Datapocalypse Now

secure

By "one secure location" you mean "central location unencumbered by passwords or encryption or anything allowing easy access by all and sundry."

I get it. The best way to prevent passwords being compromised is dispense with them altogether. Hurrah! We're secure!

@Jimbo

As "dismember" means "to remove the limbs from", I'd be very surprised to see a dismembered head anywhere.

If people seriously cared about freedom, most of the government - from the parasites in local government up to the hiveminded power-obsessed morons in the high levels - would have been dancing the bluetongue fandango from lampposts years ago, before the 'war on terror' even got into full swing. But they don't so they aren't.

I very much doubt that anyone will remember this come the general election either, unless, say, 1 in 5 or even 1 in 10 people have their bank balances cleared out within a month while the event is sufficiently fresh in people's minds that they associate their personal loss and inconvience with the government cockup. Otherwise only those with an active interest in data management will care.

Can Someone tell me...

What this data loss has to do with ID cards? More to do with the cost of outsourcing (loss of skills, price of unforseen changes).

But it could be used as a good way to kill off ID cards if that was what they Gvt wanted as part of a face saving ploy </conspiracy theory>

Well, it would have been secure if ..

Read the selection of emails between HMRC and NAO on the beeb site. We really didn't need to worry about that data, it was password protected. And doubtless the password would have been impossible to crack (unless it was the name of the "junior official's child, of course). The password would have been sent (as presumably it was on earlier data transfers) separately:

".. Please ring xxxx when you have safely received the two CDs ... so that he can pass on the passwords in an email"

(http://www.bbc.co.uk/blogs/nickrobinson/Informationrelatingtochildbenefitdata.pdf)

Though I did find one small outburst of charity for the NAO when I discovered that they were busy moving house at the time.

Still you can just imagine it.

"Hello Alastair, this is Jackie speaking, I'm Gordon's deputy whilst he's busy with the move. Could you send the passwords for those files to me on my personal email - the office ones are all out of action whilst we moving. It's j.smith@notquitehotmail.com Thanks.

Anyone like to bet it wouldn't work?

Telling you ..

MGJ says:

"What this data loss has to do with ID cards?"

It's the notion that the ID card will be administered by a central database, linked to the [highly secure, natch] police national database. With all our data, including details of when we are abroad and the house is empty, which the government wants us to hand over, whilst reassuring us that all this data will be carefully protected by strictly observed and monitored government data protection procedures.

The government wants to put LOTS of personal data, including names, addresses, all security, medical and legal details onto this database.

How long before someone manages to get a job as a junior officer in the Civil Service department handling this data, and gets another junior official from elsewhere to send them the password in an email? The data is then burned to a CD, or sent over a nearby open wireless network to the criminals who got the man infiltrated into the data centre by the process of him being prepared to do the job. (Check how easy it is to get a job in a bank's call centre.)

The data is then auctioned off - though probably not via ebay.

Trust

I trust El Reg to keep these stories safe. In fact, I have sent my entire personal financial history, my logins and passwords, and my medical records to the Vultures today for safekeeping.

There was an interesting snippet in Newsnight's report last night - a disc of data arrived at a government office with an accompanying comps slip on which was written... yeah, you guessed it, the password.

Reading the papers' reportage and watching the television coverage, the truth seems to be that mid-level civil servants fucked-up, partly through ignorance and partly because the contractor - in this case EDS apparently - was going to charge through the nose for extracting an anonymised selection from the database. And an anonymised (comparitively) small selection of records was what the NAO actually asked for.

Of course, aforesaid mid-level civil servants are trying to pin the blame on some poor 23-year-old underpaid and over-worked drone. Disgraceful.

I wouldn't trust the government with my name: I wouldn't trust the civil service to use a pocket calculator. (Mind you, I trust Experian, EDS, banks, and their many private sector cohorts even less.)

Trust no-one. Tell them nothing. Overthrow the government at the ballot-box or the barricade.. Aux armes, citoyens!

Those e-mails [redacted] in full -- Comic Sans!

The BBC have a PDF of the emails, highlighted in black. Most worrying of all, is the [over]use of Comic Sans, in one HMRC sig, and as the main body text in two more!

http://www.bbc.co.uk/blogs/nickrobinson/2007/11/those_emails_in.html

Hmmm

@ Anonymous Coward

"Why are they even sending physical media?

They could avoid have avoided the entire mess by following these 3 steps:

Compress : Zip or tar.gz

Encrypt : using openPGP or equivalent

SFTP to the destination... Email is NOT for file tranfser.

Simple and cheap enough that even the startups I've worked for can afford it."

Well the problem is that encrypted files cannot be readily scanned for viruses, so they don't get through the firewalls on the GSI. National Audit Office are of course not on the GSI anyway, and I doubt this could be considered 'RESTRICTED' in anycase (GSI is only cleared up to that level).

Of course, if we had a proper distributed system with secure electronic identities for citizens and administrators, then there would be no need for a department like HMRC to hold most of this information; they could ask the national department of payments to pay x to citizen y, but becuase no government systems talk to each other, and there are no national registers of people you have each department holding vast quantities of data they don't need.

Still, plenty still to follow on this story

More tales of HMRC incompetence

Here's another two to add to the pile:

In 2002 HMRC (then the Inland Revenue) contacted me to ask me to fax to them copies of some of my tax records from previous years, including a P60 (my end-of-year tax certificate). The reason? They were sorry but they'd "lost my files".

In 2007 HMRC was contacted by me with regard to a P85 (migration notice) that I'd sent them. This was "never received", they told me. But they must have received it, I told them: "you have my correct new address on record and the only way you could have that is if you got the P85". "I hear you, but we don't tend to lose things," the operator maintained.

@PH

I have had exactly the same problem with the Revenue. About four years ago, I got a fine for two tax forms that hand't been filled in and returned. I called them up straight away and asked words to the effect of "what is going on? I've had no forms". I went through the whole "we sent them so you must have had them" thing, after they said they'd send them again and cancel the fines (which they did rather quickly, almost like it happens all the time) I asked where they'd sent the first forms, they wouldn't tell me directly, so I listed all of the addresses I'd lived in, it turned out that they'd sent them to an address I lived at 7 years previously, but they managed to send the fines to the correct address. Funny that. The Revenue person couldn't explain how that had happened.