The loss of United Kingdom child benefit data was a
data breach
A data breach is a security violation, in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Other terms are unintentional information disclosure, data leak, info ...
incident in October 2007, when two
computer discs owned by
HM Revenue and Customs
HM Revenue and Customs (His Majesty's Revenue and Customs, or HMRC) is a non-ministerial government department, non-ministerial Departments of the United Kingdom Government, department of the His Majesty's Government, UK Government responsible fo ...
containing data relating to
child benefit
Child benefit or children's allowance is a social security payment which is distributed to the parents or guardians of children, teenagers and in some cases, young adults. A number of countries operate different versions of the program. In most co ...
went missing. The incident was announced by the
Chancellor of the Exchequer
The chancellor of the Exchequer, often abbreviated to chancellor, is a senior minister of the Crown within the Government of the United Kingdom, and head of His Majesty's Treasury. As one of the four Great Offices of State, the Chancellor is ...
,
Alistair Darling
Alistair Maclean Darling, Baron Darling of Roulanish, (born 28 November 1953) is a British politician who served as Chancellor of the Exchequer under Prime Minister Gordon Brown from 2007 to 2010. A member of the Labour Party, he was a Member ...
, on 20 November 2007. The two discs contained the personal details of all families in the
United Kingdom
The United Kingdom of Great Britain and Northern Ireland, commonly known as the United Kingdom (UK) or Britain, is a country in Europe, off the north-western coast of the continental mainland. It comprises England, Scotland, Wales and North ...
(UK) claiming
child benefit
Child benefit or children's allowance is a social security payment which is distributed to the parents or guardians of children, teenagers and in some cases, young adults. A number of countries operate different versions of the program. In most co ...
,
of which takeup in the UK is near 100%.
The loss
The discs were sent by junior staff at
HM Revenue and Customs
HM Revenue and Customs (His Majesty's Revenue and Customs, or HMRC) is a non-ministerial government department, non-ministerial Departments of the United Kingdom Government, department of the His Majesty's Government, UK Government responsible fo ...
(HMRC) based at Waterview Park in
Washington
Washington commonly refers to:
* Washington (state), United States
* Washington, D.C., the capital of the United States
** A metonym for the federal government of the United States
** Washington metropolitan area, the metropolitan area centered o ...
,
Tyne and Wear
Tyne and Wear () is a metropolitan county in North East England, situated around the mouths of the rivers Tyne and Wear. It was created in 1974, by the Local Government Act 1972, along with five metropolitan boroughs of Gateshead, Newcastl ...
, to the
National Audit Office (NAO), as unrecorded internal mail via
TNT
Trinitrotoluene (), more commonly known as TNT, more specifically 2,4,6-trinitrotoluene, and by its preferred IUPAC name 2-methyl-1,3,5-trinitrobenzene, is a chemical compound with the formula C6H2(NO2)3CH3. TNT is occasionally used as a reagen ...
on 18 October. On 24 October the NAO complained to HMRC that they had not received the data. On 8 November, senior officials in HMRC were informed of the loss, with
Chancellor of the Exchequer
The chancellor of the Exchequer, often abbreviated to chancellor, is a senior minister of the Crown within the Government of the United Kingdom, and head of His Majesty's Treasury. As one of the four Great Offices of State, the Chancellor is ...
,
Alistair Darling
Alistair Maclean Darling, Baron Darling of Roulanish, (born 28 November 1953) is a British politician who served as Chancellor of the Exchequer under Prime Minister Gordon Brown from 2007 to 2010. A member of the Labour Party, he was a Member ...
being informed on 10 November.
On 20 November Darling announced:
The lost data was thought to concern approximately 25 million people in the UK (nearly half of the country's population). The personal data on the missing discs was reported to include names and addresses of parents and children and dates of birth of the children, together with the
National Insurance
National Insurance (NI) is a fundamental component of the welfare state in the United Kingdom. It acts as a form of social security, since payment of NI contributions establishes entitlement to certain state benefits for workers and their famil ...
numbers and bank or building society details of their parents.
