My first reaction to the sheer scale of HM Revenue and Custom's loss of 25 million child benefit claimants bank detail was one of amazement, but I have to confess it was the number of records that amazed me, rather than the fact that some of it went missing.
It's an uncomfortable truth within the new information economy that often data security is frequently treated in a cavalier and slack fashion. From my personal experience I have worked in organisations that would be quite happy to fling fifty grand at a new firewall, but would also allow thousands of unencrypted customer data records to be biked around on recordable CDs.
Similar instances are abundant.
Hollywood studios agonising over DRM schemas and anti-piracy clauses in their contracts and yet happy to be letting their master tapes be transported around Soho in plastic bags carried by temps. Or the Natwest bank clerk in the Victoria branch who left me in his office with a pile of other customer's address and balance details face up on his desk the other day. Or the receipts from shops with the full credit card number printed at the top.
From big to small the list goes on, and it doesn't take a rocket scientist to realise that your data is no longer either safe nor private. Not because the technology is inherently insecure or vulnerable to interception, but because the technology makes no allowances for the society in which it exists.
Private information just isn't treated as the gold-dust that it is. We would never dream of transporting bank notes by courier, but data is often a different matter.
Now that a quarter of the nation's information security is compromised perhaps it's time to consider just how far out of the bottle his particular genie is.
Consider for a moment the digitisation of police, financial and educational records. Consider perhaps most importantly the upcoming placement of your medical records on the NHS "spine". There will soon be almost no part of your recorded life that will be susceptible - maybe not to deliberate attack, but definitely to the certainty of release by cock-up.
Throw in to this mix the myriad amount of other information that we've ourselves slung up on flickr, facebook and youtube and it's clear we have blundered into a new age of accidental freedom of information.
Will this lead to a dramatic re-evaluation of e-government, with a corresponding rolling back of centralised access to information? Somehow I doubt it.
However I think that this calls the whole concept of an ID card system into doubt. Whereas before we may have worried about abstract notions of our liberties being infringed by such a scheme, now we have the irrefutable truth that having that much data on so many people in one place is almost certainly going to get leaked someday, if not by design then certainly by accident, and we have to seriously plan for the impact of this.
If that impact is irrecoverable then we should can the whole shebang now.
No comments:
Post a Comment