How worried should people be?

**TheAtheist** · 11-20-2007, 12:47 PM

Quote:

The loss, by HM Revenue and Customs, of computer discs with details of about 25m child benefit recipients, is the biggest loss yet of personal data in the UK.

Now the Chancellor, Alistair Darling, is now trying to reassure millions of families whose details have been lost.

He said there was no evidence the discs had fallen into the wrong hands or that the information had been used for fraud.

To be honest, i'm appalled. We, the normal public, are constantly reminded of the danger of identity fraud, and i'm guessing most peoples data in their own home is more securely held than the methods used by the person who "encrypted" this disc - they used a single password system. You'd think a large government like the british, would be able to look after its own peoples data, especially when that data relates to their bank statements and bank details.

more details :
http://news.bbc.co.uk/1/hi/business/7103940.stm

**EnglishPaul** · 11-22-2007, 05:07 AM

I think this is story is just a storm in a teacup. The disk is unlikely to be stolen, it's just another lost parcel by TNT. What is more significant is that the person able to download all the data to disk probably earns about £20k, and such data on the black market would fetch...
The civil service does need to tighten up its security and procedures. But the risk of this particular incident is low. It's just a question of how many other unreported incidents have occurred.
In a funny way this incident actually argues for biometric data as proof of identity. It is far harder to defeat.

**Glaswegian** · 11-22-2007, 06:33 AM

The bigger risk here is identity fraud, not money being taken from bank accounts - an issue that the Government has so far ignored. And they say ID cards will help security?!?!?!

**Kalim** · 11-22-2007, 12:35 PM

I dislike the way they try to play down their errors and dupe the masses. It is a lie that the money or identity cannot be stolen, anyone having access to an accountancy and the internet can defraud thousands from one account and personal information can easily matter millions around the world. They should run an investigation to how and who was at fault because this is kindergarten.

**TheAtheist** · 11-22-2007, 03:01 PM

The labour party has tried to lay blame automatically at the door of the junior member who actually sent the two cds, when really the blame should lie with the guy in charge, who has resigned as it happens. If the correct procedures had been followed with data security then this should never had happened.

**EnglishPaul** · 11-22-2007, 04:00 PM

Quote:

Originally Posted by TheAtheist

when really the blame should lie with the guy in charge, who has resigned as it happens.

It always surprises me when the MD resigns over an operational error made by a junior.
If some spotty kid spits in my fries, I hardly expect Ronald McDonald to take off his colourful clothes and resign.

**TheAtheist** · 11-23-2007, 02:45 AM

But to be honest paul, i dont think this was an operational error by a junior, that junior should never have been able to make such a mistake, and if the systems arent in place to stop him doing this, then doesnt that show that something is clearly wrong within the business?

**EnglishPaul** · 11-23-2007, 04:04 PM

It does show that the department had a low regard for data protection. If it was a concern then they would have got people to test their procedures for loopholes.
I doubt that HMRC are unique in their lack of concern for data protection.

None the less, I still stand by my generalization that by the figurehead offering a 'token' resignation, nothing is actually solved. A real leader would stay and clear up the mess. The only time for a resignation is if they did a completely useless job.

**TheAtheist** · 11-24-2007, 08:43 AM

It gets worse - now they have confirmed they have lost a further 6 discs of data

Quote:

HM Revenue and Customs has confirmed that a further six data discs have gone missing in transit between its offices in Preston and London.
The discs, transported by courier company TNT, contained recorded conversations between a member of staff and a customer making a complaint

http://news.bbc.co.uk/1/hi/uk_politics/7111056.stm

**Kalim** · 11-24-2007, 12:52 PM

Not necessarily Paul (to the first para of your last response). :)
Where you have thousands working in conjunction to complete a process it only takes one slacker to make an error which results in something like this. You can take the Post Office as a good example. I've worked in a more secure position than that in the UK to know this first hand and you are often left in a helpless position. Where they really fall back is how they investigate, insure against reoccurrence of and deal with such matters. They have major problems here, leniency, apathy to a certain degree and euphemistic disregard being a few. We're all human and not everyone understands what another does, but some of these people shoved into work segments like cattle on a farm really have no clue about morals, ethics, values, principles and decent procedures outside of their daily work.
We need something to insure good initial parenting which is what will fight most problems we have rather than make punishments for it after it's already happened and a way of life for someone. Redesigning and reversing a humans mind, experiences, teachings and base values is very difficult past youth-hood (without torture). Punishments are only valid and effective if the person committing a crime was taught better with reasoning beforehand.

