenger later handed them to the BBC.

The seven-page file, classified as "UK Top Secret", contained a report entitled "Al-Qaeda Vulnerabilities" and an assessment of the state of Iraq's security forces.

Cabinet Minister Ed Miliband said there had been a "clear breach" of security rules, which forbid the removal of such documents from government premises.

But Mr Miliband said national security did not seem to be "at risk".

Two inquiries - one by the Cabinet Office, the other by the Metropolitan Police - have been launched.

APRIL 2008: MCDONALD'S LAPTOP

An Army captain's laptop was taken from under his chair as he ate in a McDonald's, near the Ministry of Defence's Whitehall headquarters.

The MoD said the data on the laptop was not sensitive, and was fully encrypted.

This is the latest MoD laptop theft to be made public and it came after the government tightened the rules on employees taking computers out of work.

Whitehall staff are now banned from taking unencrypted laptops or drives containing personal data outside secured office premises.

JANUARY 2008: MILITARY RECRUITS

A laptop computer belonging to a Royal Navy officer was stolen from car in Edgbaston, Birmingham.

It contained the personal details of 600,000 people who had expressed an interest in, or applied to join, the Royal Navy, Royal Marines and the RAF.

It contained data including passport numbers, National Insurance numbers and bank details.

Defence Secretary Des Browne later admitted the inquiry into the loss of the Royal Navy officer's laptop uncovered two similar thefts since 2005.

At the time, Dr Liam Fox, shadow defence secretary, said 68 MoD laptops had been stolen in 2007, 66 in 2006, 40 in 2005 and 173 in 2004.

DECEMBER 2007: DRIVING TEST CANDIDATES

The details of three million candidates for the UK driving theory test went missing in the US.

Names, addresses and phone numbers - but no financial information - were among the details stored on a computer hard drive, which belonged to a contractor working for the Driving Standards Agency.

The information was sent electronically to contractor Pearson Driving Assessments in Iowa and the hard drive was then sent to another state before being brought back to Iowa, where it went missing.

Ministers said the information had been formatted specifically to meet the security requirements of Pearson Driving Assessments and was not "readily usable or accessible" by third parties.

NOVEMBER 2007: CHILD BENEFIT RECORDS

HM Revenue and Customs (HMRC) lost two computer discs containing the entire child benefit records, including the personal details of 25 million people - covering 7.25 million families overall.

The two discs contained the names, addresses, dates of birth and bank account details of people who received child benefit. They also included National Insurance numbers.

They were sent via internal mail from HMRC in Washington, north-east England, to the National Audit Office in London on 18 October, by a junior official, and never arrived.

The Metropolitan Police were informed of the loss in November and extensive searches began.

In December, a reward of £20,000 was offered for the return of the two discs, but they were never recovered.

This list is only the tip of the Iceberg.

BBC NEWS UK Previous cases of missing data

Incompetence and Systemic failure at the heart of this government

As the Shadow Chancellor, whilst commenting on the Poytner Report into the loss of Child Benefit data, said this afternoon the loss of data by HMRC is symptomatic of nothing less than

"incompetence and systemic failure at the heart of this government"
They were "a guide to how not to govern this country",

Alistair Darling called for a

"change of culture" across Whitehall so that "security is first and foremost in people's minds"

following a string of further data breaches, including officials losing lap top computers.

Darling also tried to say that private organisations were no better than HMRC this is refuted by a single line in the report which says

HMRC has completed an assessment of where it stands today vis-à-vis ISO27002(International Standard for Security Framework) and has concluded that it lags well behind the majority of large private sector organisations...

As usual this government tries to lie its way out of trouble that it has caused. Initially Mr Darling told us, when he briefed MPs on the loss in November,

a "junior official" had been responsible for posting the information "contrary to all HMRC standing procedures"

Then again Alistair Darling is not the root cause of the problem, we only have to look at who was responsible for HMRC for 10 long years, yes of course that man of courage Gordon Brown, who left Alistair Darling on his own to give this apology and statement.

The Poynter report on the Child Benefit data loss by HMRC has no less than 45 recommendations all of which have been accepted. This points to complete management breakdown and a total lack of responsibility in the department.

Let's look at some of the factors

• Some DSSM and IDG policies lacked sufficient detail and strength to guide staff.
• Inadequacy of removable media and encryption policies.
• Better implementation and enforcement of policy is required.
• Policy could be made more accessible and better communicated.
• Appropriate authorisation.
• Method of data transfer.
• Prioritisation of operational delivery over information security.
• Lack of policy awareness.
• Lack of training.
• Accountability for the ownership and guardianship of data.
• Lack of clarity surrounding authority requirements.
• Relations with the NAO.

