Shambolic HMRC loses yet another CD
It’s well documented on this blog, on how the UK Government department, Her Majesty's Revenue & Customs (HMRC), failed to protect my own and 15,000 others personal information,losing a couriered unencrypted CD a couple of weeks back, and then there was the incident with an unencrypted HMRC laptop going missing a couple weeks before that.
Now they have completed the hat-trick big time, this time losing a bunch of CDs holding 15 Million children benefit records, which I understand held names, address, date of birth and bank account details for around 7 million British families.
Apparently the CD went missing after being couriered between HMRC headquarters in Washington, Tyne and Wear and London, when exactly how this happened isn’t clear yet, however ministers have known about the problem for 9 to 10 days. I understand another HMRC internal investigation is underway, while the police are still investigating.
So yet again the CD was sent unencrypted and yet again I wish to highlight there are more efficient, cheaper and secure ways of sending personal data, as well as the totally unacceptable and irresponsible practice employed HMRC.
So this time the HMRC chairman, Paul Gray, has resigned over this issue, and to quote him directly “I had hoped to be around for a while longer, and to have had the continuing privilege of leading HMRC towards the vision we have been developing. I am extremely proud of what all of you in the organisation have achieved during my time as deputy chairman and chairman."
The issue is being raised in parliament as I type, with Tory MP Nigel Evans saying "He should have told the public straight away in order that they could have taken precautions against anyone's information being used by ID fraudsters."
And for the Liberal Democrats, Chris Huhne told the BBC: "It is a horrendous problem; it's one of the biggest failures in a major government department that I can remember. It's an enormous delivery problem and I think that clearly that's been recognised by the head of HMRC when he resigned... I would be surprised if we did not see ministerial heads rolling as well."
I wouldn’t be surprised either, meanwhile with my own case with HMRC, I have written letters to my local MP, the Information Commissioner and the Minister responsible for data protection, I’ll report back any responses and further development. Although I expect from this point on, my issue will be completely over shadowed by this very significant incident, involving millions of peoples records.
Now they have completed the hat-trick big time, this time losing a bunch of CDs holding 15 Million children benefit records, which I understand held names, address, date of birth and bank account details for around 7 million British families.
Apparently the CD went missing after being couriered between HMRC headquarters in Washington, Tyne and Wear and London, when exactly how this happened isn’t clear yet, however ministers have known about the problem for 9 to 10 days. I understand another HMRC internal investigation is underway, while the police are still investigating.
So yet again the CD was sent unencrypted and yet again I wish to highlight there are more efficient, cheaper and secure ways of sending personal data, as well as the totally unacceptable and irresponsible practice employed HMRC.
So this time the HMRC chairman, Paul Gray, has resigned over this issue, and to quote him directly “I had hoped to be around for a while longer, and to have had the continuing privilege of leading HMRC towards the vision we have been developing. I am extremely proud of what all of you in the organisation have achieved during my time as deputy chairman and chairman."
The issue is being raised in parliament as I type, with Tory MP Nigel Evans saying "He should have told the public straight away in order that they could have taken precautions against anyone's information being used by ID fraudsters."
And for the Liberal Democrats, Chris Huhne told the BBC: "It is a horrendous problem; it's one of the biggest failures in a major government department that I can remember. It's an enormous delivery problem and I think that clearly that's been recognised by the head of HMRC when he resigned... I would be surprised if we did not see ministerial heads rolling as well."
I wouldn’t be surprised either, meanwhile with my own case with HMRC, I have written letters to my local MP, the Information Commissioner and the Minister responsible for data protection, I’ll report back any responses and further development. Although I expect from this point on, my issue will be completely over shadowed by this very significant incident, involving millions of peoples records.
Comments
Yes it certainly does beggars belief this could happen, (a) that someone junior within HMRC has access to download the whole HMRC database, and (b) the complete lack of information security awareness within the organisation. I work with private companies improving information security, I can tell you it does take too long (or much financial investment) to ensure everyone, even the most junior of employees, are fully aware of their responsibility in safeguarding data, especially personal data, which after all is protected by the Data Protection Act.
Apologies if you have already covered this: I am a new reader, courtesy of Guido and the Woman on the Raft. In that case some links are all we need.
Secondly, is there a valid business reason and justification to send the entire HMRC database to a third party? If there is, then there needs to be a clear understanding of what information needs to be shared, an appropriate secure method devised, a risk assessment applied and security controls put in place etc.
In answering the encryption question…
Using a tool like PGP (or the free version called GnuPG), will allow the encryption of data to industry standards. Encrypting with PGP/GnuPG means the data can only be read by two parties, the person encrypting it and the intended recipient. It’s what us security professionals call asymmetric encryption, i.e. using public / private keys to encrypt the data between two parties. If the data on CD was encrypted with this method, then the loss of the CD wouldn't be such a major issue. Although I must stress even posting an encrypted CD with the entire HMRC database in the post is just a completely unacceptable practice. For a small amount of data (handful of records at a time), using PGP within Email is a secure and acceptable method.
So what if I had to send / share sensitive databases and information with a third party, how to achieve this in a secure fashion. First I would apply file level encryption (PGP), so you know only the intended recipient/system can read it. Then I would seek to send the encrypted data by a “private” connection to the third party. One cheap method is to setup and use an Internet VPN, which is an encrypted link between two organisations via the internet, again very cheap to setup and operate, yet secure, as the data is actually encrypted twice during transmission over the internet. However if I was approached with a requirement to share the entire HMRC database (25 Million personal records), then I would insist on private circuit, namely a direct network connection between the two organisations.
I can waffle on about encryption until the cows come home, so let me know if you have any more questions. In fact if you want to try out GnuPG yourself, let me know.