|
Project Stork December 2007
HMRC lost two discs containing the personal details of 25 million people. That exposes 25 million people to the threat of fraud. Given which, the question arises whether the government should proceed with the ID cards scheme -- creating yet another database just increases the risk of losing data and could lead to more fraud. On Monday 26 November 2007, David Davis asked Jacqui Smith in the Commons about something called Project Stork:
"The Home Office is currently prototyping a Europe-wide project called Project Stork. How are we going to prevent a repetition of the disaster of the last few weeks when sensitive personal data is held not by one government but by 27?"
The Home Secretary's only answer was to ask for more details. Here are some more details:
Clearly the EU believe that eGovernment involves sharing personal information between countries and that that information will be recorded on each country's electronic ID system. Project Stork is designed to make sure that these national systems are compatible. So Mr Davis does seem to have identified an EU initiative which will cause our personal information to be shared between up to 27 EU countries. His question requires an answer. James Hall is Chief Executive of the Identity and Passport Service and, as such, he is responsible for issuing us all with ID cards and for building the National Identity Register, the database which will record all our identities. It is natural, therefore, to assume that the eGovernment referred to above will be centred on his ID cards scheme and that all this personal information which is to be shared will come from the National Identity Register. Natural, but apparently wrong. Mr Hall says that information will not be provided from the National Identity Register. No doubt he is right. He's the boss. He should know. The information will not come from the National Identity Register. But then Mr Davis didn't say that it would. People should not come away from reading Mr Hall's letter thinking that personal information will not be shared across the EU. We know that that is the intention. The EU have told us so, in so many words: "In order to meet the need to exchange information across borders ..." So Mr Hall hasn't answered Mr Davis's question. Perhaps the Home Secretary now will. How are we going to prevent a repetition of the disaster of the last few weeks when sensitive personal data is held not by one government but by 27? We started a year ago with the loss of 25 million people's bank details. And now here we are again:
The tax website in question, the one whose source code was lost, the one with 12 million users the security of whose personal data may have been impugned, is the UK Government Gateway. That is the website used by both individuals and companies to submit all sorts of tax returns and which therefore stores all sorts of personal and corporate payments information. And that is the website which, according to James Hall, will be used to store the details of people who come to the UK from any of our 26 partners in the EU. The Prime Minister acknowledged the significance of this latest debacle: It is important to recognise we cannot promise that every single item of information will always be safe because mistakes are made by human beings. Mistakes are made in the transportation, if you like in the communication, of information. When the Prime Minister confirms that no UK government system is secure, how confident will our EU partners be about using the Gateway to store their data? Will a Frenchman or a German or ... want his personal details to be stored on this leaky system? The source code was lost. Confidential passwords were lost. And this is the system that we are asking 26 other countries to trust. The Identity & Passport Service will face some interesting questions when they attend the next meeting of Project Stork. And if the EU Commission are forced to revisit the Lisbon Declaration because of the mess the UK have made, never mind James Hall, they may have a few choice words for the Prime Minister. Project STORK has not gone away. According to a 16 January 2009 article on vnunet.com: The Stork project to create a Europe-wide electronic identity network gathered pace today with the launch of five pilot deployments to test its readiness for full-scale implementation. Stork was officially unveiled at the ISSE 2008 security event in Madrid last year. Around 30 million national electronic ID cards are used by citizens throughout the European Union to access a variety of online public services, but one country's card cannot be used to benefit from the same services in another country. The Stork project aims to address this with a three-year remit to enable cross-border recognition of national electronic ID systems ... The following submission was made to the Project STORK website:
Author: David Moss STORK requires the national systems of several countries to be interoperable. The relevant system in the UK is the Government Gateway. On 2 November 2008 the Mail on Sunday newspaper reported that a copy of the source code for the Government Gateway, together wil logon details, was found on a USB stick left in a pub car park in Cannock: Ministers have been forced to order an emergency shutdown of a key Government computer system to protect millions of people's private details.The action was taken after a memory stick was found in a pub car park containing confidential passcodes to the online Government Gateway system, which covers everything from tax returns to parking tickets.An urgent investigation is now under way into how the stick, belonging to the company which runs the flagship system, came to be lost. It is suggested that our EU partners would be well advised to satisfy themselves that the Government Gateway is now secure before individuals, companies and government departments entrust their data to it. Our own Prime Minister doubts it: It is important to recognise we cannot promise that every single item of information will always be safe because mistakes are made by human beings. Mistakes are made in the transportation, if you like in the communication, of information. It will be remembered that a year before they lost the source code and logon details of the Government Gateway, they lost the details of 25 million child benefit claimants, including their bank details. Anyone entrusting their data to the UK end of STORK is taking a real risk. A response was received from the STORK Dissemination Team on 26 January 2009: Regarding the letter you have sent us on January 17, 2009, we would like to inform you that we have requested for a formal response from the UK Government. They have committed to respond and we will let you know when they have done so. Nothing happened. A message was sent to the STORK Dissemination Team on 9 March 2009: It is now about six weeks since your email. Have Project STORK had a formal response from the UK government yet? The following response was received on 11 March 2009: The UK Government is working on it. We recognise the importance of a response and will get it to you as soon as possible. We apologize one more time for the late reply. Nothing happened. A further message was sent to the STORK Dissemination Team on 5 August 2009: It is now over six months since I pointed out the danger to any EU individuals, businesses and government personnel if they rely on the security of the UK Government Gateway. It is disappointing that no response has yet been received. The following response was received on 25 August 2009:
According to the Mail on Sunday: Computer security expert Jacques Erasmus, from internet protection firm Prevx, said that the passwords and security software saved on the memory stick would provide access into a series of databases or payment systems. But he added that the greatest concern was the source code. Mr Erasmus, who has previously worked with Government agencies, said that the blueprint to the Government Gateway was 'invaluable' for those who would want to harvest personal details or defraud the Government. On the publication of an article in The Register magazine, the following exchange of emails took place: From: David Moss Further developments are awaited. (The question arises whether referring the UK to the EU like this is unpatriotic. In fact, it arises not just in this case but in the case of the whole six-year campaign against the Home Office's plans to introduce ID cards into the UK. And the answer is no. The campaign is patriotic. It is the Home Office who are being unpatriotic.) 20 December 2010 – take a look at the STORK website. Six pilots are being conducted to test the interoperability of EU identity management systems. Yes? And? That's the idea, isn't it? That's the point of STORK. Yes. But take another look. None of these pilots involve the UK. We're off the radar, no longer involved, not participating, dropped, excluded and banished. Good. David Moss has spent six years campaigning against the Home Office's ID card scheme.
|
|||||||||||||