I rather think they've just killed that particular idea. No body is
going to stand for it now.
More to the point when will Ian Blair do the honourable thing?

The main point of my post was that you never *know* when businesses
do these same things..

You get to hear about it much more readily than you do with the
blackmail and security break-ins that you get with banks on a very
regular basis, just for an example.

Indeed, but don't go thinking that they're the worst offenders.

They should all be shot, Darling down, just in case, pour encourager les
autres. Let them understand that we really want data security.....

Steve

Given that he's not been fired, but resigned, I'm sure there'll have
been an expensive get-out clause that gets triggered if he resigns,
after all it wasn't him who caused the problem so he's fallen on his
sword and will claim the expensive payoff that'll be in his contract.

Yep.  It's like fining my dad if I get caught speeding.  People have
to obey the rules, and if the main thing that happens if you don't is
that your bosses bosses boss gets a fat payoff and takes early
retirement if you f.ck up then why bother consulting the well-documented
rules.

Secondly this is not an issue that would never have happened if the
rules had been followed.  The only difference that following the rules
would have made is that the package would have been sent via
registered post rather than courier.  There is no need in the rules to
encrypt such sensitive information, only at higher classification
levels, e.g. "secret" rather than "restricted" do things start to get
properly secure.  The database was only marked "restricted" so could
be sent unencrypted in the post.  That's been standard practice across
all british governments for a long time and other countries do similar.

Sucking his keyboard for inspiration, hugh typed:

From recent BBC articles, the answers to these questions would appear to be:

frequently
no authorisation necessary
none

It's an absolute f.cking disgrace.

The reason the head honcho was booted out was because the correct
policies were not followed by the monkey on the floor, if the correct
policy had been followed and the CD had been lost, he would not have
had to step down!  Stupid I know, but that's the rules.  I suspect he
"was resigned" to try and head off a furore.  Chances are he was quite
happy to take the payoff and retire.

I'd totally agree that the way such data is treated is IMHO cavalier
and I've always boggled at the idea of it being regarded as "safe" to
just put sensitive information into two envelopes and send it in the
post without any encryption at all.  When I was first required to do
this, I queried if it was correct as the data was sensitive and I
would never send such stuff when working in the commercial sector
without proper encryption (and I don't mean passwords on word files or
zip files).

However, the head honcho booted out over this had nothing to do with
this daft policy, it's government-wide and similar is done overseas.
I think it's daft meself.

There's a lot of issues with policy not keeping up with technology, I
can't give examples but I've worked on projects where I have tests to
perform that were written 6 years previously and when I spot a major
problem that's not in the spec, then it's regarded as "out of scope"
and I'm not even allowed to put it in the report.  Not all are like
that, just some where the test requirements have been written with too
much precision by someone who doesn't do the technical side of security.

Surely, even under the data protection act, they have the duty to apply the
strictest confidentiality to just one individuals personal details.  When
the data covers the details of 25 million then it must be afforded the even
higher caveat of secret and handled accordingly.  Also, under the data
protection act, is there not a non-disclosure to any other
parties/individuals clause?   Surely the government department is guilty of
breach of the act of parliament?!  The NAO specifically instructed HMRC not
to send all of the details - on three occasions - probably all too aware
that both departments would be swimming in murky water if, as has
unfortunately but almost inevitably happened, the data got lost or somehow
leaked.  Meanwhile, Brown is rather conveniently swanning around on some
foreign junket and "eyebrows" Darling is hiding in a bunker somewhere....

Steve

yeah, blaming the previous administration starts to look a bit silly when
you *were* the previous administration.  Also, when it's 10 years since the
other flavour of twats were in power, people will, hopefully stat to
question why if it was so bad in ten years they've not made it better.

Naah, not a problem, I rarely cook and I do have an iron, but it gets
used perhaps 6 times a year max.  I don't miss the list of orders when
I finish work, that's for sure.