Don’t worry, every detail of your life will be safe with us

Say the custodians of our medical records and the Identity Cards’ National Register.

The BBC:

Confidential details of 15 million 25 million child benefit recipients are on computer discs lost by HM Revenue and Customs, the BBC understands.

The chairman of the organisation, Paul Gray, has resigned.

Revenue and Customs says it does not believe the records – names, addresses, date of birth and bank accounts – have fallen into the wrong hands.

Oh? Perhaps they’ve fallen into the right hands then… perhaps the right hands will give them back soon.

Chancellor Alistair Darling is to give a Commons statement on “a major operational problem” at 1530 GMT.

BBC political editor Nick Robinson said he understood ministers had been aware of the problem for nine to 10 days.

Perhaps the right hands have been a bit busy with other things.

Mr Darling is expected to outline the measures taken to protect those whose data has been lost.

The resignation of Mr Gray was accepted because discs had been transported in breach of rules governing data protection.

No doubt an “isolated case” and “lessons will be learned”… but wait, haven’t there been other cases recently? (1 & 2)

…

Conservative MP Michael Fallon, who is vice-chairman of the Treasury select committee, said there had been “persistent rumours that all is not well at Revenue and Customs, which is the biggest single department of the Treasury”.

There had also been “complaints from other MPs about the service that our constituents have been getting in terms of tax credits and so on and it may look as if he (Mr Darling) has simply taken his eye off the ball over that organisation as well,” he added.

But Home Office minister Liam Byrne said: “I think that the department does a difficult job and I think it does it well – the chancellor will set out a full statement and a full account to the background of this story a little later on.”

Jonathan Baume, general secretary of the FDA, the union for senior public servants, said there had been a “serious operational error” but added: “Paul Gray was in no way personally responsible, but he has recognised that, as the most senior official in the department, the accountability ultimately lies with him.

“His decision to take on this accountability is an example of British public service at its best.”

Customs and Excise was merged with the Inland Revenue in 2005, creating the biggest department in Whitehall. It was also ordered to reduce its 94,000 total staff by 25,000.

It is run by an executive board, but the chancellor is responsible to Parliament for its operations.

It collects taxes and other government receipts worth about £400bn a year, as well as administering benefits and tax credits, which require it to process large amounts of personal data.

Nothing to hide, nothing to fear.

Nothing to see here, move along.

Update

Ever excellent Tony Collins provides more background.

Ross Anderson commented,

In breaking news, the Chancellor of the Exchequer will announce at 1530 that HM Revenue and Customs has lost the data of 15 million child benefit recipients, and that the head of HMRC has resigned.

FIPR has been saying since last November’s publication of our report on Children’s Databases for the Information Commissioner that the proposed centralisation of public-sector data on the nation’s children was not only unsafe but illegal.

But that isn’t all. The Health Select Committee recently made a number of recommendations to improve safety and privacy of electronic medical records, and to give patients more rights to opt out. Ministers dismissed these recommendations, and a poll today shows doctors are so worried about confidentiality that many will opt out of using the new shared care record system.

The report of the Lords Science and Technology Committee into Personal Internet Security also poitned out a lot of government failings in preventing electronic crime – which ministers contemptuously dismissed. It’s surely clear by now that the whole public-sector computer-security establishment is no longer fit for purpose.

Whichever New Labour apparatchik appeared on Newsnight last night dismissed all that too, when Professor Anderson raised it on the programme… “lessons will be learned… if procedures had been followed this wouldn’t have happened blahblahblah” -usual guff.

Are New Labour deliberately obtuse?

THE POINT, YOU DIMWITS, IS THAT PROCEDURES WEREN’T FOLLOWED AND THAT’S HOW THIS DEBACLE RESULTED.

YOU CANNOT RELY ON PEOPLE TO ALWAYS FOLLOW PROCEDURE.

THEREFORE YOU HAVE TO MITIGATE THE DAMAGE THAT CAN BE CAUSED BY PEOPLE “NOT FOLLOWING PROCEDURE”.

Update 2

SpyBlog

We do not think that the Government or the media are actually treating this appalling data privacy and security breach seriously enough, by wittering on only about the risks of financial fraud.

Abu Bakr Mansha is currently serving 6 years in prison for the possession of a copy of the Sun newspaper, on which he had scribbled the out of date, former address of a serving British Army soldier and Iraq war hero, under the Terrorism Act 2000 Section 58 Collection of information

How valuable would a copy of these two CDROMs with the details of 7.25 million families be to serious organised criminals, enemy terrorists or foreign intelligence agencies ?

Today, there appears to be a police raid on the Child Benefit Office in Washington, Tyne and Wear, where the data breaches originated from.

Why ? There has already been an internal search for the missing CDROMs by “trained Customs officers” who are “used to searching for hidden items”.

Why were the Metropolitan Police called in by the Chancellor, who, somehow does not appear to trust the local Northumbria Police ?

and

Alistair Darling only mentioned the financial risks of this massive potential data breach, but he ignored the confidential name and address information which could be life threatening to, say, battered wives and their children, victims of stalkers, people in witness protection schemes, families of Judges, police officers, prison officers, armed forces. intelligence agencies etc.

The Chancellor unconvincingly tried to claim that somehow Identity Cards would have prevented the risks of this data breach, because of the magic of “biometrics” – which is, of course, utter rubbish!

Surely this must affect public opinion and trust in the “database state” centralised databases such as the National Identity Register / ID cards, the National Health Service centralised patient records (“Data Spine”) etc.?

The non-partisan NO2ID Campaign has been trying to raise public and political awareness of the risks of such “all your eggs in one basket” systems, which are so vulnerable to incompetent or corrupt authorised insiders.

Update 3

The Times:

The Chancellor and the Prime Minister have been criticised for not alerting potential fraud victims to increase their vigilance sooner.

Both have known about the loss since November 10, but the police were not told for a further four days and the banking industry was not alerted until last Friday.

Last night bankers reacted angrily to a suggestion by Mr Darling that he had delayed his announcement because the financial sector was “adamant” it needed time to prepare. A senior City source said: “By 9.30 on Monday we were ready to run. It is hard to fathom why any suggestion was made that any delay was down to us.”

Hard to fathom?  I believe it’s called “passing the buck”… alternatively the exciting office game, “Pin the tail on the scapegoat”.