benefit details of 25 million people missing (uk)

[Odpierdol_sie!]

HM Revenue and Customs (HMRC) officials were warned to ensure CDs containing benefit details of 25 million people were delivered "as safely as possible".

The warning from a National Audit Office (NAO) official was sent 16 days before the information went missing.

It is one of a string of e-mails released by ministers as they seek to prove top officials did not sanction the sending of sensitive data.

Another e-mail reveals concerns about the cost of removing bank details.

The government has been under fire since it was revealed the two discs went missing after they had been sent by unregistered internal post.

See sequence of events in the lost CDs scandal

The Conservatives say the crisis is down to "systemic" errors at HMRC - but the government insists it was the fault of low level civil servants.

Ministers released the e-mail exchanges, from March and October this year, in a bid to prove their case.

One of them was sent by an NAO official on 2 October, 16 days before the data went missing. It said: "Please could you ensure that the CDs are delivered to NAO as safely as possible due to their content."

The same e-mail also asked the recipient to ring the NAO when the CDs had been received so that the relevant passwords could be passed on.

Another message, dated 13 March from an NAO official, with all names blanked out, says: "I do not need the address, bank or parent details in this download - are these removable to make the file smaller?"

The e-mail is marked: "URGENT Extract from Compliance scan," its importance is listed as "high" and its sensitivity "confidential".

Cost implications

But another e-mail from the same day, from an HMRC official, appears to suggest officials were concerned about the cost implications of stripping sensitive data from the files.

It says: "I must stress we must make use of data we hold and not over burden the business by asking them to run additional data scans/filters that may incur a cost to the department".


BBC political editor Nick Robinson
What about our privacy and our rights? No mention is made of them
BBC political editor Nick Robinson

Read Nick's blog and those e-mails

But the HMRC has stressed that although one of its senior officials was copied in to the e-mail exchanges from 13 March, there is no evidence that he or she made the decision to release the data.

Caroline Mawhood, the NAO's assistant auditor general at the NAO, says in a covering letter to HMRC Acting Chairman Dave Hartnett: "The email was sent by a junior HMRC manager. It refers to a reluctance to provide data in the filtered form the NAO had requested.

"We also agreed that our own NAO audit director was aware of this position, and that we have no evidence that the Process Owner for Child Benefit made the decision to release the data. The NAO is not making any issue of this."

A National Audit Office letter also reveals Child Benefit files were sent to accountancy firm KPMG. The firm says the files were returned "by hand" to the NAO and that any information on its own system has been deleted.

'Serious questions'

Shadow Chancellor George Osborne said far from clearing senior officials of blame the e-mails released by the government were evidence of "systemic failure" at the HMRC.


MISSING DATA INCLUDES
Part of child benefit form
National insurance number
Name, address and birth date
Partner's details
Names, sex and age of children
Bank/savings account details

Enlarge Image

He said Chancellor Alistair Darling now faced "serious questions about the version of events he gave earlier this week that this was some lone figure sitting by themselves at a computer. That is not what these e-mails reveal".

In a separate development, the government is seeking to reassure people that their personal details have not fallen into criminal hands.

In a letter being sent to seven million families, HMRC apologises for losing the data but says it is still "likely to still be on government property".

It says police are continuing to search for the discs but "there is no evidence that it is in the possession of anyone else".

Data checks

On Wednesday, Prime Minister Gordon Brown apologised for the data loss but said it was down to officials not following the rules rather than "systemic" failures at HMRC caused by budget cuts.

He has ordered security checks on all government departments to ensure data is properly protected.

HMRC is protecting the identity of the official blamed for sending the two discs containing the details of 25m people by courier from the Child Benefit office in Washington, Tyne and Wear, to the NAO in London on 18 October.

The official, who the BBC understands is a 23-year-old man, has reportedly been suspended pending disciplinary action.

# Her Majesty's Revenue and Customs has set up a Child Benefit Helpline on 0845 302 1444 for customers who want more details.

LOST CDS - SEQUENCE

Here is how the crisis unfolded.

MARCH 2007

A junior official at HM Revenue and Customs gives the National Audit Office a full copy of HMRC's child benefit data, in breach of security procedures. That information is later safely returned.

SEPTEMBER

Records of about 15,000 people's details go missing after being sent by HMRC to Standard Life. Also in September, a laptop containing around 400 ISA (individual savings accounts) customers' details is stolen.

18 OCTOBER

Child benefit data is again sent to the NAO by a junior official, using the courier company TNT, which operates the HMRC's post system. The package containing two CDs, containing details of 25 million individuals, is not recorded or registered and fails to arrive.

24 OCTOBER

The NAO tells HMRC it has not received the package. An HMRC spokeswoman said the official believed it may have been delayed by the postal strikes or in the NAO's office move and did not report it. A second copy is sent, again in breach of procedures, but this time it is sent by registered post and arrives safely.

8 NOVEMBER

Senior HMRC management are informed that the 18 October package is missing.

10 NOVEMBER

Alistair Darling is informed and tells Prime Minister Gordon Brown. Mr Darling orders an immediate investigation and searches of all premises where the package might be, as well as action to ensure it does not happen again.

12 NOVEMBER

Mr Darling is told by HMRC that evidence has been found which might help to find the missing package.

14 NOVEMBER

The chancellor decides the HMRC searches have failed and tells HMRC chairman Paul Gray to call in the Metropolitan Police.

15 NOVEMBER

The chancellor goes to Information Commissioner Richard Thomas, who agrees that remedial action must be taken before a public statement is made.

12-18 NOVEMBER

Mr Gray tells Mr Darling he feels he should resign. The chancellor seeks the advice of the Financial Services Authority and Serious Organised Crime Agency, while banks are alerted by HMRC.

20 NOVEMBER

Mr Gray resigns following an announcement that Mr Darling is to make a statement to the House of Commons. The chancellor outlines what has happened and announces an investigation of HMRC's security procedures by PricewaterhouseCoopers chairman Kieran Poynter, alongside the Independent Police Complaints Commission, which monitors the HMRC.
21 NOVEMBER

Prime Minister Gordon Brown apologises for the "inconvenience and worries" caused and orders security checks on all government departments. The Conservatives produce e-mails they say show senior HMRC officials approved the downloading of the entire Child Benefit register - including bank details - on to discs to save cash.

22 NOVEMBER

HMRC writes to seven million families to reassure them that the missing data is "likely to still be on government property". The government denies the personal data was put on to discs at the request of senior officials.

[Odpierdol_sie!]

I know people are gonna be sweating it now, but i just love it wen things like this happen, makes big brother look like a complete twat.