'Cover-up' or ignorance?
Did he cover up as the Tories claim or did he not know? The release of e-mails relating to the child benefit data fiasco have been used to suggest that the chancellor was guilty of a "cover-up" of the role of senior officials. Alastair Darling鈥檚 focused purely on the role of "junior officials".
I am told that when he spoke to the Commons the chancellor had not seen the e-mails and had not been told of the potential involvement of a senior official. The briefing note produced for him by the NAO - which has now also been published - certainly did not mention a senior official.
The suggestion that a single 23-year-old on low pay at the Child Benefit Centre in Washington is solely responsible for this saga may suit certain people - including the managements of the NAO and HMRC who have clearly clashed in their accounts of this affair - but it beggars belief.
PS. The excellent by Ben Brogan, who鈥檚 travelling with the prime minister, neatly observes that just as our leader flew abroad, the generals moved in and took over all TV and radio broadcasters. Poor Gordon Brown has just suffered a very British coup.
I'm 
Comments
If, after days of internal investigations, Darling knew about the emails then he misled the House. If he didn't know about them then he was himself misled. Either way it demonstrates a culture of incompetence and cover-up - as constructed over the past decade by our illustrious leader. As you say Nick, it beggars belief.
This is starting to look like the Government is attempting to protect senior management within HMRC and dump it all on this junior official.
To me, the important thing is the attempt to deny that senior management approved sending the data on discs, but admit that they were copied in on the e-mails. The fact is that by copying in senior management on the e-mails, the junior official was making them aware of the request and how he planned to action it. As senior management said nothing and did not object, the junior official could quite legitimately accept that this was an acceptable way to proceed, and do so on that basis.
Senior management cannot deny that they were aware of the request. Nor can they deny that they made no attempt to stop the data being sent. Therefore, senior management are responsible for the actions of their juniors.
There is so much misinformation here it is maddening.
For once, however, I don't think it is from Darling or Brown, but from middle management who don't want to be sacked.
Much of this is revolving around the high cost of retrieving the data from the database.
Except there is NO high cost involved. Ask the database managers at the 成人快手 how easy it is.
HMRC, like many other organisations, use a relational database. The whole point of these databases is that they use a standard language (called SQL) to retrieve data very quickly and easily.
Let us say you have a database called BENEFITS and you want to get the names and NI numbers of everybody on it, but not get the tons of other information. How do you do it? You use this line of code:
"Select Names, NI_Number from BENEFITS"
That's it. And these database management programs come with lots of tools for exporting the data in lost of different ways - in seconds!
So, all they had to do was ring their IT department and ask for the data to be run off.
20 quid including the CDs? That is what is should have cost.
So, either the Tories are being opportunistic and the managers are cowards or our government is being ripped off by someone - but either way, this bit of the story is simply all backwards.
The action of the generals must be one of the finest examples in recent times of revenge being a dish best served cold!
This also presents Cameron with an interesting situation. Go in too hard and Labour can go on the defensive whilst making Cameron look weak if no Labour resignation occurs (Kinnock tried the same with a no-confidence vote on Thatcher and failed if memory serves). Go in too soft though and the backbenchers are left still feeling hungry.
With bad news coming out at the current rate, I suspect Cameron's best option is to apply a consistent medium-heat whilst seeing what other murk bubbles to the surface!
The NAO is not a Government Department but reports to the House of Commons via the Public Accounts Commission. NAO of course can (as auditors ) demand data from any Government Department, Agency or government funded organisations (I recall they visited the sixth form college where I was a governor). So presumably it has been asking for other parts of the Government etc for personal data and getting it on CD's in zipped but unencrypted form from junior officials. And by the way can be ask Tesco and other large private organisation about its procedures for safeguarding the information customers give (e.g to Club Card.)
The Commission meets in public on December 4th. I would have thought public concern about the current situation on personal data would override it not involving itself in the day to day operation of the NOA.
Well done Nick
Your experience is well demonstrated by your original caution in the use of the word 'junior' - getting a specific definition.
That you received a correction as to the meaning of 'junior' is surely a clear indication that the word was specifically and carefully selected to give a certain impression that does not support the actuality.
