The lost data disks

[HStorm]

A new, gigantic scandal has erupted in the everliving realm of comedy, the Civil Service.

Private information held by HM Revenue and Customs (HMRC) in Tyne And Wear of all Child Benefit claimants in the UK - nearly half the British population (no exaggeration!) - including their bank details, was stored on a pair of data disks, which were then despatched, unrecorded, through TNT to the National Audit Office in Whitehall.

The disks are missing, and have been for several weeks. The disappearance was only made public two days ago.

HMRC Chairman Paul Gray has resigned over the cock-up, and Gordon Brown and his beleaguered Chancellor Alistair Darling have made various, cringing apologies on the Commons about the matter. There have been assurances, not altogether convincing ones, that there is no evidence that the disks have fallen into the wrong hands or the information on them used for foul deeds.

It appears that the official who despatched the disks in such a devil-may-care fashion was a junior civil servant (oh it's the Civil Service in action again, surprise surprise), and in direct contradiction of instructions he had received on numerous occasions telling him to handle the information with extreme diligence.

Should the Prime Minister and the Chancellor really be taking such absolute responsibility for what is yet another horrific CS balls-up? Isn't it time that the Civil Service itself stepped forward and accepted the weight of the blame? And isn't this yet another item in the growing mountain of indictments against the CS as a whole, showing that it is long past time that it was reformed so that it functions in a way that is both transparent and completely accountable, instead of just following the usual tactic of hiding behind elected officials every time something goes wrong?

[Naselus]

It's true. To evalutate and diagnose the total ramifications of the unfortunate incident, and then formulate and impliment an immediate and radical response to the aformentioned indictment, barring of course any overly drastic restructuring and/ or needless consolidation, I move to create a committee who's first order of business must be to put forward an inquiry into the unacceptable and disgraceful matter at hand, before placing the matter into the capable hands of a Civil Service-led Think Tank to bring about a number of corrective inter-departmental prepositions, with results to be put into actions no later than within the next twenty five years.

[HStorm]

Well indeed. This is because it takes longer to do things quickly, it's more expensive to do things cheaply, and it's more democratic to do them in secret.

It's nice to have you back by the way, Sir Humphrey, but what you are suggesting are actually called 'proposals', not 'prepositions', so I'm afraid your recommendation has been rejected pending a full official redraft.

[modeski]

There are so many things wrong with this situation, it's hard to know where to start. I'll give it a shot, though.

The data ought to have been encrypted. I'm not sure that it has, but I'd imagine the chances are pretty slim. Furthermore, why on earth was it kept on discs? The data should have been transferred via a secure government data line with heavy encryption. One doesn't just book a guy on a motorbike to drop off the nation's most private data.

Obviously, given that I'm out of the country, I'm not aware of how much this issue is being talked about over there. I can only hope that it's creating a reaction akin to the Profumo Affair (at the very least). Is everyone up in arms over this? They blood well should be.

Keep an eye on your bank accounts, folks!

[HStorm]

I can't find any reference to the disks themselves actually being encrypted; there's a password on them to prevent directory access, but anyone half-competent with a computer can get through that. The data wasn't stored on disks as such, but the official involved copied them onto the disks from the database so they could be shipped down to Whitehall.

The reaction hasn't been quite up to Profumo standards here, no, but there's no doubt that there's been a lot of alarm and unease. The prevailing attitude of the HMRC in the whole business seems to have been one of "The Data Protection Act is a secondary issue, what matters is keeping costs down and making access to the data easy for our chaps." The only time that keeping information secure seemed important to them was when it came to admitting what happened; it didn't get out for two weeks that the disks were missing, which just goes to show what acts like Data Protection and Official Secrets are really there for.

I want to reiterate that I don't think Alistair Darling should get it in the neck for this one (even though he probably should get some stick over the Northern Rock fiasco). This is entirely a matter about procedure and the day-to-day running of a Government Department, which means it's outside the jurisdiction of the Cabinet entirely, and is instead a matter that Permanent Secretaries should be answering for.

This does have serious ramifications though, whichever way blame gets meted out. If the Chancellor accepts responsibility - which I still think would be absurd - then he will have to resign. If, on the other hand, blame is passed to the Civil Service - which I think would be entirely fair because there's no way any Minister could possibly control anything like this - that immediately opens up serious questions about trust in the Service at all. When it comes to things like ID cards, how can we possibly trust any Government founded on this Civil Service with so much personal information about ourselves, when it's clear they treat people's privacy with such casual disregard (if not intrusive disdain)?

news.bbc.co.uk/1/hi/uk_politics/7110547.stm#graphic

The above BBC page and links from it give a full account of what is happening.

[HStorm]

I swear, if this had happened in an episode of Yes Minister, Civil Servants would be accusing it of being 'Lib-eco' propaganda; the HMRC has confirmed that another six - you didn't read that wrong, it does say six - data discs have gone missing, this time in transit between offices in Preston and London!

The contents are less important this time - they contain recorded conversations between a member of staff and a customer making a complaint - but it's becoming clear that the casual attitude to security is habitual, not just a one-off.

Also worrying is that once again the news has been very slow reaching the public. The discs were reported missing on 30th October, and the loss has only been announced this afternoon. Once again, it seems that the only time Whitehall makes a serious effort to protect information is when the information is about its own cock-ups.