back to article Gov claims 'password protection' OK for sensitive docs

The government sent the security industry into gales of laughter today when it insisted that sensitive documents on Hazel Blears’ missing PC are quite safe, as the machine is “password protected”. The gov’s soothing words came amid speculation on what formal action, if any, communities and local government secretary Blears …

COMMENTS

This topic is closed for new posts.
  1. michael

    again

    www.trucrypt.org

    I will for go my 6 figger consluting fee this time but If I have to keep redoing my orignal work I might start charging

  2. Anonymous Coward
    Happy

    Passworded

    Well it is a step up from bunch of easy to read papers in a folder on the back seat as is normally the case

    Not much of a step up however.

    They really don't understand what they are talking about do they... and how easy a password is to crack.

    Knowing the IQ of MP's the password was probably "password" or "holiday", or the dogs name.

  3. Gordon Pryra

    Bad enough to loose a laptop

    But to loose a desktop?

    And these fuckwits want us to believe they can be trusted with ANYTHING?

    No single government is this bolloxs, so it HAS to be on purpose

    Burn them!

    Burn them all before they sell your children to whoever they are REALLY working for.

  4. Nic Brough
    Paris Hilton

    Dammit

    Thanks for that, I need a new screen now, after spraying coffee all over it.

    I know our government is monumentally crap at IT, even if it's just by the vast amount of my money they waste paying their corporate f***-buddies to screw up every NHS/Police/Tax/etc IT scheme going, but after the recent string of privacy breach idiocy and failed security, this just takes the biscuit.

    Sadly, Paris, because we now have proof that she's significantly more intelligent and useful than my government

  5. Tim
    Thumb Down

    Hazel Blears

    She really is neither use nor ornament. Fingers crossed for the message of 'unequivocal support' from No. 10.

    Anyone else spot in the other article how her spokesdroid said she had both 'constituency' and 'departmental' data on the machine, but nobody should worry because there was no personal information contained in the departmental data? I can't see her keeping her job if she's exposed her own constituents to blackmail and identity theft.

  6. Joe K
    Coat

    Meh

    This is the Gov that thinks that pedo's will only ever use one email address, making them easily trackable online.

    Nothing surprises me anymore.

  7. Eponymous Cowherd
    Paris Hilton

    what the..................?

    wh... w.. fuck...huh? doh!

    Words fail me.

    Paris, 'cos she is probably smarter than the entire Labour cabinet put together.

  8. Tony
    Thumb Up

    Oh that's alright then.

    I now feel thoroughly reassured about our governments understanding of digital security.

    Can I suggest some possible passwords they can use for protecting machines holding sensitive material in future that would reflect this?

    'admin'

    'hazel1'

    '123456'

    Or how about 'fuckw1ts' ?

  9. Anonymous Coward
    Unhappy

    3rd time = enemy action

    sorry but that's one too many incidents in a short space of time. This is a set-up.

  10. amanfromMars Silver badge

    Out of the Loop leaves them High and Dry and having to Think for Themselves

    "In the meantime, the government might do worse than despatch a crack MI5 team down to Waterloo Station to scour the trains post rush hour, as this seems to be the main clearing house for sensitive government information these days. "

    One wonders why sensitive information is shared with them... these days.

  11. Anonymous Coward
    Anonymous Coward

    I'm assuming our glorious Government....

    knows the difference between password protection and encryption? Numpties!

  12. Tawakalna
    Pirate

    but what if the password is....?

    password

    Hazel's bday

    Hazel's family members' bday

    Tony Blur's bday

    days Gordo has left in office

    year Noo Laboor got into office

    42

    <enter>

    betcha it's something obvious! this is Noo Laboor, IT f*cktards one and all.

    (where's the *I hate Labour because they are cr4p and ruining my income* icon?)

  13. Redbullguzzler
    Paris Hilton

    Post IT

    What the government didn't state was the password is written on a postit stuck to the underside of the laptop.....

    Bugger!

  14. Vladimir Plouzhnikov

    Waterloo station

    "In the meantime, the government might do worse than despatch a crack MI5 team down to Waterloo Station to scour the trains post rush hour, as this seems to be the main clearing house for sensitive government information these days."

    Yes, but the American won't let Brown do that - we know that from Borg Ultimatum, don't we? The CIA keeps that playground to itself.

  15. Benny
    Thumb Down

    Secure

    Probably find the password is written on a sticky note on the front of the machine anyway....

  16. Ian McNee
    Thumb Down

    Spot the difference:

    Civil servant breaks procedure by removing sensitive docs, leaves them on a train and gets suspended subsequent to probable sacking or demotion.

    Minister breaks procedure by downloading sensitive docs, PC is pinched and the No. 10 spin machine whirs into action declaring that the free world is safe as the machine was password protected.

    Now where's that Linux live CD that edits the Windoze SAM file...

