Britain's largest private pension scheme reveals scale of Capita break-in Universities Superannuation Scheme, the UK’s largest private pension provider, says Capita has warned that details of almost half a million members were held on servers accessed during the recent breach. The USS made the disclosure today, saying that it uses Capita technology platform, Hartlink, to manage in-house pension …
-> “reputational damage for a key supplier to critical UK government services such as Capita is likely far greater.”
A contract that was outsourced to Capita is cancelled on those grounds. Or, when some large public body rejects a tender from Capita on those grounds. Or, when HM government, in general, rejects Capita from bidding with those ground stated for disqualification.
Three options. My tarot cards offer no such prediction.
Tender process:
Q1. To avoid the risk of your company failing to be able to deliver this contract, do your annual revenues meet or exceed Crapitas?
Q2. Are you an existing supplier and can therefore skip any competence tests?
Q3. Are you willing to provide the lowest cost bid, knowing that you can more than make up for it with scope changes
Q4. Do you have multiple board members who make generous donations to political parties? Bonus points for supporting multiple parties to avoid being caught out by pesky elections.
Q5. Do you have and easy to hate PR spokespeople that can be wheeled out in front of the public to divert attention for any failures on the part of the government, the bureaucracy or you company?
Please submit your tender documents in envelopes large enough to support your tender submission and enough Bank of England padding to ensure the submission is not damaged in transit.
Maybe if the Gubermint actually employed and nurtured talent in-house, they wouldn’t need to outsource.
Outsourcing is another way of saying “we have no clue” and need outside help.
The Gubermint, you know, the supposed intelligent people running whole countries.
Nepotism strikes again
If you nurture in-house talent then they might get ideas above their station. If you get rid of 1,000 civil servants and replace them with Capita people who know nothing and are 4x the cost, you can pretend you've saved money at the same time is putting fear into the minds of other civil servants
>actually employed and nurtured talent in-house, they wouldn’t need to outsource
We (sort of Government) brought stuff back in-house at the last cycle (we still tender out desktop support and network provision because those require resources we don't have). Bringing our infrastructure support back in-house saved us huge wedges of cash - enough to have 5 full-time people looking after stuff on a partly-rota basis.
Stuff gets done more quickly, end users are happier, everyone wins (apart from the outsourcers).
We've used Capita in the past. I'd like to say thatt they were the worst people we've dealt with but, sadly, there are a lot of ex-Capita managers out there in various outsourcers who seem to have the career goal to perpetuate the Crapita methodology elsewhere.
Hint to outsourcers - pricing the standard service at below the cost to run it and then hoping to make up the difference through vastly inflated 'project' fees is not a viable business method, especially when dealing with an experienced service management team who have seen it all before. Also, please don't try the old trick of closing calls before the KPI report then re-opening them afterwards - you'll find you owe us copious service credits because we know about that little trick and wrote it as an addendum to the contract..
It is not as simple as that.
The tender process is a complete minefield of regulation in what you can and cannot do.
These huge frameworks that are in place with "call-off" are way to attempt to work around some of this but actually make things worse.
Ironically much of the regulation around tendering is filtered down from the EU with the best of intentions but has just turned into a bureaucratic nightmare. The sole purpose of tendering now it so prove that you have been through a process to prevent unsuccessful responses from suing.
That most of the successful responses are useless is a minor retail. Caveats in terms of turnover, previous contracts blah, blah all favour the same few useless corporations that have only got to that point because 20 years ago they bid for a tender or two.
If you want to fix this then tonnes of process has to be zapped and replaced. That will take years because it is such a mess and all the people on the frameworks will howl with outrage as their gravy train stops.
Equally there has to be a cultural change in the writing of the ITT and so on. So much of this is driven by legal, finance and procurement teams because that is where the actual responsibility is when unsuccessful responses decide to sue. The actual technical suitably and ongoing accountability once a tender is awarded is a minor insignificance.
>The tender process is a complete minefield of regulation in what you can and cannot do.