The "password protection" in question is that provided by
WinZip
WinZip is a trialware file archiver and data compression, compressor for Microsoft Windows, macOS, iOS and Android (operating system), Android. It is developed by WinZip Computing (formerly Nico Mak Computing), which is owned by Corel, Corel Co ...
version 8.
This is a weak, proprietary scheme (unnamed encryption and
hash algorithms) with well-known attacks. Anyone competent in computing would be able to break this protection by downloading readily-available tools. WinZip version 9 introduced
AES encryption, which would have been secure and only breakable by correctly knowing the
passphrase
A passphrase is a sequence of words or other text used to control access to a computer system, program or data. It is similar to a password in usage, but a passphrase is generally longer for added security. Passphrases are often used to control ...
.
In a list of frequently asked questions,
on the
BBC News
BBC News is an operational business division of the British Broadcasting Corporation (BBC) responsible for the gathering and broadcasting of news and current affairs in the UK and around the world. The department is the world's largest broadca ...
website a breakdown of the loss was reported as being:
* 7.25 million claimants
* 15.5 million children, including some who no longer qualify but whose family is claiming for a younger child
* 2.25 million 'alternative payees' such as partners or carers
* 3,000 'appointees' who claim the benefit under court instructions
* 12,500 agents who claim the benefit on behalf of a third party
Whilst government ministers claimed that a junior official was to blame, the Conservatives said that the fault lay in part with senior management. This was based on a claim that the National Audit Office had requested that bank details be removed from the data before it was sent, but that HMRC had denied this request, because it would be "too costly and complicated".
Emails released on 22 November confirmed that senior HMRC officials had been made aware of the decision on cost grounds not to strip out sensitive information. The cost of removing sensitive information has been given as
£5,000. Although the cost was found to be substantially less (£650) in an academic study.
According to an IT
trade journal
A trade magazine, also called a trade journal or trade paper (colloquially or disparagingly a trade rag), is a magazine or newspaper whose target audience is people who work in a particular trade or industry. The collective term for this ...
''
Computer Weekly
''Computer Weekly'' is a digital magazine and website for IT professionals in the United Kingdom. It was formerly published as a weekly print magazine by Reed Business Information for over 45 years. Topics covered within the magazine include outs ...
'', it said that back in March 2007, the NAO had asked for completed information of the child benefit database to be sent by post on CDs, instead of a sample of the database. The first time this was done, things went smoothly, and the package was registered post. However this time, it was unregistered through the courier.
It was later revealed, on 17 December 2007, that the data protection manual for HMRC was in itself under restriction to only senior members of staff, not junior civil servants who had just a summary of what the manual says on security.
Other data scandals
This was followed by several other data scandals. On 17 December it was revealed by
Ruth Kelly
Ruth Maria Kelly (born 9 May 1968) is a former British Labour Party politician who served as the Member of Parliament (MP) for Bolton West from 1997 until she stood down in 2010. Previously, she served as the Secretary of State for Transport, ...
that the details of three million learner drivers were lost in the
United States
The United States of America (U.S.A. or USA), commonly known as the United States (U.S. or US) or America, is a country primarily located in North America. It consists of 50 states, a federal district, five major unincorporated territorie ...
. However the only details said to be lost were the: name, address, phone number, the fee paid, the test centre, payment code and
e-mail
Electronic mail (email or e-mail) is a method of exchanging messages ("mail") between people using electronic devices. Email was thus conceived as the electronic ( digital) version of, or counterpart to, mail, at a time when "mail" meant ...
, so not much of a panic was caused due to a reduced risk of financial
fraud
In law, fraud is intentional deception to secure unfair or unlawful gain, or to deprive a victim of a legal right. Fraud can violate civil law (e.g., a fraud victim may sue the fraud perpetrator to avoid the fraud or recover monetary compens ...
