leyton.org

Breaking news about a horrific breach of process that has led to 25 million records going astray between the Revenue and Customs, and the National Audit Office. Clearly somebody in the organisation screwed up horrifically, and is probably nursing a P45 and watching our most senior politicians defend themselves with a very very bad sinking feeling.

Clearly a flaw with individual judgement, and organisation process and management, but also with regards what it says about the IT systems in place at these public organisations.

Firstly that they enable data to be written to removable media AT ALL in such a trivial fashion (ie. without people having had it beaten in to them how it’s done). Disabling devices should be standard practice in places dealing with sensitive personal data: Removable USB drives/pens are easily secreted in to and out of organisations, it’s reasonably easy – as well as sensible – to disable the USB interfaces on corporate systems. Similarly, writeable removable media (DVD/CD drives) shouldn’t be installed at all, and access to the media itself controlled. E-mail can be monitored and restrictions placed on likely content. Even basic attachment size restrictions, even before content checking/policy systems that can easily be use to catch simple/accidental screw ups by foolish staff.

More fundamentally, and dealing with the ‘lost laptop’ issue that has popped up occasionally, why is sensitive data being pulled off of restricted/fixed systems? Remote desktop systems (Citrix and the like) easily enable remote workers access to sensitive data in appropriate ways, but don’t expose laptops unnecessarily. There are also heavy encryption products that can protect entire accounts, and with a strong password policy and secure id systems, protect data from such loss.

But data needs to be exchanged at times. So this is where they have processes that are normally used ensure these issues are covered. However, in this rogue case it was mentioned that the disks were “password protected”. This is not an assurance: It’s important to emphasise that password protected is very distinct and different from encrypted. They are NOT the same thing. Thankfully the BBC appears to have picked up this, although Jane Kennedy MP (Financial secretary to the Treasury, and presumably one of the chancellors minions offered up to the baying media), seems dangerously keen to brush over this vital difference.

In itself, password protection is no assurance at all. Exchange of data in many organisations is frequently (in my sad experience) unencrypted: There’s a huge lack of understanding of the basics of protecting data, and people frequently don’t realise that a simple password on a file does not protect data at all from a determined individual with access to the file. But heavy duty encryption does. Look at PGP/GPG type technologies that enable data to be encrypted such that only a designated recipient can view it.

Finally there was Darlings atrocious defence of the Conservative well placed charge that it undermines the Governments entire ID Card policy. To that, Darling said the national Identity Register was “protected by biometrics”, he said, and “therefore more secure”. I’m afraid I find that derisory in the extreme. Back-end data is not going to be protected by such from internal staff.

It is all extremely concerning, and I’m beginning to wonder (perhaps a little affected by the BBC coverage vernacular that seems to be building to a hyperbole crescendo) whether this, along with Northern Rock, could build into a resigning matter and threaten public confidence in this government.

I imagine – hope even – that a lot of people were taken aback to hear the news today that a ’senior judge’ is calling for everybody to be put on the DNA database. The main reason cited it’d be ‘fairer’ than the widely acknowledged to be broken and unfair system, where anybody arrested by the Police is permanently added to the database, and it is badly skewed to minority groups. So putting everybody in it as somehow the fix? It really is putting the cart before the horse.

I suppose it’s a highlight of the silly season that we get opinions from judges and retired politicians that generate headlines, as the media hacks champ at the bit in the build up to the political conference season. But what’s worrying here is that the minister put up to respond on Radio 4’s Today programme really didn’t do much to dismiss the idea. He said the right things to avoid being gummed to death by the increasingly tedious interview style of John Humphreys, but it left me feeling this was more a political ‘outrider’ to make the introduction of ID Cards all the more tolerable to the British Public: Introduce the prospect of something awful, dismiss it, and only then introduce the thing you wanted all along as ‘better’, and not the proffered bogeyman that everybody was scared about.