The generals revolt is a major story and I think you're missing a trick by not commenting directly.
The debate was scheduled regardless of the PM's diary. And of course serving soldiers aren't complaining - its what they're told not to do and in front of a CO, they are hardly like to start grumbling to the PM.
The generals are just showing loyalty to their men (something the government aren't doing) and using a platform and freedom not open to the average squaddie or their bosses.
When the armed forces start taking pot shots at the Govt, something must be very rotten as these are the people who are prepared to die (much more important than some missing data) at the PM's whim, so its about time you gave this a little more attention and stopped taking the Downing Street line about poor Mr Brown being attacked when he's out of the country. There are legions of press officers both here and in Uganda to defend him and he hasn't answered the basic questions:
1. Why no specific mention in the Queen's Speech?
2. How can Des Browne possibly do three jobs equally well?
I think Comment #3 has a point. Extrapolating specific pieces of data from a large database is the whole reason for having data management programs, and it does not take a large amount of time and money to run 鈥渜ueries.鈥 If it did take time then these programs can be run overnight.
A junior official, like an Admin Officer, would not download data onto a disc and post it internally without being told to. I think there is more of this story still to emerge.
Ben Brogan鈥檚 blog was worth reading but defence under spending has been occurring for many years 鈥 just ask the troops about equipment shortages.
Key issue here is that people effected have to make the lost data invalid. So it cannot be changed.
Best way:
1) close account - so if anyone attempts to use this account number if future its clear sign of attack
2) Change national insurance number
Why has government not offered all effected a new number - so old (lost) number has no validity
My daughter is 12 - does she have to spend 40 years worrying about her number....
All numbers on these disks should be changed - to invalidate the informatio.
Also why no reward - surely these disks are worth 拢1,000,000 reward for being discovered.
Their contents after all is work billions to identity thiefs.
welcome to world of calamity brown
Joss, I can't imagine it being that simple regardless of the SQL used.
25million records, over assorted tables.. That can get rather expensive in computational time as opposed to financially, not to mention the knock on effect of slowing down other queries against the database.
Have you ever tried running even a short query against a busy oracle server? A huge dump of 25 million records is not a trivial task, when you are taking it from a live database, and you need to make sure that the rest of the users are not affected.
鈥淲hile we all value our civil liberties, protection from criminals should be seen as a right鈥攁 compulsory right that our Government should be expected to protect. When identities are stolen, our privacy is stolen. When identities are stolen, our financial safety and security are under threat.鈥
These are the words of my MP Celia Barlow (Labour) in the debate about compulsion in the ID cards debate from February 2006.
I wonder if she鈥檇 say the same thing in the same way today.
I agree with Joss Sanglier.
How much did it cost for the NAO and HMRC to argue (sorry, discuss) about how much data was to be supplied and what properly serious justification = did HMRC give to send a lot more than the NAO required (we don't use ordinary databases perhaps)? How much would it have then cost the NAO to extract just the data they needed? Way more than a simple line of code and burning a couple of CDs.
And that justification NOT to have filtered the data MUST have come from a more senior manager. The natural inclination of the IT guys (being in the business) would have been to filter the data as just sending the lot would have fired off alarm bells at every level.
Unless HMRC is riddled with incompetance, from IT to admin, from junior to senior, with a cavalier disregard for the data and procedures, someone, somewhere more senior than a 23 year old junior clerk must have okayed this transaction.
Where's the follow up info on Northern Rock on the bbc today? Doesn't look as though taxpayers money is safe there either.
Money, info, this government is playing fast and loose with anything they can't get their hands on!
I have no confidence in them any more (not that I ever had all that much) - where's the discussion of what happens next?
In a former life I was a "junior" official within Department of Work & Pensions and I completely believe the Government's side of the story, but this does not absolve them from blame. Basically, the computer systems are so old and creaky, and so many demands are made of it that a prioritised work programme exists, and its always full. Something like the NAO's request is basically impossible to fulfill within any reasonable timescale. Some hapless guy would be told to "sort it", and that is what has happened. The problem is, the computer systems in place are so antiquated, and the cost of replacement so vast, that successive Governments have dodged the issue while the problem got worse.
