HMRC incompetence beggars belief.

Everyone's aware that the HMRC (british tax and customs government agency) accidentally shipped a plaintext file on disks in the ordinary post with 25M people's national insurance, bank account and other personal information, in response to a request from the Govermnet audit office for some sample data.
Ross Anderson and Ian Brown (and others) appeared on Newsnight last night to very good effect, and it was quite clear that the government spokesperson failed to understand the real nature of the problem which is not the "one off" nature of the error in sending a file unencrypted (this is an operational error of fairly huge proportions) but is the fact that this is symptomatic of a government that allows low level staff the ability to even create a copy of the entire database - this should not be possible, by design. Any decent system of mission critical data will have methods to control the damage that can be done - have they never heard of the idea of "need to know"??? As was pointed out, the fact that they are so ignorant of the simplest principles of data based access control means that they are unfit to propose other systems in this space (ID cards, NHS spine, etc etc) since they will make the same, criminally negligent, mistakes.

I'd like to point out that if I now claim someone has withdrawn money from my ank account, or masqueraded as me using my NI (national insurance == social security ID), they have no course but to believe that it is from this leak. we could run a massive denial of service attack on the bank accounts of many people now by simply observing that ID is virtually worthless.

pathetic, no - more - someone should go to jail.

oh, another note: someone seems to think (brown?) that they've "lost" the records!!!
they havnt - dont they understand that they have still got them - what they have done is PUBLISHED the records, by making a copy widely available. when wil lpeople understand that "sending" a datum is not "sending" - it is making a copy, and transmitting the copy...and if you send to persons unknown, you are publishing.