This DNA database proposal, and the ID cards that are surely related, is all part of the same march towards ‘The State Knows Best’, be it judges talking about universal DNA databases, or the government changing the fundamental relationship with the public from that of our servant to our benevolent master.

If this whole proposal yanks your chain at all – and I really hope it scares you as much as it scares me – can I quietly suggest you make a bee-line over to Liberty and sign up as a member? It is the most vocal Civil and Human Rights campaigning organisation in this country, and has been at the forefront of the fight against the campaigns waged by the various Home Secretaries we’ve had over the last few years as they seek to increase Police powers whilst decreasing scrutiny and even basic access to justice. Their campaigning voice – already strong – is all the more influential and effective with more members.

It’s no longer the case that we can tut from the side lines and shake our heads and presume that “it’ll all work out in the end”. This famous poem about apathy in Nazi Germany is increasingly pertinent to this country right now. Can we really presume Cameron’s Conservative party will be any difference if they ever get in power? Can we actually NOT expect to be presumed guilty until proven innocent, as a national DNA database could allow?

I’m deeply worried that OUR collective apathy as a nation is taken as implicit acceptance of everything the Government does to erode our hard-won rights.

It really is time to make our voices heard.

The Repeal vote has opened with a truly disappointing shortlist that is sure to appeal to middle-England, but is sadly reactionary and horribly predictable in it’s contents.

Listening yesterday to the (disappointing) panel wafting it’s way through the nominations, and brushing aside the opportunity to push the debate in interesting directions, I soon lost hope it’d be a relevant list that did little, at least for anybody who doesn’t read the Daily Mail. Certainly no Identity cards act, which is perhaps the most significant ever change in the government-citizen relationship. It’s exclusion demonstrates the ignorance, wilful or otherwise, of the panel and – I fear – the wider public – to the implications of the act.

Anyway, the shortlist…

• The Dangerous dogs act is certainly a poor piece of legislation, but it doesn’t in itself really matter all that much other than to demonstrate knee-jerk legislation is a bad idea, and more scrutiny is needed across all our legislation. Not that I expect any government will pay heed to that.
• The Human rights act brings sensible laws in to our statue book, but has been turned into some bizarre hate-figure by the Daily Mail for entirely superfluous reasons.
• The Hunting ban was inevitable on the list, and is probably going to win. More time wasting. But then the ban is ignored anyway, and until it is enforced I don’t quite see why the hunting lobby just don’t keep a low profile and get on with their vicious past-time.
• Ditto the European union act. The EU has been a huge benefit and brought economic prosperity to this country (just look at who are biggest trading partners are), but again a certain group of newspapers has turned it into a bete noire. People would be voting against a self-created, and self-perpetuating mythical beast, rather than the act itself and what it represents.
• Act of settlement 1701. An act preventing catholics ascending to the throne. Well, let’s get rid of the throne itself and we’re sorted. No more religious discrimination. That we have a head of state that is appointed by accidents of birth is truly ridiculous.

I’ve therefore voted for the last item, the Serious Organised Crime and Police Act 2005 (with reference to the limitations on demonstrating near Parliament), because it’s the only item on the shortlist I feel strongly about that isn’t a sop to middle england. That the government feels it can selectively ban free-speech, no matter how inconvenient, is ridiculous. But it’s a missed opportunity by Today, when there are other pieces of legislation that will affect all of our lives, and could better use the attention this vote will bring.

Vote here

I heard Radio Four are looking for nominations of laws that should be repealed, and no2id Glasgow’s timely e-mail coaxed me in to action.

So regular readers won’t, of course, be surprised to read that I’ve nominated the Identity Card Act 2006 as the single worst piece of legislation that’s appeared in years for the way it undermines our liberties, will cost billions that could be better spent elsewhere, and won’t in any way help solve the problems the Government is claiming.

http://www.bbc.co.uk/radio4/today/vote/2006vote/ is the URL. Feel free to suggest your own if you think there’s something better that should be taken off the statute book.