This is true. Even writing the spec so as to apply to a very limited set of companies (one is a very limited spec) can get you in trouble if one of the competitors decides to challenge the requirements.. Even a bog-standard request will see the unsuccessful bidders calling for a review - which *has* to be responded to, wasting more time and effort.
However, we do have 'industry reputation' as one of our criteria. It's amazing how many companies step back when they discover that clause.
It seems that it's not the actual pensions system/database that was compromised but some fileserver used by Crapita to do admin tasks on the pensions system. It appears this fileserver had various dump/export files from the pensions database for various clients probably used for massaging data and bulk updates, the problem is that they were left lying around and were not encrypted...
Indeed, I came to ask if anyone knew how, if Hartlink was not breached, that USS members' data had been compromised? I'm pretty sure that dumping/exporting from a secure database will constitute a breach of the contract that USS has with Capita which, you know, might specify how the data are guarded in line with the GDPR? I think I can hear the sound of knocking on m'learned friends' office door even now.
Irrelevant of what happened... the data was (possibly) exfiltrated. According to the USS press release to its members, Crapita has told USS to consider the data exfiltrated until specifically told otherwise, and to warn all their members that are affected of this.
Of course, no offer to pay for fraud monitoring (should exfiltration have occurred) has been forthcoming from Crapita.
... For the information about this. No doubt the UCU union will have an absolute field day given that this pension fund holds the pensions of every lecturer and every member of staff of every classic uni (and many research orgs) in the country. Well done, Crapita, well done. I guess the next evaluation will be lower still to hide the fact that this happened instead of recovering any damages from Capita, and all that'll be offered will be a year's fraud monitoring.
I worked for one of Westminster City Council's education services in the early 00s and we took over the IT support on a couple of small Capita sites. XP had been out a few years and their desktops were still on NT, no biggy I suppose, but we upgraded them to XP... we looked after them for 2-3 years (maybe more) at which point they needed to bring them back under their control (a change in Policy). At that point XP had been out I'd say at least 4 years and they downgraded the dekstops back to NT... Bearing in mind XP wasn't released until 2002, I'm pretty sure it was close to or past to the end of support date for NT4 of Dec 2006 at that point (which was extended from 2004 for the public sector). This was my main interaction with Capita in the 7 years I worked for WCC (other than the occasional helpdesk ticket we had to submit for integration changes, which was always a real eye roller of an experience).
I'm sure things have changed a lot in 20 years and this then, already complacent monster of a company, is now super agile and well thought of.
Shirly (again) it is time that decision makers did a proper due diligence (again) when assessing who might be a good outsourcing partner (again) and not give the work to the same old pile of shit companies (again).
I shall await the email saying that sadly, my data was amongst that which was stolen/exfiltrated/encrypted/lost and that USS will do it's utmost to help but cannot be held responsible for this (again). I'll also wait for the avalanche of phishing emails of course.
Crapita strikes again.
I'm a former member of USS and my son is a current member so I have a dog in this fight.
Another absolutely disgraceful debacle from Crapita -- should we expect anything else? Personal opinion is that it's time that companies and especially the UK government stopped outsourcing to this bunch of incompetents and secondly that Crapita was broken up.
In the last few years I've watch Crapita screw up several defence projects, the tagging service, NHS IT systems, British Army recruiting and destroy a perfectly good IT company that they bought and screw up various local government contracts. Oh, and a rail franchise.
Google "capita army recruitment problems" if you want a typical run down on project mismanagement.
My brother receives one of his pensions from USS and has received a letterfrom USS. It includes an offer for 1 year free use of Experian. Apart from the complexity of accepting the offer he gave up when he realized that he was being asked to put even more personal information up onto the Experian system than had previously on the USS system.
That would put him even more exposed waiting for Experian to be hackked.
The very very commonalty of outsourcing sensative data to fewer and fewer service suppliers must be making hacking more and more potentially lucrative and therefore more likely. If one hack will get you the whole of all NHS personal datamust make it more likely to happen than if each individual hospital and doctor's systems have to be hacked.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
