Council worker spared prison after four-day data-snooping spree

A council worker who "abused" his position to unlawfully access "highly sensitive" personal records of family members and other people known to him has received a suspended sentence after admitting to violating the Computer Misuse Act (CMA). Geoffrey Smith, 31, from Ledbury, was a new Herefordshire Council employee working in …

[Guy de Loimbard]

A fair sentence I think

Seems to me, IMHO, that this individual clearly had far too many permissions and rights to services and systems that were, more thank likely, not within his remit to have access to.

If Mr Smith was a new employee, what lunatic gave him unfettered access to these types of records?

There are a few salient points missing from this article I think, one that comes to mind, is what has Herefordshire Council been held to account for? Surely there are some lessons learned to make sure employee's have limited, need to know, type of access.

Also, I'd be keen to know how this individual was discovered, as Detect is one thing, but Protect would be a better control no?

[Cav]

Re: A fair sentence I think

"this individual clearly had far too many permissions and rights to services and systems "

Based on what evidence? You have no idea what his job role was.

If he worked in that department and had legitimate reason to access such information as part of his job then his permissions would have been entirely correct. The problem was him accessing that data on people he knew, rather than cases he was working on.

[Gavsky]

"You're a VERY naughty boy - go & sit on the naughty step for five minutes!". He should have been imprisoned & the ridiculously light sentences given for IT misuse have lagged behind the damage that can be done; not much deterrent. This idiot must have spent most of his working time doing this!

[LucreLout]

There needs to be weight given to how involuntary data provision is to the public sector. If he worked at the local Ford dealership you can just shop elsewhere and secure your data from him, but when he works for the state the penalty for deliberate breaches needs to always be custodial in nature. No exceptions.

[JohnMurray]

Yes?

More interested in exactly how a low-grade new employee was given, or got, immediate access to highly confidential health data on people and children. And what reason a council had access to that data anyway

[Pete Sdev]

Re: Yes?

From the article:

working in the Children and Young People directorate

Arguably, one would imagine that certain roles in this department are justified in being able to answer questions like "has this child had an usually high amount of injuries?" (medical records) and "do the the parents have a criminal record for violence related offences?" (criminal records).

Obviously this access needs to be tightly controlled and audited. Though given that the idiot in the article was caught (and the impression is fairly quickly), at least part of the system is working.

[JimC]

Re: what reason a council had access to that data anyway

Because all that sort of stuff is exactly what Social Services are there for. Social Worker reports and Child and Family assessments are generated by the department in question, and it should be equally obvious that medical reports - disability, mental health and the like for example - are equally vital to doing the work of trying to support people from day to day.

If you employ someone for a job that involves access to or generating that sort of data then they need access from day one: you can't have them twiddling their thumbs for six months while you decide whether or not they are trustworthy. But what you should have is controls to try and find out if they are abusing that access, and by the sound of things they were in place and worked.

[Gavsky]

Re: Yes?

I worked for Social Services on the data input side; anything that a Social Worker put in a report had to be entered onto a database, reports generated for case conferences etc. Like medical files, there's a lot of deeply personal information - some of which isn't even known by other members of a family, for obvious reasons. That's why these breaches are SO serious.

[Cav]

Re: Yes?

Why? You have no idea what he was employed to do.

[Apocalypso - a cheery end to the world]

Why

It would help to know why he accessed the information he did in order to judge whether the sentence was too lenient or not.

A burst of accesses over a short period of time seems like he had some objective in mind - it would be nice to know what.

[Cav]

Re: Why

No it wouldn't. He had no right to be accessing the data for any reason whatsoever if his job did not involve the specific individuals in cases he was working on.

[doublelayer]

Re: Why

Legally, it mostly doesn't matter. It would give us some context if he had a wider plan to misuse the data, and carrying out such a plan could be additional offenses, but from what we know, he didn't execute a plan. Without information about that, you can assume the best, he accessed them out of curiosity alone and had no intention of saving or distributing copies. Even under that benefit of the doubt, do you consider the sentence adequate?

[Excused Boots]

Re: Why

Yes quite right, it appears that this person didn’t have any plan to misuse the data, it was more a case of pruient interest. Which is still wrong but not too bad, hence the sentence.

[doublelayer]

Re: Why

Just as we have no evidence telling us that there was a plan to misuse it, we have no evidence saying there wasn't. Legally, that means that there are no other charges and that's what we need when considering the sentence. However, your statement goes too far in declaring a lack of additional malice when we cannot prove anything in either direction.

[Anonymous Coward]

Re: Why

Legally, the WHY is very important.

It's shows intent.

That's the/a difference between manslaughter and murder. I think.

Between "just taking this home" and "being tooled for burglary"

[Anonymous Coward]

An excellent example

Of why businesses just don't take data security seriously. There are simply no penalties.

If we were serious about data breaches, he'd be in prison for a number of years, especially with children involved.

As it is, he'll now keep his cushy council pension. We've effectively rewarded him for doing it.

[Cav]

Re: An excellent example

"As it is, he'll now keep his cushy council pension. We've effectively rewarded him for doing it."

Nonsense. If he was a new starter and sacked for gross misconduct then what pension?

[Doctor Syntax]

Re: An excellent example

OP seems to be a Daily Fail reader. Don't assume reasoning ability.

[Anonymous Coward]

Re: An excellent example

1. I don't read the DM or any newspaper.

2. My comments are based on actual experience with council officers at all levels across many departments, from Social Services, Education, Highways to Planning.

3. When I, a mere IT professional, have to tell a supposedly *Senior* Planning Officer that they are completely wrong, what the correct process and national planning framework is, and basically how to do THEIR job, then something is seriously wrong in the public sector.

4. I won't bore you with my experiences with Social Services as its too long, but I'll say they never learn any lessons when things go wrong, and Social Workers are never held accountable.

[Anonymous Coward]

Re: An excellent example

You really think they'll actually sack him?

When did a council actually sack anyone? It simply never happens. The only people ever held accountable are the elected councillors at elections.

For council workers its just one lazy gravy train of incompetence.

[Excused Boots]

Re: An excellent example

"When did a council actually sack anyone? It simply never happens. “

Believe me you’ll be suprised.

[IGotOut]

Re: An excellent example

It's always the ACs...

[EnviableOne]

Why just CMA?

Surely this is misconduct in a public office, and a whole host of other things

[Anonymous Coward]

Suspended sentence

Does that mean he’ll be put on hold waiting for the Council to answer his call?

Barbaric!