The junior staffer at HM Revenue and Customs who just mislaid personal data concerning 25m people is in good company. He/she can draw solace from the experience of Jared Ilovar, the Ohio state intern who earlier this year mislaid 800,000 social security numbers.
Funny how cases like these always follow the same pattern:
Ageing media. Ohio trusted its data to tapes, HMCR burned its information onto disks. When there’s a need to move such sensitive data around, why put it onto storage media that can get lost in the post or stolen from the back of a car?
Encryption. Or rather, lack of it. If the UK’s tax authority doesn’t use data encryption, what are the chances that any other government department will be any more secure?
Access. How come junior employees and even interns in government agencies have access to vast troves of data, and the ability to move them around seemingly at will? It doesn’t seem enough to protest that this was unauthorised. It shouldn’t have been possible.
Lack of accountability. Both of these cases could very well have remained buried. Three weeks after sending (and losing) the first set of disks, the unnamed HMRC official simply sent another in its place. The Ohio intern was told to keep quiet about the theft of tapes from his car. How many other failures like this simply never come to light?
