Information Security News: Data breach officials could be sent to the big house

[InfoSec News <alerts () infosecnews org>]

http://www.theregister.co.uk/2007/12/18/hmrc_crim_penalties/

By Joe Fay
The Register
18th December 2007

Civil servants responsible for the loss of public data could face prison 
sentences in future, instead of a brief period in sackcloth and ashes 
before being shifted into a consultancy role.

In his update on the HMRC data loss to MPs yesterday, Alistair Darling 
said: "There will now also be new sanctions under the Data Protection 
Act for the most serious breaches of its principles.

"These will take account of the need not only to provide high levels of 
data security but also to ensure that sensible data sharing practices 
can be conducted with legal certainty. We will consult early in the New 
Year on how this can best be done."

The Times reports that ministers have accepted that the penalties for 
"gross failures" to protect citizens' details should include criminal 
penalties. These could be as harsh as a two year prison sentence for the 
most serious offenses.

Darling, yesterday, also said that spot check powers introduced in 
Whitehall in the wake of the HMRC data loss would be extended right 
across the public sector.

In the wake of the recent HMRC debacle, the head of department resigned, 
but swiftly reappeared doing work for the cabinet office. Meanwhile, the 
government pointed the finger at a junior official they said had ignored 
procedures to download the data onto a disk.

It subsequently emerged that senior officials had been involved in the 
decision to just plonk the entire benefits database onto a couple of CDs 
before popping it into the internal mail. This weekend it emerged that 
the exact procedures for protecting data were only detailed in a manual 
that was restricted to senior civil servants.

Of course, the issue is not whether the penalties are introduced, but 
whether they are enforced and used. Plausible deniability is a Whitehall 
watchword and there's nothing more plausible than denying all knowledge 
and/or blaming outside contractors. Except perhaps ensuring that the 
relevant watchdogs are fed a paltry and bromide heavy diet.

Information Commissioner Richard Thomas was presumably looking to head 
off just such a situation yesterday when as well as expressing his 
"welcome" for the Chancellor's plans, he declared: "It goes without 
saying that it is essential that the ICO is properly resourced to 
discharge any new responsibilities effectively."

The Foundation for Information Policy Research was less positive, saying 
that Darling's response, and that of Ruth Kelly on the loss of three 
million driving test candidate IDs, showed the government still didn't 
understand the nature of the problem.

"Their refusal to abandon the headlong rush towards Transformational 
Government - the enormous centralised databases being built to regulate 
every walk of life - is not just pig-headed but profoundly mistaken," it 
said.

"Before Transformational Government came along, only small amounts of 
data were lost - but as the new databases cover the whole population, 
everyone's affected now, not just a few unlucky people," it continued.

Ross Anderson, chair of FIPR and Professor of Security Engineering at 
the University of Cambridge called instead for localised databases, to 
limit the damage from any leaks.

"You can have security, or functionality, or scale - you can even have 
any two of these. But you can't have all three, and the Government will 
eventually be forced to admit this. In the meantime, billions of pounds 
are being wasted on gigantic systems projects that usually don't work, 
and that place citizens' privacy and safety at risk when they do," he 
said.

Oh, and the BBC reports that details of 6,500 people belonging to a 
pension firm have been lost at an HMRC office in Wales. The data 
includes names, addresses, NI numbers, and pension details.


__________________________________________________________________      
Visit InfoSec News
http://www.infosecnews.org/