Add to this, the fact that Blair's Goverment (back in my day) are so distrustful and arrogant in dealings with their Civil Servants. They basically want things done, with no resource and no excuse. Things like this debacle have happened before, with the difference being that the disks got where they were meant to. The Government is to blame by neglect, although this junoir lad really should have known better. I would have delivered said disks by hand!
Further to #3, although the technical details are blanked out in the emails, one suggests that it's a "mainframe" system.
The way I see it we have two different possibilities:
A) The senior management at HMRC knew of and condoned sending large quantities of private information in a poorly secured fashion.
B) The senior management at HMRC didn't know that junior office types could copy large quantities of data onto CD and post it off.
How exactly is B any better than A?
You touched on the 'what constitutes a junior official issue' earlier.
If memory serves me right, didn't a Minister complain that he had been 'accompanied by "somebody so junior"' as Dr David Kelly at the Foreign Affairs Committee? He was merely 'senior adviser in biological defence at Porton Down' as 'seconded to Proliferation and Arms Control Secretariat at the MoD' and probably the UK's top man in the field.
'Junior' in this context may just be a complete red herring.
I'd be charitable, though, and go for the 'ignorance' option. When you see the rafts of socially engineered, authoritarian legislation that NuLab is trying to drive through to force people to behave as they think they should, irrespective of how strange some of the content is, and how out of touch it often is with the views of the general populace, should we really be that surprised that they have their eye off the ball to the extent that they are proving incapable of properly funding and managing the basics, which is what we actually employ them to do?
As for the generals, good for them. It's about time someone was digging up bad news for a change.
If a junior admin clerk had routine access to this data then this represents a massive breach of security. Every minister who has ever assured the public that the most sensitive data is handled only by those who have been properly vetted and trained would have richly deserved a pillorying for their dishonesty (as well as their head examining for their naivite).
If the junior clerk did not have routine access to the database then he had to seek it from someone. An internal inquiry has now been running for some weeks - in the course of which someone must have asked the clerk about the source of their instructions. For the Chancellor to have ruled out higher authorisation so confidently, the clerk must have been unable to provide the slightest scrap of evidence to suggest that he had been told to do what he did.
Which leads us inescapably to the conclusion that the Government neither vets nor trains those it puts in charge of our most sensitive data.
I'm a software developer and there's one part of this that I have not yet seen covered.
Nick, have you or any other reporters asked what technical, instead of just management, access controls are in place to stop general access to the whole database ?
In other words, does a high level manager need to enter a authorisation access code/password before a employee can copy the database ?
If the answer is yes, then that's evidence of high level involvement right there.
If the answer is no, then the government needs to be severely criticised for specifying and installing a computer system with no proper access controls in the first place.
Also, if the answer is no, then the government should be asked which other systems have insufficient access controls as well.
If it had been a "junior" civil servant then there would have been an IT security issue about appropriate access (and there still is). However, everything about the correspondence reeks of a culture in which IT security is simply not an issue, and the protection of the "data subject" is irrelevant. It's not a surprise. It's why I have been suspicious of the NHS Spine and the ID card scheme from the beginning.
What is seriously disingenuous is the argument proposed in the debate that the biometrics on the ID card will protect the individual from this kind of action. The problem was at the database, not the card. The fact that they can say this betrays a very basic ignorance of what they are doing, to the point where their capacity to judge what they are being told is clearly in question.
Retired generals leading a coup against the UK government! not likely they don't have the freedom to do IT.
It has become routine to attribute major foul ups to anonymous (fictional?)"junior officials" or "failure to observe procedures", in order to cover up incompetence on the part of cabinet members and senior civil servants.
The most galling aspect of this fiasco is that the senior person was allowed to time his resignation perfectly and slope off a year early with his pension pot intact..with accolades for doing the "honourable" thing.
No matter who did what their is someone else at fault than a "junior" civil servant.
If he had authorisation from someone more senior it is them, if he did not it is whoever put in place a system that let him do it without authorisation.
