What about the burners?

This is a start but they still need to ensure that staff use the encryption when it is available and that keys are never allowed out of the office with the encrypted data.

Even more basically they need to stop storing information that they don't need and format/index the data properly so that personal data is not transmitted (securely or otherwise) when it is not needed - as was the case in the HMRC data-dump fiasco

Finally CD burners and USB ports be claw-hammered out of every UKGov computer.

Muppets!

The phrase I'm looking for contains the words:

Horse, Gate and Bolted...

nope, it's gone and clean slipped my mind, ah well, pass the USB stick I gotta copy the database....

PH icon obviously because she's a shining example to us all at keeping highly personal data safely tucked away....

In one sentence, all that is wrong with uk.gov.it

"...Staff have been told encryption software will be installed on their machines next week...."

WTF wasn't it on them to start with ? Ideally integrated into their email and CD-burning packages ?

Personal data

Surely someone's telephone number counts as personal data? Does this mean no mobile phones containing the name and phone number of any living person can be taken off the premises?!

Best wipe everyone's contacts list then. What use is the phone now?! Sure, they can receive incoming calls, but since no-one is going to make any calls, that means no-one will receive them! ROFL!

But CDs full o'data are OK...

...according to the new guidelines?

Nice to see you to see you nice

Any reason for the stuff to be on file without the person or persons concerned being informed of it?

@But WTF by Paul

Ah, but under this guidance laptops can leave the office if the laptops hdd is encrypted.

(Even if the encryption phrase is written down on the laptop or, more likely, written on a yellow sticky accompanying the laptop - that's what happens when the focus is on encryption and not on security.)

"could apply to mobile phones too."

Er ... how do you encrypt a telephone number?

And indeed, if you encrypt the telephone number, doesn't the phone dial somebody else instead?

@ Paul / But WTF...

@ story:

"Any source of information about 1000 identifiable individuals or more [...] Clarification is being sought". Lovely. Now, I only have to worry at the moment if I'm on a list of 999 people or less.

@ Paul:

Erm, lots of organisations use laptops for preference over desktops. And many of those same organisations don't let you take them home. Just because it's a laptop doesn't mean that you *must* take it out of the office every night - usually it's so that they can walk between departments and take their laptops with them (often stuff isn't centralised on a server or their laptops are so individualised that they like to have the correctly-configured apps with them all the time; I used to work for an organisation with exactly this sort of setup, laptops for all). Don't be so naïve.

Ahem. Anyone else spotting the uk-sized loophole?

Noone employed in those affected departments are allowed to bring the data out of the hose on enencrypted passwords.

How many consultants are they currently hiring?

And, have the UK all-of-a-sudden standardized on a sane encryption scheme that couldn't be decrypted using a 1940s computer setup?

Are they supplying all of their contractors with something resembling a sane standard to use for those CD's they are sending out to developers?

How about the data they are shipping abroad, quite possibly to countries where encryption that cannot be brute-force opened on a 1990s pda, such as France?

I guess the real improvement will only happen when an EU-Directive establishing a standard for encrypting private data surfaces, and this standard of course should establish a clear and consise method for several vendors to implement software to handle the files. Any other option would be illegal, since there would be no possibility for competing products. Since such a standard would have to be established all over EU, the maximum level of encryption, would be the lowest common multiplum limited by local laws. Unless our frogeating friends has fixed their hopeless law, we can look forward to a standard resembling the CSS of DVD. Thus, the encryption will be on level with ROT13.

Isn't this wonderful?

//Svein

Start with the fundamentals - unlike this letter

How about 'WTF is there any personal data on laptops in the first place?'.

There are *very* few reasons why there should be original source data (as opposed to obfuscated) on laptops.

If they need personal details as part of a study it could (and should and *must* ) be changed so as to contain the same *type* of data, but none of the original details. And then encrypt *that* data. Its just a matter of time before some buffoon puts the key on a yellow sticky, as already pointed out.

Encryption gives them an excuse to store data they shouldnt be keeping to start with.

Amazing

Any basic ecommerce store manages decent security, yet a government has still to secure any of their pc's and data storage...Shocking

Not so mobile.

A lot of people use a laptop in preference to a desktop for a variety of reasons these days. But even so this does smack of the company that bought the sales force laptops so that they could use them on the road and then chained them all to the desk after a couple got stolen.

Simple solution just keep all the Government officials locked up. Result no loss of data period.

From a personal perspective.

There have been rules in place to stop this from happening in our department for years.

However the users just ignore them or get upper management to make is carry out their requests.

And whenever I say that we need to educate the users using a taser, big stick, hessian sack and a bottle of water they call me crazy.

@ H'arj Imladd

TBH, these people are NOT muppets - they are neither cute, nor funny.

Mines the denim jacket with the Iron Maiden patches, thanks...

Personel Data

I have seen claims where the User address is *PERSONAL*

ie userid@theregister.co.uk

Is considered private and confidential. Telephone numbers are iffy(IMO) as they are published in the telephone book or they can be found at your local white pages (in the US not sure about across the pond).

I am not sure that the privacy rules for the EU are the same as the US.

Ed

Muppets? Really?

How very interesting that so many people are jumping on the band wagon of Encryption. I would just LOVE to see how many Private Sector laptops are stolen/lost during a WEEK, let alone a year.

Name ONE good encryption package that doesn't make a laptop a futile mess of electronic parts.

Having been working in the Private Sector for over quite a few years, I'm surprised by some peoples comments regarding encryption on laptops when there is virtually zero encryption on private sector laptops with financial details for hundreds of thousands of people. Just because it's the UK gov, everyone starts to jump on the "Ah, they are muppets" or "wtf? Horse, bolted.." band wagon.

I say, good on them for reacting quickly, rather than sweeping it under the proverbial red carpet. Might not be pro-active, but it's better than most of us departments in the private sector.

This is just sensationalist to the extreme...

Re: Er ... how do you encrypt a telephone number?

Ah. You can do that with a BlackBerry... of course its a bit of a hassle as doing stuff the "real secure way" means that getting an incoming call while the device's locked will only show the Caller ID, but not the Contact Info you have in your phone (as it is encrypted and the private key's wiped out while the BB's locked down.)

Still, that is assuming everyone even *has* Blackberries... I doubt they'd supply an entire fleet of BB's to ever man+dog in the place just because of new security requirements.

At least they are conscoius now; I have been in places where access to sensitive stuff like root passwords are kept in cleartext ... in a financial institution. Or having some hassle with "something about SSL certs" and Management giving the green light on firing up a *production* service *without* SSL as a temporary solution. Oh, would the SOX guys feast on such stuff...

Oh, and only 4 of us even knew of PGP. Of course, all my sensitive stuff was PGP'd, so much that I think no one will be ever able to get useful info from my former PC ever again... ;)

Leaked Email???

How the hell..Doesn't this count as a restricted circular under the official secrets act?

I don't think the civil service culture can take this seriously.