  17. Francis Fish
    Coat

    Poor thing

    "And even though the machine was in an alarmed room,"

    Poor thing, I hope somebody knows how to calm rooms down.

    Mine's the one with the sleeves on backwards and the funny-looking straps.

  18. Anonymous Coward
    Coat

    Umm. No password cracking required

    Assuming it is a Windows machine with the encrypted file option available (Windows 2000 SP4 certainly has it) then it should be very difficult to get the contents of the file. But how many people know that option exists? Furthermore, how many people use it? Doh!

    That being the case, you don't even need to crack a password. Remove the hard disk, stick it in a external USB case and mount on another machine. Da daahhh!!!

    [Just passing it to Blears]

  19. Marc

    trivial password cracking

    I'd love to know which password they are talking about, BIOS, Windows or MS office. The first two aren't just trivial to crack you don't even need to crack them to get to the files on the disk unless it's encrypted. I'd offer to demo how long it takes to crack their files but I don't invoice by the minute.

  20. Rob Simmonds
    Paris Hilton

    For goodness sake

    Have these people never heard of Truecrypt? Its free, easy to implement and, providing you have a strong password, is essentially unbreakable.

    Mine's the one from the University of the Bleedin' Obvious...

  21. Anonymous Coward
    Flame

    Hmmm...

    Ok first a lesson.

    CD with SAM database password reset program. I now have local admin access to the machine and all data on the machine.

    Now that's over with I highly doubt some local tea leaf will try and out any info on this machine as it's probably already been formatted and rebuilt with XP. That's not to say anyone with half a brain cell could interrogate the drive and get the docs back but you'd open yourself up to a charge of recieving stolen goods and maybe a nice spell in chokey while they wait to allow you access to Habeas Corpus.....

    Really - Gov docs are mind numbingly boring to the average person so why nick a computer for that rather than the sum of it's parts.

  22. Anonymous Coward
    Anonymous Coward

    Did I read that correctly?

    So the potentially sensitive documents are safe because the machine has a password, well that's just fine then.....

    What kind of *!$%ing idiots are running this country? Any they want to bring in national ID cards, they haven't a clue. If brains were dynamite they couldn't even blow their hats off.

    Has to be Paris, she might not be the sharpest knife in the box, but she could show these prize muppets a thing or two.

  23. John Robson Silver badge
    Pirate

    Password protected?

    Probably still Win95, so the escape key should do the job, or of course now that they have the machine simply boot of a live linux CD.

    Icon - we're all going to die unless we can find some more intelligent amoeba to govern us.

  24. Sean Ellis

    Simple solution

    Install TrueCrypt (free, libre, open-source) whole disk protection on every government machine. OK, there will be a few numpties who write down the password and pin it to the monitor, but it's a better line of defense than just having stuff in the clear on the drive.

  25. Anonymous Coward
    Anonymous Coward

    even more trivial

    ".. cracking a password, as opposed to cracking an encrypted PC, is considered a trivial task."

    Quicker to lift out the hard drive and install as D:\ on your own computer.

    And if "the computer was password protected" is spokespersonese for "the documents were password protected" try opening a protected MS Word document with a text editor!

  26. IHateWearingATie
    Stop

    Secrect Information - Not

    Put it in perspective - it's not like Hazel Blears will have access to any interesting information

    "The Government was in turmoil today as it was revealed that the Secretary of State for Communities and Local Government lost her PC which was said to have secret plans for better provision of park benches and putting a microchip in your bin"

    The only thing you'd get if you read the content of her secret files is really really really bored.

  27. Warren
    Alert

    Why oh why?!

    More data stored on a PC that shouldn't have any information on it. As for the governments belief that everyone in the UK will buy the "password protected" bull then they are dillusional.

    What is even worst is that it isn't a laptop but a PC... Time people begun thinking about protecting OUR personal information. If this information is sitting on a PC or laptop we have a right to know that it is secure. At the moment no one can give us this 100% certainty. There are products out there like BackStopp from Virtuity (www.backstopp.com) that protect data from these types of theft, even protecting a desktop PC utilising RFID technology. If the machine leaves, the data is securely deleted. Now why aren't they using something like this to come out and say "A machine was stolen, but we know the data was securely removed an hour ago without being accessed"?

    Rant over..

  28. Anonymous Coward
    Anonymous Coward

    New law needed

    If password protection doesn't effectively encrypt files it should be given a different name.

  29. scott
    Stop

    Dumb terminals?

    Since that shower of incompetents have proven time and time again they can't be trusted with anything more technical than a digital watch - take all the PCs from them and give them Thin Clients. The ones which *don't* have USB or any other way to get data off of them.

    I'll happily do their Citrix rollout for ooohh - 250 million??

  30. Alastair Dodd
    Unhappy

    Bloody idiots

    In government these days (well not just now, always have been) occasionally i think things might be getting better but no...