We know from the emails that the computer services company EDS was involved, probably in maintaining an IBM mainframe computer hosting the database in question.
This means that if any request for service comes along that does not fit exactly the service contract that was signed between EDS and HMRC, then that will involve 'extra money' for 'extra work'.
It does not matter how trivial the request is in technical terms, as in this case (shown by post #3 above), somebody must pay EDS to do this.
So, rather than 'waste' taxpayers money on EDS to do precisely what was required, somebody took it upon themselves to dump the whole database.
As an acquaintance of mine who worked at HMRC memorably said a few years ago 'EDS have us by the balls'.
HMG knew what they were getting into with the likes of EDS, but went ahead anyway (whilst simultaneously attempting to shaft home-grown IT freelancers with the IR35 tax).
If you look closely enough, you'll see that there have been a number of 'unhealthy' links between some Ministers, ex-Ministers and the likes of IBM, Accenture and EDS.
I spoke to ex-MP Martin Bell informally about this a while back, and his blunt response was that Whitehall was corrupt.
Simon , disgust at a junior official having access to take a full DB backup has been expressed by many, but not on this blog yet.
viewing multiple records, fine, offloading even as 'few' as hundreds should have been impossible, the security setup is a total shambles, they should have headhunted the best DBA's in the country and paid them accordingly to set this up, and keep it in shape!
Even the heads of their departments shouldn't have access to a full db dump.
The real story has now been revealed. The issue is not that the junior official sent the data in the internal post; but that of the way in which 'information' is treated.
There is no justification for not anonymising the data if it is to be passed out of HMRC; no matter the cost. If it is too expensive then NAO should examine the data under the supervision of HMRC staff at HMRC premises. There is no doubt that Cap Gemini, or EDS, or who-ever runs these systems would have charged for having the work done but the cost of this versus the cost of repairing the damage is minimal. Essentially, this is a failure of the risk management process and there is no way that a so called junior member of staff is responsible for that. The bottom line is that the sending of data through the post is not the story - the story is why the data was sent at all and in relation to that the government has not yet accepted that a fault has occured.
The NAO statement that it is HMRC's data and proposing that somehow that absolves them from responsibility for looking after the data subject to security guidelines is just pure obfuscation.
There have been failures across government in this situation and the organizations should be prosecuted and the responsible people jailed.
I would traditionally have voted labour but this government is now past its sell by date.
What seems to escape all the " senior" people involved in this is the simple question of why any junior people have free access to such a colossal database and also the equipment and security clearance to copy it at will.
That such open access is available at all suggests the senior staff have absolutely no idea of what adequate data security systems look like or how they should be managed.
I used to VP of R&D in a major pharma company and even I didn't have a cd burner in my laptop. I could tell you what the answer would have been if anyone had said "Can I copy all our product formulation data onto a couple of CD's please?" except that its not repeatable here.
Its no use trying to blame the junior staff if senior management leave the stable doors open, the electric fence turned off and shut themselves away in their Ivory Towers too pre-occupied to notice that the stock is on the way out of the door.
Its their responsibility, that's why they are called senior and paid accordingly. Likewise they should accept the consequences of failure.
Whatever else you might say about the now ex England football manager, he didn't complain, he didn't duck and weave, he came out and faced the music, took full responsibility. At least he looked and behaved like a decent and honourable man and at least his integrity is intact.
As an IT professional with several years experience of dealing with large databases I support the contention that exporting only the required data should have been a simple operation. The suggestion that EDS was in line to get UKP5,000 for this suggests... greviculture as the French call it. That's GRAVY CULTURE. Someone is making a buck.
What's also astonishing is that at a time when 90% of UK Internet users are using broadband that the revenue are sticking disks in the mail. I can download 2 CDs worth in minutes (using Be broadband, nominal 24Mbps, actual is about 17Mbps).
Not just is CEO of the agency keeping his pension, he's keeping his salary.
So "it is just me or are we beginning to look like the Tories in the mid 90s?" is a very relevant question.
Beginning is not the word.
What seems to escape all the " senior" people involved in this is the simple question of why any junior people have free access to such a colossal database and also the equipment and security clearance to copy it at will.
