UK government dragged for incomplete security reforms after Afghan leak fallout Senior officials are being summoned to the UK's Science, Innovation and Technology Committee to explain why the government has not fully implemented the security recommendations made in a secret review following the 2021 Afghan data breach. Chi Onwurah, chair of the committee that pushed for the secret review to be published …
According to the BBC, there were secret meetings between the ICO and MoD where written notes were forbidden - so no wonder that nobody knows what's going on as two different government departments have deliberately designed it that way between themselves.
Seems the ICO is marking it's own homework if they have allowed the MoD to dictate the terms of their investigation, and further allowed the MoD to ignore actually implementing the required changes necessary to protect personal data and enforcing the law - heads on both sides should roll for this one...
Ah!- no, it's the army that has the guns - the MoD has a plethora of pen pushers who could maybe threaten you with a pencil if only they could work out how to use the pencil sharpener, led by senior staff who could make the average PHB look competent. This is the reason for the problem in the first place...
As one of those "plethora of pen pushers" (hence posting as AC) I can assure you that (at least within my sphere of operations) we well know how to sharpen a pencil, and we have far more dangerous options if we wished to use them. I realise it's convenient to consider all civil servants as useless pen(cil) pushers, but for example, in my team we have chartered engineers, varied qualifications right up to doctorates in some rather specialised stuff we can't talk about, and many ex-services people for their "hands on" experience with the systems we are responsible for. It would be fun to say it's rocket science, but alas my team doesn't deal with that side of things.
Cast your minds back to the early 1900s.
Suddenly there were lots of motor vehicles on the public roads in the hands of completely untrained users.
Result: carnage.
There was no Highway Code. Here in the UK we had to wait until 1931 for that.
There were no driving licences. Where I live, it wasn't until 1933 that you had to pass an examination of competence to get one.
There were no Ministry of Transport vehicle tests. Believe it or not they didn't come in until 1960 - which was several years after my first three motorcycles were built - and even then it was voluntary until the Powers That Be realized with dismay how large a proportion of the vehicles were failing the tests.
Gradually we started to get to grips with putting potentially dangerous equipment in the hands of a public by and large incompetent to handle it. Although there's still carnage, there's a bit less of it.
It took half a century.
So here we go again, putting yet more potentially dangerous equipment into the hands of a population utterly incapable of operating it safely.
Governments, heaven help us, are even making it MANDATORY for things like taxation. They seem, in their cluelessness, to think that it might save them money.
This is collective insanity. OF COURSE it has caused the shedding of tears by countless people and organizations. How could anyone ever have expected otherwise?
When will we ever learn?
When will we ever learn?
From the guardian 3 points were raised.
A lack of controls over ad hoc downloads and exports of aggregations of sensitive data.
#Sounds like education is needed to minimise the data used/sent. Education and a lot of care.
The release of sensitive information via “wrong recipient” emails and failure to use bcc properly.
#email setup (disable auto filling of email addresses). Use more Carr.
Hidden personal data emerging from spreadsheets destined for release.
#see first comment.
It could be hubris/lack of care. Could somebody be designated as the checker to say what about this... Rotated around the group to prevent blame sifting.
Has anyone said I screwed up? Internal comment only I hope.
There are tools for labelling files with the appropriate sensitivity. Getting users to use them needs some pushing and shoving though. Then you can start filtering emails on the way out of the organisation. Tbh I would’ve thought MOD would have linked with US .mil global address book, so accidentally using wrong email addresses should show up, This is not rocket science!
From the inside, there's a lot of push on the culture side - as well as technical stuff. The problem is, that the technical measures can only go so far - if someone sticks a load of details in an Excel spreadsheet and fails to label it properly, then it's down to heuristics to work out if it's incorrectly labelled.
But some of the problems (IMNSHO) come down to the government (like so many others) having got so high on the MS cool-aid that they'll accept any old shite MS foist on us. Excel is routinely misused as a database because ... well it's there and we don't get given something more suitable for the task. Misdirecting emails is too easy because we use Outlook which actively obfuscates email addresses. And don't get me started on the security sieve called Teams ...
Of course it had to be a secret review. After having publicly abandoned most of them to the Taliban for judgement by extreme prejudice, it wouldn't do to show that, on top of abandoning them, you also gave up their names through shoddy security.
Well done. They were "allies" as long as they were useful, after that they were nothing but cannon fodder.
The whole story of Afghanistan is one pile of shame on top of another.
Maybe a low-level body or two will be thrown under the bus but nothing much will change. Perhaps some fine words will be uttered or lessons learned announced. They might even spaff some more of our money with a big corporation and consultants. The system is corrupt, nothing will change, our digital prison of CBDC & ID will continue a pace, nothing learned.
Once recesion kicks in people's will naturally do their jobs better, techs/admins/pen pushers included
Shame it's gonna be a really tough one this time round.... but that's our own fault for kicking it down the line so many times by "printing" money on the banks ledgers (aka isn't it lovely how much my house is worth now)
