Click here to monitor SSC
SQLServerCentral is supported by Red Gate Software Ltd.
 
Log in  ::  Register  ::  Not logged in
 
 
 

Every DBA's nightmare

By Phil Factor,

When a copy of all 25 million of the UK’s child benefit records, including bank details, went missing in the post, whilst being sent to the NAO (National Audit Office) on 18th October, the UK government must have known that a cover-up was impossible.

Nevertheless, it tried with a botched, delayed, and inaccurate statement to parliament which made matters worse. The story that first appeared in the UK press was of a junior official within the HMRC (HM Revenue and Customs) who took it upon himself to send the data on two CD ROMs unencrypted through the post. When the recipient failed to receive it, there was a delay until 8th November, three weeks later, before it was reported to senior management. The banks then insisted on a delay before the loss was made public, a week ago.

The story made no sense at all. It is impossible for a junior member of staff to have a copy of the entire Child Benefit database without authorization from senior management. If it were possible, then there would be no need to look for the missing disks as it would have been copied many times before. No competent IT staff would have sent unencrypted data of any type. There was also no imaginable need for the National Audit Office to have this data.

The story then began to unravel. Staff began to leak. The so-called ‘junior official’, identified as the culprit, had worked there for 23 years. The National Audit Office had never wanted all the confidential data and asked that it be taken from the data they were sent. HMRC had refused, saying it was too complicated and expensive to do (?). The sending of the data had been authorized by a senior official and had been discussed since March this year. The NAO had asked for the data to be sent ‘as safely as possible’, The non-arrival of the disks was known about by HMRC six days after the disks had been sent, on the 24th October. More revelations will be coming as the press scent a cover-up.

The cost of the error will be at least 200 million pounds, even if the disks have escaped falling into the wrong hands. If the data is used for identity fraud, it will be far higher. The damage from the inaccuracies in the original statements by the UK government has seriously weakened its credibility, and has increased hugely the opposition to the idea of a national identity card.

I know from personal experience that the DBAs that work for HMRC are extremely competent. It simply doesn’t make sense that they would have allowed the breach of all accepted practice that led to the loss of data security. The idea that it was impossible to do merely an extract of the data for the NAO couldn’t have come from them (surely they’ve heard of the ‘Select’ statement?) It is impossible for this sort of incident to happen in the organization without gross interference from senior officials, and astonishing neglect of their duties. At this stage, all we can do is gasp and watch as the details of the story emerge, but it is an incident that none of us can read about without taking renewed account of the importance of data security at every level. This sort of incident is every DBA’s nightmare.

Total article views: 124 | Views in the last 30 days: 3
 
Related Articles
FORUM

Do you consider yourself a Senior DBA

How can you justify your title as a Senior DBA

BLOG

A Special Belated Happy Canada Day to Leader of the Official Opposition

  Dearest Michael Ignatieff, Leader of the Liberal Party of Canada, Official Leader of the Oppositi...

BLOG

A New Season (A Networking Success Story)

I’d like to share a networking success story.  Last year, I blogged about my experience at the PASS ...

FORUM

Horror stories for Halloween

What is the worst consultancy horror story you've heard?

ARTICLE

Cell Phone Horror Stories

These are some stories that show the downside of everyone having cell phones.

 
Contribute

Join the most active online SQL Server Community

SQL knowledge, delivered daily, free:

Email address:  

You make SSC a better place

As a member of SQLServerCentral, you get free access to loads of fresh content: thousands of articles and SQL scripts, a library of free eBooks, a weekly database news roundup, a great Q & A platform… And it’s our huge, buzzing community of SQL Server Professionals that makes it such a success.

Join us!

Steve Jones
Editor, SQLServerCentral.com

Already a member? Jump in:

Email address:   Password:   Remember me: Forgotten your password?
Steve Jones