Still not so worried about ID cards and their attendant massive database? Then how about this. This week’s Private Eye publishes extracts from Nick Davies’ Flat Earth News, ‘[a]n explosive expose of the corruption entrenched in today’s media:
Reporters from the Mail to whom I spoke independently agreed that they had bribed not only police officers but also civil servants. For example, they targeted officials who had access to the massive database of the social security system, which registers the personal details of every British citizen with a national insurance number and every foreign national with a right to work in Britain – some 72 million private citizens. One reporter who has now left the paper recalled: ‘We used to use the social security computer as if it was an extension of the Daily Mail library. You phone your contact, have a chat, say you’re looking for such-and-such a guy, this age, rough location – is there any chance? Keep chatting. He says, “Oh, we’ve got five people of that name.” You say, “Well, givegive me all five.” You get home addresses, phone numbers, maybe workplace too. They get you information off the database, and you reward them with a dirty great meal or an envelope.’
Now, under the terms of the Identity Card Act 2006, if a person with access to the Identity Register who ‘provides any person with information that he is required to keep confidential’ can face ‘imprisonment for a term not exceeding two years or [...] a fine. or [...] both’.
Why aren’t similar safeguards in place for the social security database? If not, why not? If they are, why aren’t they being enforced or acting as an adequate deterrent? Unless these provisions are made to provide the illusion of security for the public (see also, the towers of anti-terrorism legislation). There do seem to be measures of some sort in place. Davies again:
At one point, according to one Mail source, a reporter in the newsroom was bribing a Ministry of Defence police office who could access several databases, including Scotland Yard’s. Mail reporters separately claim that they also had regular access to what is arguably the most sensitive of all confidential information, the health records of some of their targets. As one Mail veteran put it to me: ‘If the Mail‘ go for you, they get every phone number you have dialled, every schoolmate, everything on your credit card, every call to your phone and to your mobile. Everything.’ Even if it is against the law.
My emphasis. This isn’t rocket science. Proper security would merely mean having to log every access to the database. That will take huge amounts of computer storage but, frankly, tough. Do it right or not at all. Then, if a person complains that their personal details have reached the public domain, it’s a simple procedure to review the access logs to see who’s been looking at that person’s details.
If the accesser doesn’t have a good reason, then it’s suspension, a trial and possibly ‘imprisonment for a term not exceeding two years or [...] a fine. or [...] both’. You could sketch this idea on a napkin and have a small prototype system running in an afternoon. I should be in management consultancy.
The vital ingredient in this plan, of course, is political will. The will to implement the measures. The will to provide the resources to monitor and enforce the measures. And the will to prosecute transgressors. Oh, and a newspaper or two having the balls to a) shun these practices and b) blow the whistle on law-breaking rivals. Good luck.
Remember all this the next time you see a government minister defending the overall safety of our personal information. And remember all this the next time you see the Daily Mail bleating about the government losing our data and it maybe ending up in the wrong hands. We now know whose hands some of that data is ending up in.