I see the problem around me every day.

I'm a local goverment worker and I've been trusted with unencrypted access to the personal data of every child in our district for migration to a new school management solution. This includes names, addresses, medical problems and so on. It's no big deal because I do understand the implications of data security and how to implement it but let's look at this for a second.

I'm the lowest paid technical employee in the team at a mere £15k a year.

I've never had a CRB check.

I've pointed these things out to management and particularly highlighted them in the case of recent breaches but no one cares. Whilst I am trustworthy there's always the chance that others in this type of position might not be - case in point, a few years back someone who worked on the old system was sent to jail after 15,000 child porn images were found on his machine - he also had full access to this data.

So the data is in good hands I promise, I do know what I'm doing but it bothers me that there are people elsewhere in this situation who might not be either competent enough to look after the data or may just be outright malicious. Furthermore I'm just so utterly apathetic towards the job due to management ignorance and low pay amongst other things that even if something did go wrong I don't think I'd really care, besides I've informed management of the issue and they've done nothing to resolve it so I can't help feeling the age old and rather ignorant view of "It's not my problem".

I have a lot of sympathy for the junior staff being blamed for these various breaches because if they're in the same situation as me then it's not their fault, they do what they can to look after the data but they can only do so much and if management isn't listening to their pleas to tighten up the process then what more can they do other than accept they'll have to do what they can with the tools they've got and if management orders them to send the data unencrypted on CDs via unregistered mail then they have to do it or face disciplinary and lose their job? Of course they'll lose it anyway when the blame comes round to them even though they did everything within their power to prevent it bar actually sacrificing their livelihood in protest.

To cite another example, the goverment IT profession, some goverment organisation that basically oversees goverment IT workers has a mailing list we were encouraged to sign up to which I did. When they sent out one of their mailings they'd listed all addresses signed up to the list in the "To" field. As such all recipients could see all other recipients addresses and these addresses included everything from police to MI5 to NHS to parliament to other local goverment addresses. I immediately e-mailed back suggesting they in future used the BCC option to ensure people could only see their own addresses and not everyone elses. If one of those machines had been infected with a virus that spreads via mass mailing there is potential for that virus to spread to every single public sector department in the country. Of course, I never got a thank you or even a response to my notice of the problem that I sent to them but since then all e-mails have been sent such that we could only see our own addresses. Problem averted, but did it really take a £15k a year nobody IT support technician to point it out?

It's frustrating and I say this sincerely, please don't listen to the lies about how it's all the fault of juniors - many of us try, we really do but we're limited by management. If we're going to achieve change then yes it is the goverment that needs to be blamed and in turn the problem needs to be pushed into the hands of upper and middle management to realise the issues and realise that they need to take action to ensure the data of the very people we're meant to be working for - the general public that pay their taxes is kept safe and secure.