That such open access is available at all suggests the senior staff have absolutely no idea of what adequate data security systems look like or how they should be managed.
I used to VP of R&D in a major pharma company and even I didn't have a cd burner in my laptop. I could tell you what the answer would have been if anyone had said "Can I copy all our product formulation data onto a couple of CD's please?" except that its not repeatable here.
Its no use trying to blame the junior staff if senior management leave the stable doors open, the electric fence turned off, the cattle grid covered over while they shut themselves away in their Ivory Towers too pre-occupied to notice that the "stock" is on the way out of the door.
Its their responsibility that there are inadequate or non implimented management controls and security systems, that's why they are called senior and paid accordingly. Likewise they should accept the consequences of failure.
Whatever else you might say about the now ex England football manager, he didn't complain, he didn't duck and weave or pass the buck, he came out and faced the music, took full responsibility. He looked and behaved like a decent and honourable man and at least his integrity is intact.
One thing seems to have been overlooked. The NAO - if reports are correct - had already received discs in the same manner - with the same information - before. Why did the NAO not pick up the break in procedures? If the NAO cannot spot this, how will anyone else?
A junior official dealing with such confidential information should be subject to oversight from a senior manager. It is basic security.
It seems to boil down to targets and KPIs taking priority, regardless how they are achieved.
What is required now is an independant audit of all Government processes within such departments. The auditors need a free hand and access to all information. No witch hunt - the damage has been done, get it sorted out and ensure nothing like this happens again.
Surprise, surprise another delay!
Anything that goes wrong there always seem to be delays, we shouldn't be surprised by them from this Government though.
So, one sunny morning the office junior decided to send a couple of CD's, this ought to have been a criminal offense and we have heard nothing, surely he was told to send them!
Lets face it the office junior is just a senior person who's does something wrong and doesn't to be blamed.... not Alister Darling but Gorden Brown is the prime mover here as Chancellor for it was his doing.
This ought to be classed as a criminal offence, just what can we trust them with, certainly not with private data so why trust them with what they say.
Just like the DVLA fiasco selling private data, more leaks than a broken water pipes.
Some of the redactions in the published documents are a little excessive, since the names can be determined from other docs published by HMG.
Going by the HMRC annual report, the recipient of the letter at the end can only be Sarah Walker at HMRC. Interestingly both she and Paul King who is in charge of security report to Mike Hanson. A case of conflict of interest for Mr Hanson? Why is security not within, say, IA or Governance?
I expect that the sender, and some of the other redacted names, could be readily identified from the Civil Service Yearbook, or Whitaker's Almanac. One wonders why HMG is pretending to hide this already public information? A "culture of coverup", perhaps?
'1) close account - so if anyone attempts to use this account number if future its clear sign of attack
2) Change national insurance number
Why has government not offered all effected a new number - so old (lost) number has no validity'
Brian - no 9
Although this is clearly a mess, people like Brian really are worrying unduly. NI numbers are not 'secret'. You often use the number when you fill in a form. They're essentially in the public domain, and I wouldn't have a problem telling anyone what mine was. No need to close your bank account either - you'll only open a new one, and the number will be printed on all your cheques, if you have them, and you'll have to give it to the government if you claim child benefit.
You should just do what you have always done - check your account regularly for any odd transactions. And if you haven't been doing this, you should start!
Wouldn't it have been cheaper to send the auditor to the department?
Once the records have been accessed in an SQL or Oracle search, filtering requires less processing power so accessing all 25 million records to save to CD already used the brunt of the power. The record's fields could have been filtered on the client PC for the cost of MS Access.
Have Mr Brown's and Mr Darling's records been compromised? What action has been taken to safeguard their identification security? Do I and my daughter not deserve the same?
I hope the next calamity does not involve national security.
Some of the redactions in the published documents seem a little excessive, since the names can be determined from other docs published by HMG.
Going by the HMRC annual report, the recipient of the letter at the end can only be Sarah Walker at HMRC. She is, therefore, the "data owner" referred to in the letter. If this is the same as the "process owner for child benefit" referred to in the letter at the top of the PDF, then she is also the senior copy recipient of the March 13 email.