  31. AndyC
    Stop

    Quick vote...

    Why bother cracking the password... Vote now for it to be either:

    A) "password"

    B) "hblears"

    C) " "

    D) "abc123"

  32. Anonymous Coward
    Flame

    semantics

    It might as well be encrypted, but with a password to log-on on the encrypted disk.. ?

    Seriously, do you expect politicians to be able to explain to 'the masses' what they do with their computer or how it is protected ?

    I can only imagine that it is as toe curling as a senior manager or a CEO doing an IT security pep talk.

    On the other hand.. they seem to have proven that it impossible to underestimate their tech savviness or protection measures.

  33. Anonymous Coward
    Black Helicopters

    WTF

    And I suppose that her password is/was ****** [because she couldn't remember 'password'].

    Still nothing will happen to her. She's a Government minister and they don't have to follow the rules like the little (and poorer) people do.

    And HOW ON EARTH did someone walk away with a DESKTOP machine? Without anyone noticing! Though I wouldn't mind betting that some clever sod held a door open for the guy taking "his" PC out to his car.

  34. Anonymous Coward
    Paris Hilton

    Information Governance

    After years of attempts by HMG to secure quality information governance they really have only two lines open to them;

    1. Formally discipline the person who breached security policy (in this case sack the minister not only from her post but from the government, she should also resign as a constituent MP. She can of course re-stand for her constituency, but let her constants hear ALL the facts before allowing a by-election. Let the people decide about data security). Ensure that this hard line is taken against ALL members of HMG and departments of HMG, and give the IT departments technical tools to enforce Information Governance policy.

    2. Give up the pathetic pretext of information governance altogether. "sorry everybody we can barely keep secret data secret, your personal records don't stand a chance".

    As it stands the minister will probably survive, and some highly paid member of the civil service will issue another letter saying “this kind of behaviour will not be accepted, in future…..”

    Why Paris?,

    HMG have exposed themselves more often than Paris has (shame or shame ?)

  35. Charlieman

    Official Secrets Act?

    Will Hazel Blears be prosecuted for leaking?

    http://www.opsi.gov.uk/acts/acts1989/ukpga_19890006_en_1#l1g8

    "(1)Where a Crown servant or government contractor, by virtue of his position as such, has in his possession or under his control any document or other article which it would be an offence under any of the foregoing provisions of this Act for him to disclose without lawful authority he is guilty of an offence if—

    (a)being a Crown servant, he retains the document or article contrary to his official duty; or

    (b)being a government contractor, he fails to comply with an official direction for the return or disposal of the document or article,

    or if he fails to take such care to prevent the unauthorised disclosure of the document or article as a person in his position may reasonably be expected to take."

    Incidentally, I have experience of securing systems on which Home Office data relating to criminal prosecutions is stored. And the rules clearly state that the device has to be physically secure (ie bolted to something big).

  36. Anonymous Coward
    Joke

    Just as an addition to my previous anonymous post..

    Six laptops containing information about 20,000 patients have been stolen from a south London hospital!!!

    Yup HMG data security is a bad joke

  37. Mike Crawshaw
    Paris Hilton

    A PASSWORD?? Oh NOES!

    My carere as a hax0r is over!!!

    Unless I is very smartz and trys:

    Her child's name? Noes...

    Her hubby name? Noes...

    Her dog's name?

    SUXXESS!!! I IS HAX0R SUPREME!!!

    *sigh*

    and it probably is... the entire concept of a complex password to try and at least put SOME sort of speed-bump in the way would be far too difficult. Paris would encrypt....

  38. Roger Lancefield
    Unhappy

    Fear not sir, it's password protected!

    We received a letter this morning from St Georges Healthcare NHS Trust informing us that details about our son (who recently underwent minor surgery) were among those on laptops recently stolen from St Georges Hospital in South London:

    http://news.bbc.co.uk/1/hi/england/london/7461619.stm

    In the light of yet another government data security fiasco, I thought I'd share the following paragraph in the letter with El Reg readers:

    "It is our policy to store such data on secure central network drives which saves data away from the hardware of a computer. However, due to a problem with the network drive this data was being stored temporarily on the laptops until the problem was resolved. We have now fixed this issue and we are reinforcing all security measures across the Trust to protect our patients' confidentiality.

    As all computers were password protected, only authorised staff who had the correct password could access the data. Therefore, there is only a very small chance that any patient details have been passed on"

    It would be interesting to know how long that period of "temporary" storage lasted, wouldn't it?

    You had a good run son. You almost made it to 3 years of age before your medical records escaped onto London's trash-strewn streets like so much, errr, trash.

  39. Steven Hunter
    Alert

    Cracking the password?

    Who cares about the password? Just pull the drive, attach a USB to PATA or SATA adapter, and start copying the data.