Now that's a fair list and leads us to easily conclude that this was a disaster waiting for an opportunity. In fact as the report says, even after the loss of the 2 discs, staff still sent out essentially the same data with no protection.

The wider review makes it very clear what the problems are:

• Information security, at the time of the incident, simply wasn’t a management priority;
• Even had it been a priority, HMRC’s organisational design and the governance and accountabilities underpinning it would have made it extremely difficult for it to be felt as such;
• Even with a more suitable organisational structure, the fragmentation and complexity that has accompanied the changes that HMRC has had to absorb makes information security difficult to control;
• HMRC’s information security policies were inadequate and those that they had were unduly complex and not adequately translated into guidance or training for the junior officials who needed them;
• HMRC continues to operate processes that hark back to a paper-based, rather than a digital, world; and
• Morale is low in HMRC and management needs to continue to focus on engaging with staff as the department embarks on a period of further change.

In other words Information Security just wasn't part of the work ethic. This in an establishment that is handling secure data each and every day. Poynter says in his report

As regrettable as the Child Benefit data loss incident was, one positive may yet flow from it. It may provide the burning platform for these transformations, recognising it as an imperative rather than a luxury.

This is key to understanding why the whole sorry situation occurred. The whole HMRC system is so fragmented and so full of holes that the transfer of data between agencies and within its own systems is unbelievably complex. Only by transforming this system can it ever be truly secure. Until then the whole process needs to be tightly controlled to ensure a somewhat acceptable degree of security. Some facts that bring this to life. HMRC

• Operates some 650 different systems;
• Has a further 4500 Business Developed Applications (mostly Microsoft Excel & Access), of which 550 have been classified as business critical by Business Units;
• operates from some 900 sites/offices;
• Sends out some 300 million items of mail a year.

It is no small wonder then, that when the Director of Data Security imposed a ban on non-encrypted bulk data transfers following the data loss incident, several data transfers were uncovered that senior management in HMRC was not aware were happening, including at least three regular downloads of the entire child benefit database – the same information that was reported lost in November 2007. These were regularly downloaded onto non-encrypted media and put into internal mail.

The report also highlights some of the more inefficient waysand outmoded ways HMRC handles data such as

Although the volumes have declined a little, HMRC continues to rely heavily on paper-based communications. Last year, for instance, HMRC sent out around 300 million letters and mailings to its customers, an average of 8 per household and 68 per business. The media it uses for data transfer is similarly archaic. For example, the Magnetic Media Handling operation in Longbenton, Newcastle, accepts all media (reel to reel tape, cartridges, floppy discs, CDs etc.) on which employers submit their end of year returns and could be designated a museum if the criteria were variety of media no longer generally used (media, incidentally often associated with systems incapable of creating encrypted data). Whilst part of the reason for HMRC continuing to accept such media is in response to customer demand, I strongly believe that HMRC should be stronger about which media it will and won’t accept – particularly when this can drive whether or not data can be encrypted.

As well as the media and the channels that HMRC employs, its modus operandi similarly harks backs to a pre-digital era. For instance, HMRC never seems to start from the base of the information it has. Good examples are the self-assessment process for employees where the majority of people copy their information from the P60 and P11d given them by their employer – information that HMRC already has – and Tax Credits where the application form starts from scratch although HMRC nearly always has details on that customer. Both of these examples contribute to information security risk by requiring unnecessary exchanges of data and by creating islands of information that require additional exchanges to keep them synchronised.

So not only ancient ways of taking in data but also requiring data that they already have more than once which cannot lead to anything but problems.

The recommendations of the report are nothing less than a damning indictment of the HMRC. They are long and cover
Strategy, 14 recommendations.
People, 7 recommendations.
Process, 21 yes 21 recommendations.
New Direction, 3 recommendations.

All of these recommendations have been accepted. It will take time to implement them all. Until then the security of HMRC data, our data can only be suspect.

Statement: CHX 250608

Recommendations from Child Benefit CD data loss

Recommendations from the IPCC investigation of the Child Benefit data loss are as follows, I have tried to highlight what they really mean. In one word CLUELESS.

The report does not seek to make detailed recommendations, nor does it comment on the developments needed to ensure that HMRC's systems and practices meet the challenges involved in modern-day data handling. HMRC did not have a clue what they were doing and had no idea how to deal with computer based data.