From what I'm hearing it seems the security is compromised from a body or group of bodies within. The major bodies trafficking such possessions won't be the ones making use of them, they just sell them. The main bodies will be "networks", "barons" and "gangs".

**TheAtheist** · 11-24-2007, 01:21 PM

There was, as you put it kalim, the suggestion initally that there was an inside job on this one, but that appears not to be the case. I just dont understand how a superpower government can manage to lose all this data, when really the security measures needed to work against it aint exactly expensive, when you consider how expensive this could turn out to be, if fraud is ever commited with this set of data

And woot, my 1000th post

**Kalim** · 11-24-2007, 03:59 PM

It's quite easy. We're humans, all of us. The person you place in charge of anything no matter how secure it be is human too, just like you, even if it's a computer [s]he operates. They can do good or bad, it's a choice and where you follow "each for his own" you'll find thousands of instances where they will get far more for jeopardizing anyones health or security than if they stuck to a company policy. Unfortunately people will and do follow this on many occasions. Security within that branch is too tight for it not to be an inside job to some extent, by that I mean, facilitated or made possible by someone within. Without that, it's quite impossible for so many failures to occur concurrently, it's a long planned happening. One disc would be believable but by what I'm aware of the running, what the reports are saying is quite impossible unless it be compromised within.
However, even it it turns out to be this way, you won't find the government forthcoming to let you know. It gives them too bad a name destroying their trust and throws havoc in the general public to do so. Not just GB, but in any world government.

11-22-2007, 05:07 AM	#2 (permalink)
EnglishPaul Still no avatar Join Date: Sep 2007 Location: Sheffield Posts: 1,314 OS: XP SP2 Blog Entries: 9	Re: How worried should people be? I think this is story is just a storm in a teacup. The disk is unlikely to be stolen, it's just another lost parcel by TNT. What is more significant is that the person able to download all the data to disk probably earns about £20k, and such data on the black market would fetch... The civil service does need to tighten up its security and procedures. But the risk of this particular incident is low. It's just a question of how many other unreported incidents have occurred. In a funny way this incident actually argues for biometric data as proof of identity. It is far harder to defeat.

11-22-2007, 06:33 AM	#3 (permalink)
Glaswegian Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic Join Date: Sep 2005 Location: Glasgow Posts: 25,499 OS: Win XP Pro SP3 / Win 7 Pro My System Blog Entries: 10	Re: How worried should people be? The bigger risk here is identity fraud, not money being taken from bank accounts - an issue that the Government has so far ignored. And they say ID cards will help security?!?!?! __________________ Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner

11-22-2007, 12:35 PM	#4 (permalink)
Kalim Roaming To Help Join Date: Nov 2006 Posts: 5,642 OS: Many	Re: How worried should people be? I dislike the way they try to play down their errors and dupe the masses. It is a lie that the money or identity cannot be stolen, anyone having access to an accountancy and the internet can defraud thousands from one account and personal information can easily matter millions around the world. They should run an investigation to how and who was at fault because this is kindergarten.

11-22-2007, 03:01 PM	#5 (permalink)
TheAtheist Mentor, Articles Team Join Date: May 2006 Location: Portishead, Bristol Posts: 1,317 OS: xp sp3 My System	Re: How worried should people be? The labour party has tried to lay blame automatically at the door of the junior member who actually sent the two cds, when really the blame should lie with the guy in charge, who has resigned as it happens. If the correct procedures had been followed with data security then this should never had happened. __________________ Submit New Articles "Freedom of thought is best promoted by the gradual illumination of men's minds, which follows from the advance of science" - Darwin Join the TSF folding team - Team 85015