  40. David Neil
    Joke

    On the bright side

    It's probably been planked by some chancer for offloading down the pub/eBay.

    Not like anyone would walk into their MP's constituency office, pick up an unsecured desktop and walk righ out the front door with it - and actually have some intent to use the information on it...

  41. Anonymous Coward
    Anonymous Coward

    Unbelievable

    I work for a company that is cleared to handle and store documents up to and including Top Secret, these documents are usually to do with national security / intelligence etc.

    Because we are a private company not a government department the amount of work we have to do to secure the information we have is amazing. The rules and regulations on what can and can't be done, who can and who can't see things, audit trails, physical as well as software security, air-gaps on machines, no cables crossing due to Temepst, the list goes on..

    When I read a story like this it makes me wonder why we bother going to such lengths, the government don't seem to bother!

  42. Frederick Karno
    Unhappy

    unbelievable

    it is now an everyday event that sensitive information is stolen, mislaid, blah blah

    and this is only the tip of the iceberg that we find out about......

    We can have no confidence in any government that allows ministers to stay in place when such events occur.

    As gordon brown would find out IF he bothered to ask security experts password protection is all but worthless and very very simple to crack probably the password was written on a post it note on the monitor.

    It would appear that all government departments need to run an intensive security course and dismiss people who do not comply.

    Only the thought of loss of lucrative employment combined with threat of legal action will change peoples attitudes.I hate to think what information they carry about on their phones.

    There is shortly going to be a point reached where we all have had our personal information given out by the government is it a plan to stop us moaning about the id data base where they can quite rightly say "its only information that is in the public domain anyway" because we have put it there.

  43. Anonymous Coward
    Anonymous Coward

    A Question

    Imagine this hypothetical situation:

    You work for a private company and have access to the HR database (including payroll). You've been given training on the procedures for protecting this sensitive data. You knowingly and willingly disregard this and take a copy home with you (but keep it in a hidden folder). It gets stolen.

    How long before you get shown the door?

  44. Anonymous Coward
    Anonymous Coward

    Post it note

    Chances are the password was on a post it note stuck to the outside of the PC!

  45. Chris Long

    Numpties

    How did any of these people get into top government jobs in the first place? As a government minister, Blears is about as convincing as a Thunderbirds puppet. Perhaps, to re-work an old saying, it's a case of "those who can, do; those who can't, govern".

    Oooh, biting.

  46. Anonymous Coward
    Flame

    It's bad enough that she's in a position of power...

    ...but do I have to see a picture of that ginger dwarf on the El Reg main page?

  47. Anonymous Coward
    Alert

    Free Masons

    I once bought a computer from Cash Converters & it contained the full details of a local Free Mason's Lodge! Well it was only a 286 & was back in the days when security didn't matter!

    AC for obvious reasons, some FM's are the fuzz!

  48. Anonymous Coward
    Anonymous Coward

    Ah! One rule for is, one rule for them, and one to....

    If ministers can do this, why are we all spending loads of tax payers money on encryption software.

    I would be sacked if I had GPMS documents on an unencrypted laptop that was stolen. Or even if I had them unencrypted on my PCs at home.

    This really is something that warrants a minister resigning, especially after all the fuss they have been making about civil servants and contractors doing it.

  49. TrishaD

    I wanted ...

    ..to make a pithy comment.

    But words fail me.....

  50. This post has been deleted by its author

  51. Anonymous Coward
    Anonymous Coward

    Computer License

    the only solution, they cannot pass the computer test, then they cannot use it.

    We do it for cars, and in someways there is less of a risk. They make blunders like this and they have points added to their license, in this instance it should be an automatic ban for at least 6 months, and a resit of the test.

    If she needs to use a computer for her job, then she should either pay for a person out of her own pocket to use the computer for her, or she takes public computering - damn the analogy broke down just at the end.

  52. David Buckley
    Coat

    password cracking...

    why bother to crack to password, just yank the drive, far less work and even a skally from salford can manage that.

  53. Algernon
    Black Helicopters

    Safe in Government hands

    Is there ANYONE at all that still thinks our personal details are safe, that the National Identity register wont just be a good and easy method to steal identities?

  54. A A

    They never learn

    Some people are incapable of learning from their mistakes.

  55. Gordon

    What's the use??

    Personally i'd just give them a thin-client on the laptop (or desktop) and store everything centrally in a hoofin' great server behind several feet on concrete, steel and armed guards. Then GIVE them strong passwords they CANNOT change and make it a "revocation of computer privaledges" offence to write it down or give it to anyone else. You can't do much more than that.

  56. Ash

    Hey HM Gov...

    My work laptop IS password protected.

    On Dell Latitude laptops, there is an option in the BIOS to set a password which protects the computer from booting. Works great!

    Oh, and the whole drive is encrypted with TrueCrypt's System Partition encryption facility. Which is free. As in 'Don't have to pay for it."

