Whittington NHS Trust loses 18,000 sets of data

by Michael Smith

The personal details of nearly 18,000 NHS staff have gone missing in the post, it has emerged.

Four computer discs containing the details of 17,990 current and former staff were lost in July when they were sent between Whittington Hospital NHS Trust in north London and McKesson, a firm providing IT payroll services.

Those CDs contained the names, dates of birth, national insurance numbers, start dates and pay details of all staff of Whittington Hospital NHS Trust, Islington Primary Care Trust, Camden Primary Care Trust and Camden and Islington NHS Foundation Trust.

They also contained the addresses of some staff, although Whittington trust insisted they did not contain anyone's personal bank account details. Well, now there is a relief. But this has just be announced rather in a very slap happy way.

The more we hear about this the more we can but wonder as to whether there is somewhere in British government institutions, including NHS Trusts, the MOD, etc., a competition going on as to how many sets of data can be lost. This kind of criminal negligence just cannot be explained away in any other way unless gross stupidity also has something to do with it.

The trust said the discs went missing when an envelope they were in was placed in a post tray marked "recorded delivery" on Tuesday 22 July. But there was no record of the discs being sent.

The chief executive of the trust said that each one had a separate alpha-numeric passwords on them which, unless found by expert hackers, are very difficult to break. Let us just hope that this is indeed the case. But they have just password. They are NOT encrypted. Who the **** is running this asylum called British government?

He apologised to all those affected by the blunder, saying it was the first time information had been sent through the post and that the member of staff thought to be responsible has been suspended.

"It is trust policy to send any such information by courier," he said, and he added, “to our knowledge this is the one and only time that such information was directed through the post.

"An investigation is underway, with an enquiry panel taking place shortly. In the meantime, a member of staff has been suspended."

It is NOT the member of staff whose head should roll – at least not alone. The buck does not stop at the little guy or girl who may not even have been told how to send the CDs and never been told that they are to be sent by courier.

This revelation led both the Conservatives and the Liberal Democrats to call on the Government to scrap its planned electronic database of 50 million patient records in England. One can but add to that a call to scrap the National ID Card scheme and other such hair brained things. This country and its government are incapable of looking after data of its people.

Not that it would be impossible to make the systems safe. While it may not be possible to 110% guarantee that no one ever will be able to get hold of someone's details it is possible to encrypt the data to such an extent that it would take even a sophisticated hacker – even a hacker team – months if not more – to gain access to the data. If the protection would then be set in such a way that a limited attempts are permitted only and the data will after the limit be wiped c;lean then things would be safer still. This is NOT rocket science, as I keep saying. The technology is available and out there.

© M Smith (Veshengro), September 2008
<>

Yet another USB stick lost by British government agency

by Michel Smith

London, September 15, 2008: The Home Office has this evening announced that one of its police forces – believed to be the West Midlands Force – has lost a data memory stick with sensitive data.

While the Home Office refuses to comment as to the contents of the memory stick it is believe to contain sensitive information of anti-terrorist operations. When you thought it could not get an y worse, apparently it can. One of these days, as I said in the previous piece, the luck will run out and someone is going to use the data against this country and its people.

The more we hear of such losses the more a sense of deja vu overcomes me and the more I want to scream at this people to, at least, have hardware encrypted sticks on which to carry the data. It is NOT rocket science and they are easily available. I have reviewed a few of them by now.

Maybe someone should point the government agencies into the direction of this journal and the reviews done by yours truly. They might just get the idea, but then again, they still may not. I am beginning to lose confidence that this government can actually learn how to deal with sensitive data of any kind.

© M Smith (Veshengro), September 2008
<>

The umpteenth case of data loss – due to wild party?

by Michael Smith

How blasé can any government actually be as regards of sensitive data? It would appear that the British government is trying to provide an answer to that question for there is no other way, I am sure, to explain all this kind of careless sloppiness, which by now borders on the criminal negligent, in the handling and dealing with sensitive information and data.

