International Law

Government Gateway USB memory device with system passwords and source code found in a pub car park

The Mail on Sunday has a scoop report, picked up by the other mainstream media, under a somewhat misleading headline, Yet Another Government IT Security Failure:

Tax website shut down as memory stick with secret personal data of 12million is found in a pub car park

By Daniel Boffey
Last updated at 11:06 PM on 01st November 2008

Ministers have been forced to order an emergency shutdown of a key Government computer system to protect millions of people's private details.

The action was taken after a memory stick was found in a pub car park containing confidential passcodes to the online Government Gateway system, which covers everything from tax returns to parking tickets.

An urgent investigation is now under way into how the stick, belonging to the company which runs the flagship system, came to be lost.

The Department for Work and Pensions insisted that the system's security has not been breached, but a computer expert told The Mail on Sunday that in the wrong hands the data on the memory stick could enable hackers to access personal details of the 12million people who have registered on the system, including their passwords.

Users trying to log on to the site yesterday were met by the message: 'The Government Gateway is temporarily offline. We apologise for any inconvenience. Normal service will be resumed as soon as possible.'

The Government also closed down access to self-assessment tax applications via the Revenue and Customs website.

The HMRC income tax self assessment system is still the Government department which uses the Government Gateway website, even after all of these years of alleged "joined up e-government".

The Government Gateway website appears to be back online, for now.

[...]

The lost memory stick was found two weeks ago outside a Brewers Fayre chain pub in Cannock, Staffordshire, but the Department of Work and Pensions, which owns the Government Gateway, was made aware of its loss only last week when the 2in device was passed to this newspaper.

An expert who examined it for The Mail on Sunday said it contained confidential passwords, security software and the technical blueprint to the system known as the 'source code'. The memory stick is now in the hands of the police.

Therefore this USB memory device must have been unencrypted

Full post as published by Spy Blog on November 02, 2008 (boomark / email).