Patrick Hosking, Grainne Gilmore and Sean O’Neill
We've made some changes
to The Sunday Times
Thousands of people changed their bank account PIN codes yesterday as concern grew over the potential criminal abuse of the 25 million sets of personal details lost by Revenue & Customs. Banks and credit reference agencies were flooded with phone calls from child benefit claimants trying to protect details of their personal circumstances.
Many people altered their codes after advice to change any PINs linked to the names or birthdates of children or other family members.
It was revealed last night that the official responsible for Britain’s biggest breach of personal security was a 23-year-old junior at the Child Benefit Agency who could have been paid as little as £13,000 a year.
Whitehall sources said that the male IT worker had been authorised by senior managers at HM Revenue & Customs to copy and dispatch the files on two CDs in a blatant breach of all documented data security procedures.
The managers had been asked to send strictly protected information about Child Benefit claimants to the National Audit Office but reportedly refused to do so because editing the database would have been a costly exercise and they were under pressure from the Treasury to slash expenditure.
As the focus of the inquiry moves away from the 23-year-old junior – who is being kept away from the furore with a 24-hour media minder – his managers were left to explain who authorised him to download the data and provided him with whatever security clearance was necessary to do so.
Bankers attacked Alistair Darling yesterday over the Treasury’s six-day delay in informing them of the potential criminal threat to seven million accounts and for refusing to underwrite any losses arising from the loss of the records.
One senior banker told The Times: “They should have called in the cops earlier and they should have told us earlier.”
Mr Darling was first informed about the crisis on November 10, but did not tell bankers until November 16. A further two days passed before banking industry bodies were allowed to pass details to individual banks.
Angela Knight, chief executive of the British Bankers’ Association, implied that the banks would expect the Government to pay if fraud occurred in the wake of the security breach. She said: “This isn’t a bank responsibility. The banks didn’t lose the data.”
Police searching for the two missing CDs holding the data have been told that two more unencrypted discs with thousands of personal records also went astray in recent months.
Yesterday Edward Leigh, the Conservative chairman of the Commons Public Accounts Committee, said he had been informed that the NAO originally asked only for basic details about child benefit recipients – omitting information on personal bank accounts – but was told by “high level” officials that it would be “too burdensome” for Revenue & Customs to separate out this data.
Mr Leigh said that he had been given a copy of a briefing note written by NAO head Sir John Bourn for the Chancellor, which indicated that senior Revenue & Customs officials authorised the release of sensitive information. He said the note states that the NAO requested data on child benefit claimants in a “desensitised” form, with bank accounts and other personal data removed, in March.
Mr Leigh said the reason given for turning down the NAO request was that desensitising the information would require an extra payment to the data services provider EDS.
Shawn Williams, a solicitor who regularly receives CDs from Revenue & Customs, said there was a slapdash attitude to data security. “Sometimes there is no security at all, sometimes there are instructions telling you how to access the data, sometimes the password is just written on a compliments slip and included with the disc.”
The Times has learnt that the Information Commissioner is also unhappy with the Government’s handling of the situation and with the limited data security powers given to him by the Prime Minister.
Enjoy screenings of all the classic films you love, plus take advantage of two-for-one tickets
We explore leisure activities that are safe and suitable for all of the family
Times Online's new TV show helps you make the right decisions for your pet
See the best entries in this year's competition
Your brain is capable of more than you might think...
An interactive preview of the brand new For Your Eyes Only exhibition
The latest travel news plus the best hotels and gadgets for business travellers

Love Sudoku? Play our brand new interactive game: with added functionality and daily prizes

Are you irritable when you return from work? Drained of emotion? You could be suffering from boreout
Prepare for some shock and awe, petrol lovers. Despite the greens trying to wipe it out, the car is about to offer us the most exciting year ever
We've trawled the brochures and websites to find this summer’s best holidays for every taste and budget

Our Credit Clinic has free help and advice
2002/02
£59,995
The Midlands
2008/08
£169,950
Scotland
2007/57
£35,000
South East England
Great car insurance deals online
Circa £82,000 per annum
Birmingham Women's Hospital
Birmingham
To £28k
Barclaycard
Various (outside London)
£
Up to £66,000 per annum
Hertfordshire County Council
South East
To £38k
Barclaycard
Northampton/Liverpool
2 Bathrooms, Balcony and Garden
Beautiful Gardens w/ stunning Thames Views
Apts From £249,950
Mortgages, bank acc & money transfers to help you buy abroad
Explore mystical Jordan
From £1030 for 7nts 4*
to USA's Most Cosmopolitan City; San Francisco!