    Go look it up.

  57. Adam Foxton

    "password protected"

    Which means Windows log on.

    In separate news, "hackers" are requested to avoid all Linux Live CDs not because they allow the bypassing of most windows security, but because there's... err... a virus.

    You've gotta wonder who'd nick a desktop from an alarmed office. More amazing still is that with all the CCTV going about no-one noticed anyone who looked suspiciously pregnant or overweight- just in a very cuboid way...

    Anyone with a rucksack or with anything shoved up their jumper should be tracked down using the top-notch (you'd hope, given that it'd being inflicted on the rest of us) security there and kept in cells for questioning. For up to 42 days on the grounds that "the PC they improperly secured contained information potentially of use to Terrorists". See how they like it...

  58. Anonymous Coward
    Anonymous Coward

    What a stupid.....

    cow Blears is. She looks so bloody dozy and when she speaks you realise she actually is dozy. How on earth do these people actually get into a Government ???.

  59. Anonymous Coward
    Alert

    I know I know

    I think time has come for Politricians to be given a compitency test ?

    How about general knowledge or even IT based testing Politicians versus 12 year kids ?

    ( I know who to bet on here the 12 year old would definitly have a few more brains cells than the whole of NU LABOUR cabinet.)

    Or even better still how about Computers for Dummies to be sent to all law makers who try to create new laws in an environment they know nothing about ?

  60. Eponymous Cowherd
    Paris Hilton

    Another MP drops an IT Bollock

    Well she would if she were a bloke.

    It seems Portsmouth North MP, Sarah McCarthy-Fry had her Hotmail account 'hacked'.

    The enterprising miscreant sent an e-mail to everyone in her address book claiming she was stuck in Nigeria (bit of a give-away, that) and needed £1000's to get home.

    BBC News Story:

    http://news.bbc.co.uk/1/hi/england/hampshire/7461409.stm

    Paris, 'cos there isn't a dopey-looking MPess icon.

  61. Roger Lancefield
    Stop

    Plus 1 for the mandatory security training idea

    Frederick Karno wrote above:

    "It would appear that all government departments need to run an intensive security course and dismiss people who do not comply."

    I agree. We live in an information economy & society for gawd's sake. Our politicians and public servants should be obliged to obtain and *demonstrate* a working knowledge of data security technology and practices, together with performance appraisal to ensure that they can not only talk the talk, but are also walking the walk. As we know, security is as much about behaviour as technology.

    Despite the fact that we live within an information society and are dependent upon an data-driven economy, we are still being governed by a generation of people many of whom barely understand the difference between hardware and software. Time for a forest fire. If you don't understand encryption and other security-related technologies, if you don't observe best security behavioural pratices, away for re-training with you! If you fail the courses, thanks for your efforts, but this is an information society we're living in here. Here's your (analogue) carriage clock. Next generation please!

  62. John Brookes
    Joke

    They know nothing about security!

    If they wanted it to be REALLY safe they'd have used a substitution cipher on it too!

    Mine's the diamond-studded one made of gold thread in the unlocked, papier mache safe... Oh, and watch out for the guardsnail!!

  63. Anonymous Coward
    Anonymous Coward

    Is she actually "guilty" ?

    It's always fun to bash New Labour, but if I park the actual contents of the machine to one side I'm a bit mystified why the woman (from the little data I have seen) gets bashed for having a DESKTOP PC stolen from an ALARMED room.

    It's not like she walked out of teh building with the machine and forgot it on the train or, in a break with tradition, left it in a cab.

    I'd first give building security a real roasting, and then use the opportunity as proof that the INSIDE of Whitehall et al needs fully saturated CCTV coverage :-).

  64. Anonymous Coward
    Gates Horns

    Cruel people

    I think you are all cruel. password protection on windows is in fact OVERKILL. I suggest that you just use a piece of selotape on to hold the lid down. That will fool anyone who goes to the trouble of breaking into a lock and alarmed room to steal a computer. They probable don't even have the right type of electricity.

  65. Anonymous Coward
    Anonymous Coward

    Prank

    Imagine the hilarity if every El Reg burned a CD filled with random data, labelled it with things like 'For Hazel B - URGENT!' and left them on trains and buses across the nation.

    Okay I admit they'd be hard to find amongst copies of the Metro and all the legitimate government CDs that have been left behind, but it'd be amusing to see the PM standing in the Commons trying to work out if the disk called 'Iran Battle Plan' found on the 08:25 to Grimsby was genuine or not.

  66. Inspector_Morse
    Black Helicopters

    Itfuo17062008wId-lff10DS&tapwktcs!

    The only way to come up with a memorable secure password is to think of a life-changing event and then take the first letter of each word, include numbers and non-alphabetic characters, and vary the case of the letters.

    In Hazel Blears case, a good password would be:

    Itfuo17062008wId-lff10DS&tapwktcs!