Excellent piece in The Register arguing that ID Cards could actually be dead in this parliament.

Whilst I fear that too much political capital has been associated with ID Cards to write it off, the piece extrapolates the available information nicely, factoring in the likely forthcoming political events. This starts next week with Reid’s Home Office review, which will need some close attention to find out where the ID Card projects sits in the priorities. Leaks seem to be consistently imply that key parts of the projects are getting postponed….

Nick Robinsons analysis also adds weight to this: Reid likely to postpone rows, especially costly ones. Fingers crossed.

Following on from the news that Whitehall staffers are concerned about the scheme, the wider media is beginning to pick things up, including the BBC. I had seen this excellent piece in the Guardian only moments before my friend Ben sent it over to me suggesting I link to it.

It does an excellent job of summarising the issues, the atrocious and shifting justifications given by the Government, and highlighting the fundamental issue for me and many others, that the identity register proposed fundamentally and irrevocably alters the balance and relationship between us – the people – and the government. They are supposed to serve us. With an identity register, we become the subjects of government, as well as of that prehistoric and pointless royal family.

If you remain apathetic on this issue, I’d suggest you give it a read and tell me you’re still not concerned. Then check what the anticipated costs are, and compare that to the money it’s supposed to “save”.

El Reg has an article that ID Cards may be doomed, according to some leaked e-mails from Whitehall. This was originally broken by the Sunday Times.

Well, it’s a welcome beating with the reality stick for Mr Blair’s lackys. Countless people, including myself, have been writing, campaigning, and generally doing everything we can to say it’s a Bad Idea, badly conceived, badly planned, poorly structured and completely unnecessary, not to mention being more of a security risk in itself. Talk about a sledgehammer cracking a nut. And almost all of this would appear to be becoming the case inside Whitehall, if the story has even a modicum of truth.

But I fear it’s not going to stop Blair and his coherts until the “waste-o-meter” reaches the billions of pounds. There are too many political careers nailed to the “ID Cards” banner, including the PM-in-waiting Gordon Brown. Plus there’s a ’stealth’ ID cards system already coming along through the passport system.

Whilst all this potentially bad news for us the tax payer, for the campaigners it is at least some good news as it clearly demonstrates that the arguments being made opposing ID cards were based on sound argument and reason.

For more on the whole farce, visit no2id (Why Not? is a good intro to the issues). If you’ve a minute or two longer, you might also be interested in my article on why ID Cards are to be feared.

It seems a bit hard to believe at first, but it’s happening. Schools across the country are compulsorily fingerprinting children without the consent of the parents. It seems to be with regards some supposed library system, but it seems rather over the top, and that it’s without the consent of parents beggars belief. Especially when parental consent is required for so many other things, not least sex education, swimming lessons, and away trips. So why not the capturing of biometrics information, the use of which seems a little murky, and rather ominous, and in a time when identity theft is of growing concern. Surely childrens identities are of equal value, and deserve equal protection and appropriate consent.

A campaigning website has been set up, and it seems momentum is building. no2id brought it to my attention, seemingly via a national tabloid campaign too. If you’ve kids at primary school, or involved in their teaching, it’d make sense to familiarise yourself with the issues.

Due to the Lords-cave-in (”they’re not elected so they have no say”, but barely a third of the UK voted for the Government as is, due to the broken first-past-the-post system we’re stuck with) with some half-hearted compromise on a poor definition of ‘compulsion’, we’re now looking very clearly down the barrel of ID Cards being rolled out in this country.

But the battle is not over. Not by a long shot. Enter this nice piece of mathematics, showing the logistics required to even roll out the system across the UK. Of course, this is all assuming the system is fully operational and cost-effective, which I seriously doubt.

