*that* muich?

> "no way I would of trust *that* much information to the British Government and a single war-mongering organisation."

Did you actually read the census questions?

There really wasn't anything particularly exciting in there. Facebook probably has more detailed information on me.

in fairness

Facebook probably has more detailed information on me too, and I'm not a farcebook user.

blerf

It'll be data from all those who completed the online form, methinks. Oh well, good luck to them, my life is not exciting enough for me to care!

Point: Missed!

The takehome lesson here is not 'lulzsec are a bunch of little shits'. It is that net security is so woefully inadequate and the attitude of the people responsible for your information is lax to the point of irresponsibility if not dereliction of duty.

Sure, it sucks that a bunch of juvenile delinquents stole your stuff, but, get this: how on earth did a bunch of juvenile delinquents get to steal your stuff in the first place? If they can do it, so can pretty much anyone. And indeed, there's a pretty big chance that people already have, but because they are serious criminals you won't find out about it til your credit card bill comes.

Regarding bikes? Your metaphor sucks. Its a bit like giving your bike to someone else to keep safe, only to discover they left it locked up on the street with a £5 bit of wire and a 3-digit combination lock and it vanished the moment their back was turned.

You should be grateful that the people who have exposed such incompetence are not more malicious.

Errrmmm

While I'm not a fan of lulzsec and they probably are a bunch of f*cknuts, moaning at them for getting the data is a bit short sighted. Yes they're probably doing it for kicks, but if they can do it so can criminal organisations that wont shout about it and the first thing you know is when the debt collectors come knocking.

By all means think they're muppets, but never complain that people have publicly warned you that your private details are available to any crim with an internet connection.

Except

Except that if/when they post that information on the internet for anyone to see, what little justification they have for their little crusade goes right out the window. There's nothing socially responsible about Handing our data over to the people who will gladly fuck us over for real.

Couldn't have said it better myself

I was pretty much intending to post almost exactly the same thing but since you covered it quite well I don't think I will - I'll just say good on that man :)

The only thing I would add is that at this stage we don't have any direct confirmation that the census hack itself has happened but the post is just as valid without it.

but but but

they took away our OtherOS......

They haven't warned...

...they've threatened to publish, for no other reason than for 'lulz'. Totally ridiculous apologism for a criminal act here. Looks like a massive red herring anyway. Maybe it was an experiment to see how many people would defend them, just because they were going against 'the man'...

@Ru

I'm not confirming that this was the mechanism used because I just don't know, but it is reported that Lockheed Martin's internal networks were compromised by the RSA failure reported several weeks back, so it would not surprise me if they used similar technologies for the UK Census.

If you are implementing a solution that relies on a security product that is proved faulty after installation, can the blame be put completely put at your door?

The fact that RSA keyfob one-shot password devices were in use in Lockheed Martin shows that someone was actually thinking about some security. RSA devices are widely used because they were trusted, and that problem has caught many organisations out.

I am not saying that a single security measure is sufficient, but I wonder how many people commenting here have really tried to build a complete infrastructure that a) does not rely on third party security devices, and b) provides the level of security mandated by CESG. I'm sure that some have, but most have not.

I'm not apologising for LM, but like so many things, it's actually much more difficult to do than most people think, and there are serious tradeoffs between security and cost.

When I worked at government agencies in the past, the most secure systems were effectively on air-gapped networks, with multiple networks to each desk. This cost a lot of money, and ultimately meant that remote support was difficult to impossible. As you cut costs, you link things together using security products. This makes the environment vulnerable to third-party security failure. One bank I worked at had multiple security layers, and adjacent security layers could not be provided by the same technology. Very sensible, but also very expensive.

Lockheed Martin

Is this the same Lockheed Martin that hadn't bother to upgrade access to its VPN two months after it was publicly announced that RSA would have to replace 40 million tokens due to private keys having been stolen from RSA's server?

http://www.pcpro.co.uk/news/security/367723/lockheed-martin-under-fire-over-rsa-breach

>> " ... “Lockheed had slightly over two months from the time that EMC notified them and other RSA SecurID customers about their breach."

and the same Lockheed Martin that that has its traffic intercepted and monitored by the NSA?

Is there no UK data that ultimately ends up in the hands of the US Govt?

@ AC

The NSA doesn't need to bother snooping. Thanks to the Patriot Act, any data held on American soil is fair game for examination.

The question here isn't about LulzSec or a red-herring hack post, but more WTFingF is the British government doing handing sensitive data on its citizens (even if the questions are boring, you can infer a hell of a lot from that much data) to a FOREIGN company where it will almost certainly be of interest to the FOREIGN government. If the British government does not feel competent to manage the census collection and collation, and there is no single British organisation capable, then the answer is bloody obvious - skip it. Wait until it can be coped with. Nationally, within the borders of the country concerned.

Fail icon, because the British government is a laughing stock. Whatever LulzSec may or may not have done, the data is far out of their (the govt's) control by now. Congratulations.

@heyrick

Just because a US contractor is working on a project does not mean that the data is being stored on US soil. I don't know about the Census, but I do know about the DVLA, where the contractors are IBM and Fujitsu, and I can tell you that there is no wholesale storage of your car or license data anywhere outside of Swansea and Salford (although the D90 mainframe in Salford should have been decomissioned by now). That's where the servers are, and that is where the contractors work.

There was simply no method of moving the data onto either IBM's or Fujitsu's corporate networks, and severe penalties (including prosecution) to for anybody who did. This was understood, and is drummed into all people working on the contract on a monotonously regular basis.

In case you hadn't noticed, there are very few companies prepared to work on large government bids that are not mutinationals.

But it was lost...

On the ConDem's watch. That counts for a lot. Who is going to remember who issued the contract 10 years or so ago?

At least, as my colleague has pointed out, this should put paid to all this craze in the govt about Cloud services.

I think *you're* forgetting

the moronic nature of the british public, with a 5-second attention span. I've heard people banging on about "da cuts", (look at the ILF, for example) and blaming "da tories" when it turns out they were implemented 18 months before the election.

Anyway, isn't one of the responsibilities of government that what happens on your watch is your fault, irrespective of who actually instigated it ? It's certainly why they claim the jobs are paid so much.

Re: OMG

Who's the other one?

Always two there are. No more, no less.......

Never understood that line.

What if you're a Sith apprentice and your master gets run over by a bus? Then you're well and truly fucked.

Remember, kids: redundancy is your friend! Whether you're storing UK census information or supa-secret evil Jedi knowledge: a backup in time saves nine.

er ...

some people filled the forms in online - so surely a subset is available. Maybe not processed, but in a raw form ?

Heads never roll..

'Lessons are learnt".

Twats.

Ringleader?

No, I'm Spartacus!