£POA
Book Now for Winter 08/09 and Get 10% off!
Great travel insurance deals online
Contact our advertising team for advertising and sponsorship in Times Online, The Times and The Sunday Times. Search globrix.com to buy or rent UK property.
© Copyright 2008 Times Newspapers Ltd.
This service is provided on Times Newspapers' standard Terms and Conditions. Please read our Privacy Policy.To inquire about a licence to reproduce material from Times Online, The Times or The Sunday Times, click here.This website is published by a member of the News International Group. News International Limited, 1 Virginia St, London E98 1XY, is the holding company for the News International group and is registered in England No 81701. VAT number GB 243 8054 69.
It has been ever thus. Those who are responsible for keeping the most classified information have always been of the lowest rank and in receipt of the lowest pay. My experience as a civil servant (military and civilian) for over 35 years has shown that.
TI, London, UK
Of course heads should roll at HM Revenue and Customs as should a full investigation be held in to the alleged six day delay by Alistair Darling. Presumably the thousands of people potentially at risk have been informed and advised of what they should do?
This government continues to treat the public as "idiots" in claiming that this disaster is another one off incident.
TBH, Usk, Wales
Aside from the "ten-second statement" claims above, it is standard practice to have de-personalisation scripts on hand for back-filling live data into test databases whilst removing all personal references (usually on a routine, weekly basis). Those scripts could have been modified and run in less than an hour by any competent database administrator.
As for blaming the IT worker (almost certainly the database administrator in the loop), he was probably pressured into it to cover someone else's procrastination. If he received authorisation from a manager to alter the security protocol then don't report him as the person to blame. Sack the man that authorised this, without severance pay or pension benefits, and do it now and very publicly. That's the only way to regain any measure of public trust.
KR, Stockport,
The managers should be sacked and the practice of enclosing the password with the disk investigated. This is clearly institutional disregard for data protection, not a one off incident as the government is trying to claim.
Alison, London,
This is unacceptable. Head must roll starting from Alistair Darling downwards. No one should be spared. It is a negligence of Himalayan proportion.
Dr. A. Kumar, Gt. Yarmouth, Norfolk, England
... and the government want us to give them a lot more data for their identity card scheme! They claim that this will reduce indentity theft but with their (mis-) management skills it will play into the fraudsters hands.
Ian Allerton, Watford, Herts
Read the article again James. It's the people who base their PINs on family birth (etc) dates that fear they may have cause for concern.
Brian, Southampton, UK
Agree with Falanx (Birmingham). Wait until the Security Services check ip on the way renewed Passports are delivered by Courier.
If no-one is at home the Passport is pushed through the letterbox and instead of a signature the Courier merely makes a note in his/her receipt book of the colour of the streetdoor and colour/type of fittings on it. Some security in this day and age ! And we are expected to believe that the 12,000 Passport that go missing each year are purely as a result of being "lost in transit">
John E.Flunder, London, England
This is not a problem when we do criticize one or two individuals. It`s a mayor problem when important personal information on data can´t be protected in U.K. and of course many other countries.
Karl G. Qvarfordt, Upplands Väsby, Sweden
UK once again - a total laughing stock
Further proof - (as if needed) - that New labour are utterly unfit for Government.
They make me so ashamed to be English.
Mike, London,
Like the England football team, the UK has a lot of good players and potential, but ends up being 2nd rate.
roger, london,
Many companies outsource their IT to save money. They then find to peform simple tasks, that they must pay large amounts of money and waste a lot of time for large outsourcing companies to do the work - often poorly. Worse, IT is only being taught at a basic level in UK schools, with lots of the work going to India. In 20 years time, one wonders who will be left to peform the most basic of IT tasks such as performing database queries that this case required.
roger, london,
Why are people changing their pin codes ? I thought these are not revealed to anyone... ? Does this mean the government doesn't need our signatures anymore and that someone can clean out all of our accounts simply by hitting "Enter" on a keyboard.. ?
