Write to your MP today: stop the Government’s privacy timebomb
On Monday next week Kieron Poynter of PricewaterhouseCoopers will publish his report into the failures that led to HM Revenue and Customs (HMRC) losing 25 million confidential records about UK citizens claiming child benefit. The HMRC fiasco, and privacy debacles before and since, demonstrate a public sector culture of complete disregard for the privacy and security of individuals in the UK.
There will be a Ministerial statement about the Poynter Review in the House of Commons on Monday afternoon. If you haven’t already, please write to your MP today and ask her or him to put your concerns to policy-makers during this session. This culture of disregard for personal privacy combined with the Government’s continued belief in the aggregation and sharing of vast amounts of personal data across agencies is a privacy timebomb.
If you’re unsure how to write an effective missive to your MP, then read the ORG wiki’s handy guide. What follow are some key points and requests to put to your MP for you to choose from – click on the links for further ideas and resources.
- How does Government propose to tackle what is clearly a culture of disregard for citizens’ personal and confidential data?
- Why does Government persist in telling the “fairytale of biometrics”
- Shouldn’t Government be ashamed that it has consistently brushed aside the advice of computer security experts?
You could also ask your MP to sign the Early Day Motion proposed by Annette Brooke MP which calls upon the Government to reconsider its decision to proceed with the children’s database ContactPoint.
Discgate was not an isolated incident. Seven months before the DVDs went missing, HMRC had already established a practice of recording sensitive data onto DVDs, secured only with a password and dispatched via internal mail. Emails sent back and forth about this debacle, the largest ever data breach to hit the UK, cite cost as the reason given for not filtering personal details out of the data. But how much is your privacy worth to you?
This is not just about the HMRC. The ORG wiki’s log of UK privacy debacles has been struggling to keep up with the public sector bodies who have been queuing up to admit data breaches since the HMRC announcement. The HMRC data breach may be the biggest but it was not the first and it will not be the last.
If you’re MP is wondering why a junior employee was able to download the information to CDs in the first place, then they’re in good company:
“I would question whether anybody should be allowed to download an entire database of this scale without going through the most rigorous pre-authorisation checks.”
“It was a really shocking example of loss of security.”
Information Commissioner Richard Thomas
“How you can have a system which allows you to copy a whole database onto a disk is of concern,”
“Clearly there are issues about when the data was accessed and by whom. They should have had access controls and authorisation levels to make it physically impossible to burn a disc off the database without the say-so of the chairman of HMRC. Why isn’t the technology there to do that? It isn’t rocket science.”
The Information Commissioner described the HMRC breach as “the worst the ICO has encountered” and said it called into question the security of the entire system of data sharing in government. He called for a review of the national identity register, a call which echoes a marked shift in public opinion on ID cards, and a recommendation for more debate about ID cards from thinktank Demos, who concluded a year-long study of data-sharing last week. The Government’s data minister, Michael Wills MP, has said that plans for the national ID register need looking at again. Ask that your MP pressures the government to re-examine the flawed National Identity Register.
On 27 November, children’s Minister Kevin Brennan announced an independent assessment of the security procedures surrounding ContactPoint, to be conducted by Deloitte. An Early Day Motion asking Government to go further, and consider recommendations to scrap the idea, is currently collecting signatures: please encourage your MP to sign.
For people in technology, one of the most worrying developments since this crisis has been ministers’ using it as an excuse to push for solutions based around biometrics, solutions that would actually increase the privacy risks we are exposed to. Six leading academics (including two Open Rights Group Advisory Council members) recently wrote to the Parliamentary Joint Committee on Human Rights to express their dismay at how biometrics are seen as a magic fix for improving security:
“These assertions are based on a fairy-tale view of the capabilities of the technology and in addition, only deal with one aspect of the problems that this type of data breach causes. … Furthermore, biometric checks at the time of usage do not of themselves make any difference whatsoever to the possibility of the type of disaster that has just occurred at HMRC. This type of data leakage, which occurs regularly across Government, will continue to occur until there is a radical change in the culture both of system designer and system users. The safety, security and privacy of personal data has to become the primary requirement in the design, implementation, operation and auditing of systems of this kind.”
These technologies are unproven and will not be ready for commercial deployment for another 15 years. Ask your MP to encourage the Government to listen to the facts on biometrics.
Unfortunately, the skills and knowledge necessary for successfully procuring, managing and securing computer systems are not commonly possessed by Government Ministers or senior managers in the civil service. This might not be such a problem, were the Government to listen to the advice that has been readily offered by expert groups during the quest towards Transformational Government, and their warnings about giving thousands of people access to large, centralised databases. But then, why should it, when apparently it doesn’t even listen to warnings from its own internal auditors?
“Again and again and again these warnings have been made in different contexts by expert groups and the Government has not been interested.”
We are living in an age where systems dealing with our identity must be designed from the bottom up not to leak information in spite of being breached. Perhaps I should say, “redesigned from the bottom up”, because today’s systems rarely meet the bar. … There is no need to store all of society’s dynamite in one place, and no need to run the risk of the collosal explosion that an error in procedure might produce.
Britain’s HMRC Identity Chernobyl – Kim Cameron (Microsoft’s Chief Architect of Identity)
Ask your MP to encourage the Government to heed the warnings of these and other experts.
Together, we can stop the Government’s privacy timebomb. If you haven’t got time to write to your MP today, please write on the weekend. The more missives MPs receive on Monday morning, the more they will recognise the public mood on this issue, and the more likely they will be to raise their objections in Parliament on Monday afternoon.