    The life-changing moment: "I truly fucked up on 17/06/08 when I down-loaded files from 10 Downing Street and thought a password would keep the contents safe!"

    Use that password to access the files encrypted by TrueCrypt as others have already suggested. Job almost done. "Almost" - because it's still not perfect, but it's a lot better than trusting in Redmond.

    And a thousand times better than trusting in gov.uk.

  67. Pat
    Alert

    More Blears please?

    Quoting AC above:

    "...but do I have to see a picture of that ginger dwarf on the El Reg main page?"

    Sorry AC but I'm beginning to think we should see more of her <shudder>. She should be on cctv full time, the same for all our politicians and senior civil servants, recording their every word and move - for their own protection, of course.

    Nothing to hide, nothing to fear!

  68. Anonymous Coward
    Stop

    Password

    If the password isn't written on a Post-It note, try the nearby calendar.

    That's another favourite.

    I think we need a new word to describe the staggering levels of incompetance that our Government has reached.

    It's truly mind blowing.

    Incompetwats maybe?

  69. N
    Thumb Down

    Password protected? so its all OK then?

    Im helpless with laughter at that statement, password protected only from those under the age of three years.

    I suppose its just one very small rung up the security ladder than tossing 26 million records into the post & hoping they turn up at the right destination, but wait, they are going to shove every bit of data about us onto an ID card very soon, ram it down our throats & charge us £80 or so for the privilege, no doubt that data store will be 'password protected' as well.

    could do better

  70. Cavehomme
    IT Angle

    Blame their IT department

    Yes Labour are muppets, but most of the lapses so far are concerning the Civil Service not the actual politicians, apart from this loss.

    Same problem would exist if The Cons were governing as well.

    All these politicking to$$ers are as clueless as each other, regardless of party. Cameron and his sidekicks are similarly inexperienced as Labour in the real world. Can you imagine Cameron really understand what is going on rather than blaberring any old bull cr@p about things? They are mostly all the same, with only a few precious exceptions.

    As for the Civil Service, well what a bunch of time wasting lay abouts.

    So, all these idiots need an IT department that can effectively manage their stupid liabilities.

    They also need me in charge of the country to tell them what is what.

  71. Anonymous Coward
    Flame

    Remember - these people keep how you voted

    It never ceases to amaze me, but the Govt keeps how you voted in a "confidential" database, and refer to it for "canvassing purposes" around election time.

    Imagine that falling into the hands of extremists? Left, Right or religious nutters - no matter.

    AC - cos at least here I *can*

  72. Mr Smin
    Stop

    i'd hate to give them the benefit of the doubt

    .....but since the person who stated that it was password protected is not employed in a technical role, maybe the machine was decently encrypted and he just didn't know the difference because from his perspective 'you have to put a password in'....

    even if i'm right, she should still get fired for storing classified stuff on an unauthorised machine.

  73. Anonymous Coward
    Happy

    More Password Suggestions

    shortarse

    ginger

    twat

  74. Anonymous Coward
    Boffin

    br00t_f0rc3_4774ck5_57r1k35_4g41n

    Looks like ministers don't understand leet. H4x0r5 will have a birthday. Thing is in the c1v1l_53rv1c3 is they expect those who are c0mpu73r_l173r47e to help the ones who aren't.

    Those who suggest trucrypt.com should set themselves up as consultants (cutting me in of course) to gain lots of t4xp43r5_d05h.

  75. Aodhhan

    What is the problem

    The password protection on a PC is good...well, for at least the 70 seconds it takes to boot up a CD Rom or 15 seconds on a thumb drive.

    You guys are just too hard on these people!

  76. Nomen Publicus
    Boffin

    There's clueless...

    ...and then there is government data security.

    It makes you wonder about the incidents we don't get to hear about.

  77. brimful

    Easy password crack

    Assuming it's a windows XP or earlier pc, take the following steps to get around windows password protection

    1 - take out the hard drive

    2 - insert hd into usb caddy

    3 - connect caddy to another computer

    4 - fire up computer, login, and browse mounted hard drive to your hearts content.

    I thought the upper echelons of our civilisation were supposed to be smatter than us and hence why they rule over us. Where did darwin go wrong and why didn't Guy Fawkes succeed?

  78. Andrew
    Unhappy

    not being funny but...

    would the Tories or the LibDems actually be any more computer savvy?

  79. Steven Pepperell
    Alert

    Frankly...

    ....take there latops off them. We all pay for them to have second houses so they can be close to 'the office' so make them bloddy go there to work instead! as last they cant leave a desktop on the train!.

    Wouldnt of happen with John Prescott......he'd have eaten it first.

  80. Anonymous Coward
    Pirate

    @ They never learn

    <quote>

    Some people are incapable of learning from their mistakes.