11-23-2007, 02:45 AM	#7 (permalink)
TheAtheist Mentor, Articles Team Join Date: May 2006 Location: Portishead, Bristol Posts: 1,317 OS: xp sp3 My System	Re: How worried should people be? But to be honest paul, i dont think this was an operational error by a junior, that junior should never have been able to make such a mistake, and if the systems arent in place to stop him doing this, then doesnt that show that something is clearly wrong within the business? __________________ Submit New Articles "Freedom of thought is best promoted by the gradual illumination of men's minds, which follows from the advance of science" - Darwin Join the TSF folding team - Team 85015

11-23-2007, 04:04 PM	#8 (permalink)
EnglishPaul Still no avatar Join Date: Sep 2007 Location: Sheffield Posts: 1,314 OS: XP SP2 Blog Entries: 9	Re: How worried should people be? It does show that the department had a low regard for data protection. If it was a concern then they would have got people to test their procedures for loopholes. I doubt that HMRC are unique in their lack of concern for data protection. None the less, I still stand by my generalization that by the figurehead offering a 'token' resignation, nothing is actually solved. A real leader would stay and clear up the mess. The only time for a resignation is if they did a completely useless job.

11-24-2007, 12:52 PM	#10 (permalink)
Kalim Roaming To Help Join Date: Nov 2006 Posts: 5,642 OS: Many	Re: How worried should people be? Not necessarily Paul (to the first para of your last response). :) Where you have thousands working in conjunction to complete a process it only takes one slacker to make an error which results in something like this. You can take the Post Office as a good example. I've worked in a more secure position than that in the UK to know this first hand and you are often left in a helpless position. Where they really fall back is how they investigate, insure against reoccurrence of and deal with such matters. They have major problems here, leniency, apathy to a certain degree and euphemistic disregard being a few. We're all human and not everyone understands what another does, but some of these people shoved into work segments like cattle on a farm really have no clue about morals, ethics, values, principles and decent procedures outside of their daily work. We need something to insure good initial parenting which is what will fight most problems we have rather than make punishments for it after it's already happened and a way of life for someone. Redesigning and reversing a humans mind, experiences, teachings and base values is very difficult past youth-hood (without torture). Punishments are only valid and effective if the person committing a crime was taught better with reasoning beforehand. From what I'm hearing it seems the security is compromised from a body or group of bodies within. The major bodies trafficking such possessions won't be the ones making use of them, they just sell them. The main bodies will be "networks", "barons" and "gangs".

11-24-2007, 01:21 PM	#11 (permalink)
TheAtheist Mentor, Articles Team Join Date: May 2006 Location: Portishead, Bristol Posts: 1,317 OS: xp sp3 My System	Re: How worried should people be? There was, as you put it kalim, the suggestion initally that there was an inside job on this one, but that appears not to be the case. I just dont understand how a superpower government can manage to lose all this data, when really the security measures needed to work against it aint exactly expensive, when you consider how expensive this could turn out to be, if fraud is ever commited with this set of data And woot, my 1000th post __________________ Submit New Articles "Freedom of thought is best promoted by the gradual illumination of men's minds, which follows from the advance of science" - Darwin Join the TSF folding team - Team 85015

11-24-2007, 03:59 PM	#12 (permalink)
Kalim Roaming To Help Join Date: Nov 2006 Posts: 5,642 OS: Many	Re: How worried should people be? It's quite easy. We're humans, all of us. The person you place in charge of anything no matter how secure it be is human too, just like you, even if it's a computer [s]he operates. They can do good or bad, it's a choice and where you follow "each for his own" you'll find thousands of instances where they will get far more for jeopardizing anyones health or security than if they stuck to a company policy. Unfortunately people will and do follow this on many occasions. Security within that branch is too tight for it not to be an inside job to some extent, by that I mean, facilitated or made possible by someone within. Without that, it's quite impossible for so many failures to occur concurrently, it's a long planned happening. One disc would be believable but by what I'm aware of the running, what the reports are saying is quite impossible unless it be compromised within. However, even it it turns out to be this way, you won't find the government forthcoming to let you know. It gives them too bad a name destroying their trust and throws havoc in the general public to do so. Not just GB, but in any world government.