Interestingly both she and Paul King who is in charge of security report to Mike Hanson. A case of conflict of interest for Mr Hanson? Why is security not within, say, IA or Governance?
It is also interesting that all these emails are marked "confidential", a term with a defined meaning and requiring specific handling. Why is this applied to the emails, but apparently not to the data being discussed?
I expect that the sender of the letter to Ms. Walker, and some of the other redacted names, could be readily identified from the Civil Service Yearbook, or Whitaker's Almanac. One wonders why HMG is pretending to hide this already public information? A "culture of cover-up", perhaps?
Nick, one of the posters noted the lack of news on Northern Rock. I was fortunate enough to be in the audience in the Glasgow QT, and sitting very close to Wendy Alexander as she said that the taxpayers money loaned to Northern Rock is "almost certainly safe". Almost? She did not look very confident about any questions thrown at her and Nicola Sturgeon wiped the floor with her (I'm no supporter of the SNP either).
David Cameron needs to apply solid pressure against the Government and maintain it. Don't bother about votes of no confidence, but keep repeating the demands for information on brid flu, Northern Rock, the Armed Forces, HMRC and keep going. Someone will crack. In fact, all it will take is a few Labour backbenchers who have had enough and then the whole mess will spill over.
Added to all this we now have record oil prices and fuel bills are about to rocket.
What difference does it make if the data was sent by a "junior" official or not? Surely the "senior" officials should know and authorise EXACTLY what the "junior" officials are doing - especially in a government department dealing with such sensitive information. No one in society wants to take any responsibilty for anything that goes wrong anymore - it's always 'someone elses' mistake and 'I cant do anything about it.'
EDS are the service provider and these service contracts are written with legal precision, in terms of its requirements.
Therefore, if there was not a requirement for EDS to generate a precise report of this nature in the contract, then the service provider would require extra money to be paid, in order the fulfil a requirement that had not been previously defined.
The fact that the type of report to be generated was a relatively trivial SQL-type query is not relevant.
The Civil Servants involved knew that and so to 'save money and time' apparently dumped the whole database, which presumably was a pre-defined function.
That is how it 'works' in the commercial world, that is, there is no latitude whatsoever for a bit of give-and-take, it is all legally defined.
The only 'give' is via the hapless English taxpayer and the 'take' is the political food-chain and the service providers such as EDS, IBM, Accucenture et al.
Nick, I have seen a post that says that the details of the children of Politicians and Celebrities are excluded from the database that was lost. If this is the case the public must be told. If our elected members at Westminster are exempted from the potential problems the country faces on this issue they cannot share the depth of our anxiety
Cynically, perhaps the junior official sent the disks to Northern Rock, and his monthy mortage payment to the NAO.
Seriously, is this just the groundwork to discredit National Insurance Numbers as a Unique Identifier in favour of a new number for National Identity cards?
Breaches of the Data Protection Act are "an offence". Section 61 states that this applies equally to the directors of corporate bodies. are we going to see prosecutions of those responsible or are Civil Servants as immune to such charges as policeman appear to be to murder?
Indeed the briefing note supplied to the Chancellor by the NAO did not refer to the involvement of a Senior Official. Nor does it mention a Junior Official! Where did that come from? Or was he trying to mislead by using the term in Whitehall Civil Service code as opposed to how it would be interpreted on the street?
It seems that the "Sir Humfrey's" of Whitehall may have been in the dark, the "Bernards" may have got a small inkling when it was too late whilst those below were probably following the "Not me Guv" philosphy.
The problem may be that a lot of the Managers at the "Junior" level responsible are most likely young University Graduates with limited experience at the front edge. They will learn much from this, and because of the high profile it is unlikely the same mistakes will be made for quite a few years.
To all those posting that extracting the data is easy or cheap, don't overlook the fact that the IT work is outsourced. Therefore running the right queries on the data is not as easy as it might appear. If a junior needs to produce this report, I would imagine it is unlikely that they may not have the luxury of the "correct" query or indeed the means to run it.
They also more than likely have several layers of bureaucracy and expense above them in pursuance of it, which makes the figure of 拢5000 which is being reported to manipulate the data look all the more reasonable.