    </quote>

    You are suffering a serious lack of comprehension about our current government. In the same way they genuinely do not understand how they have pissed off the electorate in the run up to the local elections, they do not see this (and all the other data losses) as their mistakes. *Someone*'s mistakes but not *theirs*. In their eyes they really are the squeaky clean saviours they dream of being, instead of the dogshit Brown incompetents they really are.

  81. Anonymous Coward
    Anonymous Coward

    @Ash

    That's the Dell boot password that protects the hard drive in a separate machine is it?

    Truecrypt is another matter but it won't be implemented by the government as it's "open source and therefore not secure"

    Digital security is easy for any intelligent person but totally beyond the wit of this shower.

    Anonymouse cos I have to work for the clowns

  82. Anonymous Coward
    IT Angle

    Please, remain calm

    We in government realise that the modern security challenge is defined by new and unprecedented threats: terrorism; global organised crime; organised drug trafficking and laptop trafficking. This is the new world in which government must work out how it best discharges its duty to protect people.

    New technology is giving us modern means by which we can discharge these duties. But, as I have suggested recently, just as we need to employ these modern means to protect people from new threats, we must at the same time do more to guarantee our liberties. Among those liberties are the right to a government post for any New Labour member able to find a constituency amenable to his or her continual reelection.

    Furthermore, we are assured by a consensus of experts that password-protected computers are worthless as anything other than paperweights, boat anchors, and souvenirs to any but their rightful owners. We are therefore pleased to reassure the British populace that all is well.

    GB

  83. Tony

    Sorted.

    Here you go Mr Brown:

    http://cgi.ebay.com/Computer-Security-for-Dummies-by-Barry-D-Lewis-Pet_W0QQitemZ320259976637QQihZ011QQcategoryZ378QQrdZ1QQssPageNameZWD1VQQcmdZViewItemQQ_trksidZp1638Q2em118Q2el1247

    The 'buy it now' price is $4.00

    I know the economy is in the toilet but surely you can stretch to that?

  84. Andrew Smith
    Alien

    data

    "would the Tories or the LibDems actually be any more computer savvy?"

    Perhaps not, but neither of these parties is actively seeking to increase the amount of data the government holds. A sensible policy line after all these leaks would be something along the lines of:

    "We know you value you your privacy and you don't want your data to find it's way into criminal hands, so we will now launch a review into the all government computer systems. On a case by case decide whether they are required or if the data the each system holds can be reduced."

    No government will ever do that though, it'd be sensible.

  85. Anonymous Coward
    Anonymous Coward

    I've been told

    That this is just sheer incompetence, but damn its as if this is part of some plan. I almost believe that some higher power is in control and its their plan to leak all off this stuff. Just keeping on putting Muppets in charge and they will keep on losing data . The muppets are not even aware that they are part of this plan.

  86. Grumpy Old Man

    The government must have moved ....

    ... from Downing Street to Mornington Crescent, as obviously they don't have a clue.

  87. Anonymous Coward
    Anonymous Coward

    @ Gordon Pryra

    Loose != Lose

    http://www.elearnenglishlanguage.com/difficulties/looselose.html

  88. Anonymous Coward
    Paris Hilton

    How to break a windows password

    As I am 99.999% sure this was a windows machine, here is how to get the information back easily.

    1: Download knopix

    2: Mount the drive

    3: Get the files

    O wait, maybe the ment a boot password? Then all you need to do is rip the HD out and put it in another machine first. But I doupt they went this far.

    Or maybe (even less likely) the HD was locked using the ATA standard lock. Then I guess they just have to get the plater out and analyse that. Shouldn't be hard for someone who could break into such an office. But then again, chances are the only protection was the login password on windows ...

    Paris, cause she was brilliant enough to listen to him when someone who knew security told her how not to get her stuff stolen anymore.

  89. Anonymous Coward
    Thumb Down

    Its the organisation or lack of IT

    It is just incompetence and someone should be hauled up on the government IT side but you'll probably find there's no one specifically responsible (in that department) and to be honest most ordinary people (including MPs) have no idea about encryption or passwords or the difference between the two. Some years I worked in a Government owned organisation and my boss got PGP encryption (it was quite a while ago) installed on all the departmental laptops - we had huge grief from the users as they couldnt remember their passwords and weren't too happy to be told that we couldn't decrypt the drives (even though they'd been told that on numerous occaissions losing the passwords would mean data loss).

    There's also some interesting thinking going on in this thread i.e. thin client yes centralised government DBs/Servers no? You'd probably find that thin client would be way more secure as you could enforce passwords/password complexity/access policies.....etc. What your seeing now is the general disorganisation in government (always been there but not as obvious) and the breakup into agencies....etc won't have helped either. Whoever gets in next time won't change it as they'll be too busy with 'getting' pointless 'things done' - probably by setting up some more agencies rather than sorting out the mess thats there ad infinitum.

