HMRC disc loss was 'entirely avoidable'

**Glaswegian** · 06-26-2008, 03:02 PM

Systematic failures and "woefully inadequate" processes for handling data at HM Revenue and Customs (HMRC) led to the loss of personal details of 25 million people, according to two scathing reports published Wednesday.

Fragmented and complex IT systems made it difficult for the organisation to identify and manage its information security risks, the Poynter report stated.

The report - which highlighted serious structural failings at HMRC offices and said the loss was "entirely avoidable" - was the result of a review into HMRC's security procedures by PricewaterhouseCoopers chairman, Kieran Poynter, in consultation with the Independent Police Complaints Commission (IPCC).

Another report by the IPCC also dealt HMRC a heavy blow, stating information security "simply wasn't a management priority". The IPCC report looked into the series of events that lead up to the loss of data to consider whether any criminal conduct or disciplinary offenses had been committed by HMRC staff.

While IPCC found no evidence of criminal misconduct, it said corporate data handling was "clearly woefully inadequate."

http://www.techworld.com/security/ne...&NewsID=102025

06-26-2008, 03:02 PM	#1 (permalink)
Glaswegian Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic Join Date: Sep 2005 Location: Glasgow Posts: 25,568 OS: Win XP Pro SP3 / Win 7 Pro My System Blog Entries: 10	HMRC disc loss was 'entirely avoidable' Systematic failures and "woefully inadequate" processes for handling data at HM Revenue and Customs (HMRC) led to the loss of personal details of 25 million people, according to two scathing reports published Wednesday. Fragmented and complex IT systems made it difficult for the organisation to identify and manage its information security risks, the Poynter report stated. The report - which highlighted serious structural failings at HMRC offices and said the loss was "entirely avoidable" - was the result of a review into HMRC's security procedures by PricewaterhouseCoopers chairman, Kieran Poynter, in consultation with the Independent Police Complaints Commission (IPCC). Another report by the IPCC also dealt HMRC a heavy blow, stating information security "simply wasn't a management priority". The IPCC report looked into the series of events that lead up to the loss of data to consider whether any criminal conduct or disciplinary offenses had been committed by HMRC staff. While IPCC found no evidence of criminal misconduct, it said corporate data handling was "clearly woefully inadequate." http://www.techworld.com/security/ne...&NewsID=102025 __________________ Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner