Feeds

Data breach officials could be sent to the big house

No, we don't mean a conference centre with golf course

3 Big data security analytics techniques

Civil servants responsible for the loss of public data could face prison sentences in future, instead of a brief period in sackcloth and ashes before being shifted into a consultancy role.

In his update on the HMRC data loss to MPs yesterday, Alistair Darling said: "There will now also be new sanctions under the Data Protection Act for the most serious breaches of its principles.

"These will take account of the need not only to provide high levels of data security but also to ensure that sensible data sharing practices can be conducted with legal certainty. We will consult early in the New Year on how this can best be done."

The Times reports that ministers have accepted that the penalties for "gross failures" to protect citizens' details should include criminal penalties. These could be as harsh as a two year prison sentence for the most serious offenses.

Darling, yesterday, also said that spot check powers introduced in Whitehall in the wake of the HMRC data loss would be extended right across the public sector.

In the wake of the recent HMRC debacle, the head of department resigned, but swiftly reappeared doing work for the cabinet office. Meanwhile, the government pointed the finger at a junior official they said had ignored procedures to download the data onto a disk.

It subsequently emerged that senior officials had been involved in the decision to just plonk the entire benefits database onto a couple of CDs before popping it into the internal mail. This weekend it emerged that the exact procedures for protecting data were only detailed in a manual that was restricted to senior civil servants.

Of course, the issue is not whether the penalties are introduced, but whether they are enforced and used. Plausible deniability is a Whitehall watchword– and there's nothing more plausible than denying all knowledge and/or blaming outside contractors. Except perhaps ensuring that the relevant watchdogs are fed a paltry and bromide heavy diet.

Information Commissioner Richard Thomas was presumably looking to head off just such a situation yesterday when as well as expressing his "welcome" for the Chancellor's plans, he declared: "It goes without saying that it is essential that the ICO is properly resourced to discharge any new responsibilities effectively."

The Foundation for Information Policy Research was less positive, saying that Darling's response, and that of Ruth Kelly on the loss of three million driving test candidate IDs, showed the government still didn't understand the nature of the problem.

"Their refusal to abandon the headlong rush towards Transformational Government - the enormous centralised databases being built to regulate every walk of life - is not just pig-headed but profoundly mistaken," it said.

"Before Transformational Government came along, only small amounts of data were lost - but as the new databases cover the whole population, everyone's affected now, not just a few unlucky people," it continued.

Ross Anderson, chair of FIPR and Professor of Security Engineering at the University of Cambridge called instead for localised databases, to limit the damage from any leaks.

"You can have security, or functionality, or scale - you can even have any two of these. But you can't have all three, and the Government will eventually be forced to admit this. In the meantime, billions of pounds are being wasted on gigantic systems projects that usually don't work, and that place citizens' privacy and safety at risk when they do," he said.

Oh, and the BBC reports that details of 6,500 people belonging to a pension firm have been lost at an HMRC office in Wales. The data includes names, addresses, NI numbers, and pension details. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
Whoever you vote for, Google gets in
Report uncovers giant octopus squid of lobbying influence
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Alphadex fires back at British Gas with overcharging allegation
Brit colo outfit says it paid for 347KVA, has been charged for 1940KVA
Jack the RIPA: Blighty cops ignore law, retain innocents' comms data
Prime minister: Nothing to see here, go about your business
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.