. On 23 December it was revealed that nine
National Health Service (NHS) trusts had also lost the data of hundreds of thousands of patients, some of it archive information, some of it medical records, contact details and soft financial data. A few other trusts also lost data, but found it fairly quickly. Several other UK firms have also admitted security failings.
Response
Darling stated that there was no indication that the details had fallen into criminal hands, but he urged those affected to monitor their bank accounts.
He said "If someone is the innocent victim of fraud as a result of this incident, people can be assured they have protection under the Banking Code so they will not suffer any financial loss as a result." HMRC then set up a Child Benefit Helpline for those concerned about the data loss.
[
The incident was a breach of the UK's Data Protection Act and resulted in the resignation of HMRC chairman Paul Gray; Darling commented that the discs were probably destroyed when "the hunt was on, probably within days" and that there was an "opaque" management structure at HMRC and it was difficult to see who was responsible for what. Gray was subsequently found to be working at Cabinet Office.] The Metropolitan Police
The Metropolitan Police Service (MPS), formerly and still commonly known as the Metropolitan Police (and informally as the Met Police, the Met, Scotland Yard, or the Yard), is the territorial police force responsible for law enforcement and ...
and the Independent Police Complaints Commission
The Independent Police Complaints Commission (IPCC) was a non-departmental public body in England and Wales responsible for overseeing the system for handling complaints made against police forces in England and Wales.
On 8 January 2018, th ...
both investigated the security breach, and uniformed police officers investigated HMRC offices. The loss led to much criticism by the Acting Leader of the Liberal Democrats Vince Cable
Sir John Vincent Cable (born 9 May 1943) is a British politician who was Leader of the Liberal Democrats from 2017 to 2019. He was Member of Parliament (MP) for Twickenham from 1997 to 2015 and from 2017 to 2019. He also served in the Cabinet a ...
and Shadow Chancellor
The Shadow Chancellor of the Exchequer in the British Parliamentary system is the member of the Shadow Cabinet who is responsible for shadowing the Chancellor of the Exchequer. The title is given at the gift of the Leader of the Opposition and ...
George Osborne
George Gideon Oliver Osborne (born Gideon Oliver Osborne; 23 May 1971) is a former British politician and newspaper editor who served as Chancellor of the Exchequer from 2010 to 2016 and as First Secretary of State from 2015 to 2016 in the ...
. Osborne said:
In addition he said that it was the "final blow for the ambitions of this government to create a national ID database". Cable also criticised the use of disks in the modern age of electronic data transfer. Spokespersons for Gordon Brown
James Gordon Brown (born 20 February 1951) is a British former politician who served as Prime Minister of the United Kingdom and Leader of the Labour Party (UK), Leader of the Labour Party from 2007 to 2010. He previously served as Chance ...
, however, said that the Prime Minister fully supported Darling, and said that Darling had not expressed any intention to resign.[
The general reaction of the public was one of anger and worry. Banks, individuals, businesses and government departments became more vigilant over data fraud and identity theft and the government pledged to be more careful with data. The public and media was particularly angry over the fact that the data was not registered or recorded, and that it was not securely encrypted.
Nick Assinder, a political correspondent at the ]BBC #REDIRECT BBC #REDIRECT BBC
Here i going to introduce about the best teacher of my life b BALAJI sir. He is the precious gift that I got befor 2yrs . How has helped and thought all the concept and made my success in the 10th board exam. ...
...
, expressed the opinion that he believed Darling to be "on borrowed time".
, who questioned whether Darling was "up to the job", suggested that it would be a matter of days before a decision was made regarding Darling's future.
However Darling remained Chancellor until Labour's defeat in 2010.
TNT stated that, as the delivery was not recorded, it would not be possible to even ascertain if it had actually been sent, let alone where it went.
'' to make the point that public concern over the scandal was unnecessary. He wrote, “All you'll be able to do with them is put money into my account. Not take it out. Honestly, I've never known such a palaver about nothing”. Someone then used these details to set up a £500 direct debit to the charity
. In his next ''
'' column, Clarkson wrote, “I was wrong and I have been punished for my mistake.″