1. HMRC should review and develop a strategic working relationship with the NAO in respect of any audit of its resource accounts. HMRC should implement a strategy of communicating the detail and requirements of an audit to HMRC staff in order to facilitate audit work. Bothe agencies are clueless on how to work together. HMRC should work with the NAO to sort out how they communicate and stop losing data and providing data not required
2. HMRC should review the security controls and protocols associated with generating large volumes of data, and the subsequent handling of that data in whatever format both internally and on disclosure outside the organisation. Clueless. HMRC have no security in place and need to work out how they are going to secure their data.
3. HMRC should develop a data security strategy, training strategy and communication strategy for all HMRC staff to raise awareness and understanding of data protection and data security, and in line with the principles of the Data Protection Act. HMRC have no strategy for data security or training for people in data security.
4. HMRC should review and develop its role and responsibilities as data controller within the meaning of the Act in order to demonstrate a management commitment to information security throughout the organisation. Clueless. HMRC should read the Data Protection act and conform with it. Senior Management need to realise that they have to do some work to justify their salaries.
5. Consideration should be given to sharing this investigation report with the Information Commissioner, who is responsible for data protection issues under the Act. Clueless. HMRC should be prosecuted as a business under the Data Protection act and if this was a normal business would be heavily fined and hung out to dry. Resignations of senior IS staff etc would be expected.
6. Where breaches of security are discovered, HMRC should report these promptly so that any remedial or recovery action can be taken. This did not occur in this particular case. Clueless. HMRC did not have a clue what they were up to.

If HMRC were a run of the mill business they would now be under severe pressure. The whole management of their IS department is to blame. Where was the proper audit of this system.

This is the sort of organistation which is or will be responsible to

• Look after your health records (aka The Spine)
• Look after your DNA
• Look after ID cards

I wouldn't trust them with a single bit. They are clueless and hopeless. This is beyond parody that an enterprise entrusted with our vital data have no apparent strategy for the handling and securing of data. Both management and employees are at fault here. The management for not providing the correct structure for the proper running of the business and employees for not ceaseless complaining about this lack of structure.

Alistair Darling has called this a "Cultural" problem. I call it criminal irresponsibility. Now guess who was responsible for the merging of the two departments and was in charge of them for over 10 years. Yes, of course, it was our Jonah, Gordon Brown. He is the man ultimately responsible for this problem, however he will have retired to his Bunker again to sulk whilst leaving his underlings to face the music. A true man of Courage.

IPCC publishes report into missing HMRC data CDs (full version)

Who knows what else is out there?

It appears from this report in the Guardian that it was a junior civil servant who made the cock-up and sent the data to the National Audit Office. Apparently

"This individual should not have been involved. It was none of their business. They should have forwarded it on to someone else - another group of civil servants at a more senior level."

"The HMRC office is a huge office with 200 people and there is a nominated team that send items between us and other departments. The individual in question had nothing to do with that team and the it was completely outside their job remit."... ...

And on it goes about how they shouldn't have done this and etc and etc.

This is just not the point. No official should have the capability to do this in HMRC without having gone through a whole range of audited steps. No official, however high in the organisation, should have the ability to do this on a whim at any time. It is a complete breakdown of Security and not just a case of "not following procedures".

It is not just a case of a silly person doing something silly it is about an organisation that is criminally incompetent.

The only saving grace is that we know about this incident.

What about the untraced copies of data that could have taken by, it seems, any member of this organisation and have already been supplied to those who could profit from this data. Who can tell what is out there if it was only procedures that are supposed to stop this type of data extraction.

Civil servant who made the 'colossal error' | Special Reports | Guardian Unlimited Politics

Major Operational Problem?

What more can go wrong for this Government?

"Intriguing news. Alastair Darling is to make a second and unexpected statement to the Commons this afternoon. It is not about Northern Rock but is, I'm told, about a 'major operational problem' at Her Majesty's Revenue and Customs. One rumour (and it is, I stress, no more than a rumour) has it that it is about 'data loss'."

Update: More discussion on this here

According to the BBC

Confidential details of 15 million child benefit recipients are on a computer disc lost by HM Revenue and Customs, the BBC understands.The chairman of revenue and customs, Paul Gray, has resigned.

Update 2: According to Darling all Child Benefit names have been "lost" includes parents/children and basically all the details you would need to raid an account or set up a new account. This is a disaster waiting to occur and apparently this is the second time it has happened.