Feeds

FCO to probe visa security lapse

Indian problem could be worldwide

Secure remote control for conventional and virtual desktops

The Foreign and Commonwealth Office (FCO) has closed its online service for visa applicants from India while it investigates a security breach that made the personal details of visa applicants available online.

VFS Global, the private firm that runs the FCO's online visa application service, told the reporter who broke the story that they had "resolved" the problem "globally". The breach was initially thought to have occured only in India, and the FCO's statement on the matter treated it that way. Yet VFS run online visa applications for the FCO in various countries.

The security hole was originally reported to both VFS and the British High Commission more than a year ago but no action was taken. The Indian gent who first noticed the problem has a blog here.

Lord Triesman, Secretary of State for Foreign and Commonwealth Affairs, said in a statement yesterday: "The VFS online facility will not be resumed until VFS and UKvisas can be assured that it is absolutely secure."

VFS's online service could apparently be subverted by making changes to its URL - doing so gave a browser access to the firm's database of visa applicants, which stored passport numbers, names, addresses, and travel details.

Mumbai-based VFS - a subsidiary of the Zurich-based Kuoni Travel Group - operates 11 visa application centres in India. According to the FCO, the firm processed 471,746 Indian visa applications last year, but only a "small proportion" were initiated using the online service.

However, VFS also processes online applications for UK visas from Nigeria and Russia. The FCO could not confirm whether the same problem occured in the systems operating in these countries as well, but did say that their sites had been closed down.

As well as VFS, CSC is contracted to handle visa applications. A spokesman for UK Visas said that 87 per cent of applications were handled by these third parties in their countries of operation. 12 per cent of the applications handled by VFS in India, Nigeria and Russia were handled online.

Furthermore, VFS's online service is merely intended to support the walk-in visa service it runs in its countries of operation. Visa applicants to the UK can still make online applications on the FCO's own website.

VFS also provides visa services to countries including the US, Australia, Canada, France, Germany, and Sweden.

Yet Damian Green, Conservative shadow immigration minister, said the screw-up didn't bode well for the government's identity plans.

"This government cannot even run a simple online visa application system without betraying all the sensitive information. What hope has it got of protecting the integrity of the National Identity Card Register which will hold dozens of pieces of sensitive information of every adult in the country?" he said in a statement. ®

The essential guide to IT transformation

More from The Register

next story
Hello, police, El Reg here. Are we a bunch of terrorists now?
Do Brits risk arrest for watching beheading video nasty? We asked the fuzz
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
UK government accused of hiding TRUTH about Universal Credit fiasco
'Reset rating keeps secrets on one-dole-to-rule-them-all plan', say MPs
Caught red-handed: UK cops, PCSOs, specials behaving badly… on social media
No Mr Fuzz, don't ask a crime victim to be your pal on Facebook
Felony charges? Harsh! Alleged Anon hackers plead guilty to misdemeanours
US judge questions harsh sentence sought by prosecutors
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Yes, but what are your plans if a DRAGON attacks?
Local UK gov outs most ridiculous FoI requests...
EU justice chief blasts Google on 'right to be forgotten'
Don't pretend it's a freedom of speech issue – interim commish
Munich considers dumping Linux for ... GULP ... Windows!
Give a penguinista a hug, the Outlook's not good for open source's poster child
This'll end well: US govt says car-to-car jibber-jabber will SAVE lives
Department of Transportation starts cogs turning for another wireless comms standard
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.