Security breach saw 15 million child benefit recipients' details 'lost in the post'
HM Revenue and Customs (HMRC) has been slammed by security experts after being responsible for what has been described as ‘one of the world’s biggest ID protection failures’.
As a result of the government faux pas, which involved the loss of computer discs in the post, thought to contain the confidential details of 15 million child benefit recipients along with over seven million people's bank details, HMRC chairman Paul Gray has resigned.
Earlier today the Chancellor of the Exchequer, Alistair Darling was forced to issue a statement which admitted an investigation is still in progress, after attempts to locate the missing CD’s failed. Darling added that an independent review of HMRC’s security procedures is taking place, with the full results being published in Spring 2008.
However Tom de Jongh, product manager at SafeBoot, said: “Basic policies were ignored. It appears that the fundamental policies upon which the National Audit Office and HMRC operate are flawed and it is no wonder that this breach has occurred. The Chancellor freely admits that NAO and HMRC broke clear procedures, but that will not reassure the millions of families that are praying their financial details don’t get into the wrong hands.”
Brian Spector, general manager for content protection group at Workshare, said: “It is staggering that an organisation responsible for the data of over 25 million child benefit claimants is still copying data onto CDs and not ensuring its full protection through encryption techniques. It has never been acceptable for businesses or government departments to lose data, but in today’s information society, the flagrant disregard for the protection and security of this type of data is not acceptable.
“The money invested in IT by the UK government must now be prioritised on security to ensure that the data of those the government serve – the public - is secure and protected.”
Jamie Cowper, director of European marketing at PGP Corporation, said: “Thes e discs should never have been transported in the first place – information of this type should only be transmitted using the strongest security protocols available such as encrypted batch transfer – but more to the point, these details should not have been stored in this medium.
Discs are easy to lose, but difficult to protect. This type of information should only be stored on formats where the data can be encrypted transparently, so that it remains protected wherever it resides, and whether at rest or in motion."
Further Reading:
Tax man loses 25m people’s records
http://www.channelweb.co.uk/computing/news/2203890/25m-records-lost-tax-man
Like this story? Spread the news by clicking below: del.icio.us Digg this reddit!
Tags: Government
Alistair Darling 
British Chancellor of the Exchequer Alistair Darling announced to a shocked House of Commons today that two password-protected — but not encrypted — computer disks containing the entire Child Benefit database have been lost in transit between the offices of Her Majesty's Revenue and Customs (HMRC) in Washington, Tyne & Wear and the National Audit Office (NAO) in London, in what has been described as "one of the world’s biggest ID protection failures".

The database contains details of all families in the UK who receive Child Benefit — all families with children up to 16 years of age, plus those with children up to 20 years old if they are in full-time education or training — estimated to contain 25 million individuals in 7.25 million families. Among other items of information, the database contains names, addresses, dates of birth, child benefit and National Insurance numbers, and where appropriate, bank or building society account details.

The discs were created by a junior official at the HMRC in response to a request for information by the NAO, and were sent unregistered and unrecorded on 18 October using the courier company TNT — which operates the HMRC's internal mail system. When it was found that the discs had not arrived for audit at the NAO, a further copy of this data was made and sent — this time by registered mail — and this package did arrive. HMRC were not informed that the original discs had been lost until 8 November, and Darling himself was informed on 10 November.

The violation of data protection laws involved in the creation of the discs has led to strong attacks on the government's competence to establish the proposed National Identity Register, when all UK residents will have an identity card. Conservative Shadow Chancellor George Osborne described the loss of data as "catastrophic" and said "They the government simply cannot be trusted with people's personal information".

The Chairman of HMRC, Paul Gray, has resigned over the affair, and critics are calling for Darling to do likewise.

This is the third data embarrassment for HMRC in recent weeks — earlier this month it was reported that the details of over 15,000 Standard Life customers had been put on disk, and then lost en route from HMRC in Newcastle to Standard Life in Edinburgh — and last month a laptop containing the data of 400 people with high-value ISAs was stolen from the boot of a car belonging to a HMRC official who had been carrying out a routine audit.