Posts by threaded 19 publicly visible posts • joined 13 Aug 2007
Whoever ends up with them disks could make more than £20k, every day, easy.
Planks. Utter planks. Utter clueless planks.
Yet, I suppose offering some reward looks good to the sheeple who vote for them. Baaaa.
I bet they set up a committee to decide on how big a reward to offer: big enough to look serious, but not so big as to cause a stampede to every government waste disposal site. I then go on to posit that the cost of supposed committee meetings is greater than the reward they're offering.
Yet, this reward is still less than the quoted cost of removing the data as originally requested by the NAO.
Planks.
As someone who knows a little more than nothing about encryption I'd like to point out that even if they'd encrypted these disks you should still have been worried.
This data is going to have significant value for many years. In fact it will only start to make good money for the bad guys in about 3 years, and then onwards for a lifetime, what's that, maybe another 80 years more. If bad guys have got them they'll probably sit on them for a good few years before even starting to use them.
Cryptography is always advancing, and so is the speed of machines. Encryption systems in use today will be broken eventually, they always are. These disks have a significant value, and will continue to do so for a long time. It would be worth the time and money for the bad guys to break the scheme in use. (I now look forward to myriads of posts about how hard it is to crack the current encryption schemes. Yes, currently it is hard, but next year it will be easier, and in ten years: probably trivial.) Considering the governments wherewithal on security, I doubt they would have encrypted it properly anyway, even if they'd tried.
The issue is not the use of CDs, the posting in the mail, or the lack of encryption, the issues are these lunatics thought it OK to send a large quantity of that quality of data about, as it exhibits a monstrous level of cluelessness, and that people so cavalier are even allowed through the gates, never mind given positions of authority.
Hang on a minute, Salvador Dali's work is Art! Every telco billing system I've seen, and I've seen lots, are the product of some sales droids enthusiasm to get their grubby mits on as much of your money as possible by means of confusion marketing, combined with their complete inability to notify the billing department of what they're up to until customers start phoning up complaining about the bill. In fact the confusion is usually so extreme that no one really knows what the bill is, and it generally falls to some sort of agreement or acquiescence on the part of the consumer as to how much you pay, and then the billing system is quickly written using staff of dubious ability. Then you get the next wave of complaints on these bills, and they get some slightly more experienced staff to try and sort out the new mess.
Eventually they end up with loads of highly experienced contractors, who spend their time tinkering with the systems in an effort to minimise the number of customer complaints, and still maximise the take for the telco. Although it is hardly ever described in that fashion.
Then, every so often, some management type decides they're going to save loads of money by unifying their billing system and getting rid of all the contractors. Sounds and looks great on the PowerPoint slides. Unfortunately the management droid has to look up what POTS means by use of Google, so their understanding of the situation is likewise vast, not! So they get a new system, written by a bunch of part-time college students, some of who do actually study IT, so it does at least compile..
Then they get contractors in to sort out this next mess.
And so it goes.
So a journalist misrepresents someones comments and makes a news story out of it. Same old same old.
Was a really good website, very funny.
Sad that the more and more of this that happens, the more and more the web becomes this homogeneous 'safe place' and you get the feeling like walking around the supermarket after it has driven all the corner shops and boutiques out of business.
From the original specification this 'debacle' appears to have been the intended outcome.
Then they waste a load of money on a report. Explaining what went 'wrong'.
Yet, nothing did go wrong because the outcome was what was intended from the outset.
IIRC, they did a similar thing to the Doctors: set up a website, specify that security should be more than lax, gather loads of personal information, wait for the identity thieves to harvest as much as possible, and then shut the stable door. If the outcry is loud enough commission a report, or in extremis put up some doe-eyed PR bunny to say what a terrible thing has happened and it's all the contractors fault.
What I find annoying is that these reports never put this in very large type on the front page. In effect these reports are not just throwing good money after bad, but actually part of the 'modus operandi'.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