This in itself is absurd given that you would expect audit functionality would be built in to such an IT system, especially as the NAO request differs substantially from the actual data lost. 100 rows and 3 fields.
In response to your initial question Nick, I think both are present alongside utter incompetence, all in equal measure.
The UK Civil Service considers anyone with a grade up to and including that comparable to an Army Colonel as being "junior".
see
From the exchange of emails it looks as though the "senior official" "knew" what was going on because he was on the CC list. If that's so, the first thing to check is how many emails this official gets every day. If he is (as some government bods are) getting hundreds of "CC" messages a day from everyone else in the building who thinks that everyone wants to have everything, then the official can hardly blamed for not reading them all.
The more interesting question is, as several others have commented, how did he get on to a machine where he was allowed privileges to save everything to CD.
But I'll buy the explanation that the "junior clerk" was told "just do it" by someone too busy, or too ignorant, to realise what they were asking.
It's just another one of those stupid cover up stories that insults the intelligence of the British public.
Telling us that they gave 25 million child benefit records to a junior employee hardly absolves them of responsibility!
In a former life I was a "junior" official within Department of Work & Pensions and I completely believe the Government's side of the story, but this does not absolve them from blame. Basically, the computer systems are so old and creaky, and so many demands are made of it that a prioritised work programme exists, and its always full. Something like the NAO's request is basically impossible to fulfill within any reasonable timescale. Some hapless guy would be told to "sort it", and that is what has happened. The problem is, the computer systems in place are so antiquated, and the cost of replacement so vast, that successive Governments have dodged the issue while the problem got worse.
Add to this, the fact that Blair's Goverment (back in my day) are so distrustful and arrogant in dealings with their Civil Servants. They basically want things done, with no resource and no excuse. Things like this debacle have happened before, with the difference being that the disks got where they were meant to. The Government is to blame by neglect, although this junoir lad really should have known better. I would have delivered said disks by hand!
It is not just the fact that they lost these disks, it seems to have been ignored that the disks were being sent in the first place. It's a pretty bad affair that the Government is willing to share all our details with the NAO and whoever else. Imagine the outcry if a non-governmental organisation was sending our private details to whoever requested any information. Surely somewhere in all this there has been a breach of data protection laws?
Joss Sanglier at post 3 has described the process required to get the data but I believe he has underestimated the cost becasue the database is now admintersted by an external contractor.
Therefore the revenue not only has to pay for a minor techie to do the actual work, but all the extra overheads of the big company which needs to make a profit out of every transaction it is asked to do.
If you subcontract your IT department then you had better buy a barrel with some of the money you save, because you will be over it every time you want anything which is not in the original contract - and unless you were very careful you will find that you have paid for very little indead.
Of course the office in question could have filtered the data, but remember all the IT staff were transfered to the contractor, and having enough skill to burn a CD does not imply enough skill to manipulate data.
However, the Data Protection Act still applies. The junior officer should have known enough to require authorisation from the "Data Owner" to send out the data, and it is the "Data Owner" who is responsible - either for authorising the transfer or for the inadequate training of the junior officer.
So both the civil service and the armed forces are overstretched...
...tax-cutting Tories, anyone?
Coverup or ignorance? In the halls of government, it is usually both. One failing feeds off the other.
They've been found! No, not the records of 25 million individuals, but those files that were lost when sent from a Scottish Hospital recently. Which illustrates that files go missing all the time. It happens in firms too!
Most missing files turn up in a cupboard somewhere, not in a compromising position. That's not a plea for complacency. I am making a plea for moderation in this hysteria. I wonder how many tapes and files get lost - temporarily or otherwise - at the 成人快手? How many 成人快手 payslips or expense claims get issued to the wrong person? Don't worry, I won't exercise my FoI rights just yet.
Usually there's enough news coming out of the "news nachines" to keep newsrooms busy. But with less real spin these days, mountains need to be made out of molehills.
It's not events that are difficult, dear boy, it's whether the results turn out straight. That'll be the real test of Northern Rock and the HMRC loss.