I am surprised the news didn't result in a run on a number of banks with people withdrawing their money or at a minimum transfering their money to a new and 'secure' bank account.. just a thought.
James Bremen, Pinner, London
This is a direct result of the Government's insistance in handing every IT contract over to EDS, despite foul up after foul up (Pensions system, Child Tax Credit system etc) yet they charge the government millions in Taxpayers money for their incompetence. I worked for a company that used EDS in the past and they were a bunch of jokers back then, their 'system' got thrown out and replaced only a couple of years after going 'live'. Shame the Government are blind to their incompetence and keep handing them our money.
Claire James, Ruislip, Middlesex
Yes, ask HMRC about the State Second Pension Disk... that went missing too.
Chantel, UK,
There is only one word for this DISGUSTING! If I were to give erroneous advice in my profession I would pay the price by being sued by my clients, so I have professional indemnity insurance. So the government, hiding behind all the laws they have written, are refusing to fork out for any losses incurred as a result of the data being lost.... DISGUSTING! What hypocritical, spineless individuals... and they're running our country??!! Totally laughable!
Sickened, Belfast,
When it is said that the treasury were involved, we can safely assume that Gordon Brown is the name of the person most culpable, darling only carrying out his masters orders and most of the orders having been put in place months, if not years, ago. It is becoming ever more clear why Tony Blair didn't want to endorse Brown as PM.
David Leslie, Perth, Scotland
The positive in this deeply depressing saga is that the government is now under intense pressure to reform Data Protection Law and this desperately needs to be done. The question isnât so much about what information the government has on various systems but who actually has access to this information. How can we be sure that they can be trusted? What safeguards will there be? How will this prevent our information from falling into the wrong hands or being abused? How secure is our information? Who watches the watchers?
All of this should have been resolved at least 20 years ago when Data Protection Laws were first being introduced. If it had then maybe the government wouldnât find itself in the unfortunate position it is in now.
Jason Mead, Bristol, England
Does anyone else get the feelign these were intentionally lost?
Does anyone else get the feeling that someone, somewhere, very high up in the 'command' structure of this country, is facilitating oorganised crime?
Falanx
Falanx, Birmingham,
It beggars belief that this data should ever have got onto CDs in the first place - encrypted electronic transmission over a dedicated line would never have allowed this data get into the public domain.
Steve Jubb, Kegworth, UK
Well, now we at least know that a lot of people are incautious enough to use their children's names for their passwords, despite ten years' worth of advice to the contrary.
The statistic I'd REALLY like to know is how many of them already publish their children's names and birthdays on Facebook or Friends Reunited. 80%? 90%?
Ian Kemmish, Biggleswade, UK
This idea of "editing the database" is complete nonsense.
To pull out specific data from any of the big relational databases takes one line of code which takes 10 seconds to write. For instance:
Select NAME, BENEFIT, NI NUMBER from DATABASE NAME
And that is it. A couple more lines of code to print it out to a text document.
EDS are famous for charging millions for pennies worth of work. Why not investigate them instead?
Joss, Stony Stratford, UK
"Too burdensome" They are surely having a laugh.
select [field-1],[field-2]
from [tablename]
where [field-1 is not null
sounds like a fairly simple query to me.
does not seem as if this would cost such a vast amount of money.
Keith Wood, Frankfurt am Main, Germany
big disaster!
Zhang Haibo, Datong, China
England has fallen so far. It's sad.
Stosh2, Chicago,
There could be something positive out of this fiasco. If all applicants are required to reapply the fraudsters might be easier to spot.
That assumes of course that the Government cares.
BJ, London, England
A good day to hide bad news:
Whatever ones views about governmental incompetence in other fields, they have clearly not lost their ability to spin a dangerous story.
In their hurriedly convened huddle of the 15th-16th November, the most pressing topic was how to best spin the story.
Their resulting wheeze was to hold it back for six days or so, and even then to release the information via the well proven drip, drip method, by which time the football results would be in, and win or loose, the minds of Mr.average moron would then be filled by the media to distraction.
Thereafter the whole matter could be kicked into the long grass, or would anyway, likely be superseeded by the next monumental cock up or panic story to come along.
John Bayldon, Harrogate,