  90. Anonymous Coward
    Coat

    To all you naysayers

    If we all had ID cards, we needn't have worried about what went missing from HB's dekstop.

    All our data would already be in the public domain, and we'd have nothing left to protect. Ergo, we need not worry about privacy / ID theft / etc.

    ID cards solve all your problems.

    Mine's the heavy one loaded with aromatic herbs in all the pockets.

  91. Mr Larrington
    Black Helicopters

    Mountain, molehill

    The fact that the miscreant who made off with the machine got into the building by breaking a window makes me think that it's highly unlikely that said miscreant is any kind of l33t h@xx0r. More likely said miscreant had offloaded the PC at a car boot sale within 24 hours, and the buyer is e'en now stalking the streets of Mankchester with a baseball bat ready to be applied to the head of said miscreant. On the very reasonable grounds that when the buyer plugged it in and switched it on, it asked him for a password. Which he didn't know and, being ignorant of the machine's provenance, was unlikely to guess in a hurry.

    Yes, ZaNuLabour and its mongrel hordes are seriously lacking in Clue when it comes to IT security, but how about, just for once, a sense of proportion?

  92. michael

    @pepol who are sugesting trucrypt

    that is my 6figer contract for stating the obvoius read the first post hands off my pork

  93. michael

    to be even handed and unbised

    www.ubcd4win.com

    contains all the tools to brake a windows passworded pc including a password recovery tool I will be submiting my bill to the theifs as well as the goverment

  94. Ash

    @AC (@Ash)

    Well, you're right there... It doesn't protect the hard disk when inserted into a computer which doesn't support this password protection feature.

    Thank god, too! If it did, we'd NEVER be able to restore the data from these numpty idiots who forget their passwords, or hose the laptop by spilling coffee / wine / paint thinner on it.

    As for TrueCrypt not being secure, I hope to GOD that you're being sarcastic. The ability to peer review open source code is simply THE most secure way a program can be released.

  95. Anonymous Coward
    Linux

    CESG

    doesn't CESG (nice chaps who live quietly in Cheltenham) enforce gvmnt IT security policy? Won't they be having a nice friendly chat (proper security style interview) with the relevant MP's. hope so!

    in fact , probably the malfaiteur was a spook conducting an authorised pentest

  96. David Stone

    If they believe computers are secure then why not legalise hacking?

    Legalised hacking would sharpen them up, after all its just the same as now except the law abiding cannot join in!

    Really its time that Government data loss meant that the responsible person went to jail for a long time. Perhaps the simple word responsibility just doesn't register?

  97. Wayland Sothcott
    Coat

    Laptop - Desktop - what's the difference?

    People love laptops, they are cool. Desktops are so last century, no one wants a big box with a separate screen and loads of messy wires that takes up a desk and therefore a room.

    Imagine carrying that lot out of the building. I expect someone helpfully held the door open and maybe carried the printer.

    On the otherhand, if they only took the base unit, that would indicate that they wanted the DATA. If they wanted the data then they would spend the time and crack the password. Like I said, if it was a laptop then that's because they wanted a laptop, no one steals a desktop, duh.

    If you want data then look in coat pockets for USB sticks and PDAs.

  98. Ben Cwilewicz

    @michael

    At least the others could get the URL and name right.

  99. michael

    @ben

    I was protecting my sorces for my masive funding I was hoping to get (I was going to arange a meating with topgov man but he aprently left his notes on a train)

    (I also can not spell cos of dyslexica)

  100. Ken Hagan Gold badge

    Identity Trouble

    By the time this government has finished, there won't be a single shred of information about UK citizen that isn't in the public domain. That will include all biometric details (courtesy of the lovely ID database).

    How then, will commercial organisations like banks actually verify anything?

  101. Anonymous Coward
    Anonymous Coward

    Ground-up security

    Reports seem to indicate that the documents in question were emailed to the minister. If the email system was Outlook and using an OST, then the data is inaccessible without the correct user authentication details (as anyone who has tried to recover data from an OST knows). An Outlook PST is not secure - nor is any other email local store.

    The real problem is that there is no complete bottom up approach to security. For a secure system, documents (of any type) must be stored in a management system that enforces classification, and any access must conform to that appropriate classification. Media transfers must also conform (to disk or printer), and so must any other process such as email.

    Of course, there is actually no such system that integrates classification for applications, user devices and server solutions, and there will not be while the Govt insists on buying COTs solutions. And the only way such a solution could be integrated would be via the Open Source community, where the ability to see and modify everything at the source code level for a customised solution beats the non-free world where you would have to get several hundred vendors to co-operate.

    And that does not stop someone walking out of Whitehall with a printed copy of a secret document and leaving it on the train - when will printer paper with embedded RFID tags be available so they can be stopped at the door?

    Simon

This topic is closed for new posts.

Other stories you might like