I hope Andrew Dundas does not work for HMRC with such a complacent attitude. The personal details and unique identifiers (NI numbers - which can never be changed) of A WHOLE GENERATION have been lost. That potentially means that every child in this country, for the rest of their lives, may be at risk of identity fraud, with all that implies for credit ratings, mortgages etc. I am not sure that some people like Mr Dundas realise the true scale of this massive cock up even now. It is not just a routine screw up; it is an unforgivable lapse of security with life-long implications. With this government's record in respect of its relationship with the truth, even if it were announced that the discs had turned up safely, who would believe them now? It is a timely warning about the wisdom (or lack of) in government plans for even more sensitive central
We know from the emails that the computer services company EDS was involved, probably in maintaining an IBM mainframe computer hosting the database in question.
This means that if any request for service comes along that does not fit exactly the service contract that was signed between EDS and HMRC, then that will involve 'extra money' for 'extra work'.
It does not matter how trivial the request is in technical terms, as in this case (shown by post #3 above), somebody must pay EDS to do this.
So, rather than 'waste' taxpayers money on EDS to do precisely what was required, apparently costing about 拢5K, somebody took it upon themselves to dump the whole database.
As an acquaintance of mine who worked at HMRC memorably said a few years ago 'EDS have us by the balls'.
HMG knew what they were getting into with the likes of EDS, but went ahead anyway (whilst simultaneously attempting to shaft home-grown IT freelancers with the IR35 tax).
If you look closely enough, you'll see that there have been a number of 'unhealthy' links between some Ministers, ex-Ministers and the likes of IBM, Accenture and EDS.
I spoke to ex-MP Martin Bell informally about this a while back, and his blunt response was that Whitehall was corrupt.
As Kinnock found out, an opposition never won an election just by going hard on government incompetence. It begs the question - would it have been any different if the Tories were in power? Judging by their current lack of coherency and reliance on spin over substance, it is highly unlikely they would stand up to the rigours of an election campaign without serious heavyweight policies.
Cameron cannot spin his way into Downing Street - he is not a spider. Either he comes up with the goods that makes him look a possible government leader over the solid and reliable Brown (ten years as Chancellor isn't all going to waste, I hope; and Brown is canny enough to let the recent tide of problems wash over him and cut and run before the Tories even know what date it is) and if what I am hearing is anything to go by - from the provinces, not metropolitan London - the Tories are nowhere near even the 2005 high-water-mark without something of substance to offer people that doesn't look as if it has come out of a think-tank press release.
We need real policies from the Tories and we need them now. Otherwise there is going to be five and maybe ten more years of this and that is the last thing Britain needs at the moment.
NICK
I AM a low-grade Civil Servant & have experience of NAO, best described as a pain with their demands.
However, there is a difference between cc-ing your e-mail to an alleged Senior Manager and actually e-mailing said manager directly, or going to see them about a problem. I'm sorry to say it, but alleged Senior Manager, if not INFORMED about the discs & downloads, would probably not even read it.
You learn, as a junior Civil Servant, CONSULT,ASK SOMEONE WHO KNOWS. That clearly hasn't happened here & the fact is someone hasn't used common sense in the situation ie I'm a public servant-How would I feel in their shoes;would I want MY bank details going anywhere off of our database?
My part of DWP has an awesomely bad reputation, so you can guess what it is. I can assure you, though, customer confidentiality is something we work flaming hard at on a daily basis. So does the vast majority of the Civil Service!
Unfortunately, Nick, this scenario, as outlined by Alistair Darling IS possible. It doesn't need any malevolence or malice aforethought-nor even a moment's thoughtlessness;just a moment's not thinking it through-which ain't the same thing!
Is it not a criminal offence for details of people to be sent by HMRC to NAO when NAO has told HMRC that it would not need those details (see sections 17 - 23, Commissioners of Revenue and Customs Act 2005 and section 8, National Audit Act 1983)? The criminal offence may relate to the discs which arrived at the NAO and contained information which HMRC had no legal duty to send.
So the approved procedure was to send the same confidential data by registered post. Hardly a way to protect the information beyond saying with certainty that someone picked up the package.