One of the biggest problems facing the anti-ID card campaign is that frequently encountered problem any grass-roots campaign faces: Sweeping apathy on the part of the Great British Public. “It won’t affect me”, “What have I got to worry about, I’ve done nothing wrong”, and “What harm is a bit of plastic” are standard retorts. Of course, that will probably change when the implications of the card are more widely understood, not least the obligations and penalties placed on the public at large, but most of all the significant costs involved – which the Government refuses to properly divulge citing “commercial confidence”, when it’s the public that is paying the bill through their taxes. no2id.net explains this in more detail, and this e-mail did the rounds recently, and succinctly explains the problems and issues.

I still remain convinced the biggest threat is the power to track accesses to the national identity register (ie. recording who has queried your information). This is woefully under-reported in the media, and will enable a very detailed picture to be built up on our lives by anybody with access to the database. We always assume it’s a benevolent thing to capture information, and assume the best of those accessing it. But it’s a huge honey-pot of information, that will create a significantly new risk of identity theft, and expose everybody in this country unnecessarily.

So there we have it. The rebellion on the ID Cards bill was quashed as The Leader In Waiting made the necessary noises, plus a few supposed “compromises” were, for the Government at least, well aimed to give what few rebels there were in the sycophantic back benches of the Labour party, an utterly misplaced feeling of success.

So brace yourself folks. You might want to consider asking the barber to shave a little patch at the back of your head ready for that tag to be nicely visible every time you interact with the Government machine.

If you’re not into tattoo’s, well, your passport will do – it’s been made clear that Biometrics will be appearing on some passports to be issued from April. That’s the start of the process that will end in everbody being compelled to have and carry an ID card.

Oh, and don’t think that any of this is voluntary as the Government would have us believe. Not a jot of it. Because many people need passports, we will have no choice but to apply for a passport when they expire and then get one of these horrible little cards – plus the far more ominous record in the National Register. Once you’re in, you’re in. No way of being removed at your request (so much for data protection, eh?)

Whilst I suspect any attempt to return the ID card will be ignored, I at least am very fortunate that I have very little interaction with the state beyond paying taxes and running my own company. Others are less fortunate, and the “non-compulsory” cards will be further forced on people through the implicit threat of bureaucratic delays, problems and other awkward hindrances that possessing an ID card would purportedly solve.

It’s compulsion, plain and simple.

The sheer audacity, and increasingly right-wing nature of this Government leaves me with a feeling of dispair I haven’t felt since the sabres rattled ahead of the invasion of Iraq. I have lost any last vestige of hope that The Leader in Waiting will be any better. What he makes up for in supposed left-ish sentiments and policies, he loses in belligerence, bloody-mindedness, not to say a penchant for fiddling (didn’t his mother tell him to stop?) with red tape: Try filling in office of national statistics forms, when you’ve already completed Inland Revenue returns with the same data in, and then tell me small company red tape is being reduced as He supposedly claims.

Worst of all, in contrast to my doom laden words earlier, I fully expect that this country is about to witness a spectacular amount of money being wasted. It pains me immensely, but we’re talking of the order of £15 billion pounds. Why? The ID card technology simply isn’t proven (I know, I’ve seen, used, and read-up on biometric measures), is insecure (read the proposals for why), poorly considered (did they listen to anybody other than the people who’ll be selling the technology?), badly planned (where they’ve even gone that far), badly researched, offensively detailed in what it records about individuals and their interactions, and completely and utterly unnecessary as a tool for any purpose other than to massage ministers egos and give them a misplaced assurance we’re somehow safer with expensive (We’ll be paying the taxes that subsidise them) pieces of plastic in our pockets. Plus, it seems MP’s don’t even care about financial costings. The list goes on

I’m sure a few school children could come up with a better way to spend that sort of money. The school children, I’d hazard, would certainly care more about it than the sycophants who probably don’t understand what they’re voting against as they fumble their way through the lobbies hoping to catch the eye of the whips.

Still, the fight goes on. Much like the Poll Tax, I think when people actually experience it in their daily lives, they’ll realise what they’ve sleep-walked into.