Now, this time, the travel plans and destinations and other details of seventy soldiers of the 3rd Battalion the Yorkshire Regiment.

The data in question was stored on a USB-Stick and this little comrade is now, since the year 2004, the 120th stick that has been lost by the British government and it agents.

The lost stick was lost and found in the Nightclub “The Club” in Newquay, Cornwall. How it got there and how it was lost is till now unknown. Maybe it would be a good idea to actually ask which member of staff it was who had the grandiose idea to carry that stick with him or her with such sensitive data into a nightclub.

The loss of this stick and the unencrypted data on the stick could have been rather dangerous for the soldiers concerned, especially in light of the always mentioned danger from terrorists. In fact it is rather amazing that to this very day none of the lost data has, apparently, not fallen into the wrong hands and been misused. This despite the fact that in most instances none of the data has been encrypted in any way, shape or form.

To any terrorist the lost stick with the data of the soldiers would have been a goldmine and would have made them very happy indeed. On the UBS stick were contained the exact times of travel, the destinations and all routes and planned accommodation. Phew! Only good it did not get into the wrong hands and was found by an honest person. One day the luck will, however, run out, of that we can be sure.

The Ministry of Defence has only called this incident in its statement a “unhappy incident”. To call this attitude blasé probably is an understatement. How can any government and government agency have such attitude with such kind of sensitive data? This is especially difficult to understand as hardware encrypted USB sticks are no longer costing a fortune and regardless of cost, such data should, if stored on USB sticks, should, nay must, be put onto such sticks that are encrypted to the highest standard. Otherwise the day will come when the luck will finally run out and such data found will be used against this country and us, as the people of this country.

© M Smith (Veshengro), September 2008
<>

Another case data loss by UK Government another case of deja vu

by Michael Smith

Slowly but surely the feeling of deja vu overcomes one when one hears how well the British government, either directly or via private contractors and subcontractors, deals with the private data of its citizens and employees.

On Saturday, September 6, 2008 the Justice Minister was informed of the fact that a contractor to the government has lost a hard drive with the private and personal information of 5,000 prison service staff. While it is, obviously, worrying enough that such a hard disk has been lost, the most worrying part is the fact that it has been lost for about a year already and only now the company acting as a contractor to HM government had the integrity to actually inform the relevant department of the fact that this hard drive is gone, lost, cannot be found.

First question in my mind, aside from the fact of asking what took them that long to admit the loss, is how on earth you can lose a hard drive. While, I am sure, we all, to some extent, can understand how one could mislay and lose an USB stick or a CD with data, losing a hard drive, whether, and we have not been told, this is one that actually sits in a PC or is removable, is something entirely different. This loss in my mind smells to high heaven of theft, probably stolen for financial gain. What is the bet that none of the data held on that hard drive is encrypted in any way, shape or form?

So far we have one incident after the other of data loss from the offices of the British government and/or its contractors or subcontractors and they still expect the people to trust them with personal data.

They tell us that the data for the new passports and the ID cards that they want to introduce on a voluntary compulsory basis (yes, that is a contradiction in terms) is going to be completely safe and cannot be misused (ever) by anyone.

Right, sure, and on an airfield nearby a squadron of pigs is preparing for takeoff.

The same contractor that recently has lost data on the stick and in other ways is the same one that has the contract for the national ID card scheme. That really inspires confidence – NOT. In addition to that hackers have already announced that they are capable of getting into the chip on the passports and ID cards and that they can alter data or extract data from them.

Not that they seem to need to do that. All they need to do is watch the employees of the contractors losing USB sticks and such.

The way this country, in government and banking, is dealing with data is making the UK a laughing stock amongst the countries of the world as far as data security is concerned. Small companies have, more often than not, better security measures in place as regards to their data sticks and such than, it would appear, the British government and all its branches. Worrying indeed, this is.

© M Smith (Veshengro), September 2008
<>