No-one understands this stuff

[Dave Birch] Well, the Birch household received its apology from HM Revenue & Customs this morning.  Mr. Dave Hartnett offers his personal apologies for the data loss (although no data has, of course, actually been lost — I’m sure the HMRC still have it somewhere).  He does, entirely sensibly, tells that there is no need to get a new bank account. I didn’t read the rest of it, because I noticed that it had my full name, address and (completely pointlessly) national insurance number on it, so I ran to the shredder to dispose of it immediately. He’s probably wasting his time, since neither the general public nor general journalists seem to have any understanding of the "incident" or its implications. My evidence? Well, Link tell us that the number of people who changed their PIN at a cash machine rose by more than 50 per cent in the three days following the HMRC data loss announcement, despite the fact that even if a dedicated team of crack identity fraudsters did manage to copy the CDs (either at HMRC, the courier or at KPMG) before handing them in, they wouldn’t have anyone’s PIN anyway.  Link did point out something that hadn’t occurred to me though: people may have been changing the PINs because the PINs were birthdates.  Hhhmmm.  Meanwhile, the Metropolitan Police announced that they have finished their search with no results, and are therefore offering a £20,000 reward for the discs. I thought Ian might have misunderstood, but no, he is correct.  The reward is for the return of the discs!!  As if that means that if the CDs are returned, all the data that was on them could not possible have been copied.  What on Earth is going on? Even normally sensible people are saying very strange things. Emergent Chaos picks up on this as well, spotting this quote about HMRC’s data antics:

However, [Gartner VP Avivah] Litan warned that the chance of identity theft was actually small, at just 1%.

As Chris says, the chance of this estimate being scientifically defensible is even smaller.

Technorati Tags: government, identity, management, security

What’s actually happened is that several Titanics have hit several icebergs. I use this analogy because I was listening to a podcast with Henry Petrovski.  He’s the chap who, if I understand things correctly, argues that, contrary to design theory’s conventional wisdom that "Form follows function" (design theorists being, so to say, the ideologists of successful designers), it is more accurate to say that "Form follows failure", and to see the inventor primarily as a critic.  Anyway, he used the analogy about something else, but it seems to me that it works well here.

Well all know that the Titanic was an unsinkable ship that sank on its maiden voyage.  But suppose it hadn’t?  Suppose it had made it to New York?  Then a whole bunch of other ships would have been designed the same way, and then when one of them eventually did sink we would be really shocked and we spend much of our time discussing how to spot icebergs and refining the Captain’s evacuation plan, legislating for better lifeboats and praising the band for playing on as the ship goes down.  No-one would think: wait a minute, perhaps ships shouldn’t be built this way if their purpose is to traverse the North Atlantic.

Incidentally, while we’re thinking about transtlantic things, I thought it was rather nice of Her Majesties subjects in Canada to show their support for the mother country by adding a security flaw to the Passport Canada website to give easy access to the personal information (birth certificate, driver’s license, dates of birth, social insurance numbers) of passport applicants.

What has happened at HMRC and elsewhere (and now the data losses seem to be coming thick and fast).  The Titanic that is the government’s only strategy for managing anything (ie, build a big database and put everything in it) has hit the iceberg that is humanity.

These opinions are my own (I think) and are presented solely in my capacity as an interested member of the general public [posted with ecto]