UK Gov't and Lost Personal Data

Slashdot is running a story on UK Gov't Lost Personal Data On 4M People. I follow these stories (as previously posted here) because the management of Personally Identifiable Information is probably one of the hardest and most vital issues we have in front of the internet in the next decade.

As I have observed previously in this blog, computer programmers are beginning to build systems that substitute for subtle key social infrastructure that we (as mere programmers) have no idea that we are replacing. As computers take over the duties of identifying social standing, trust-worthiness, and other faculties that used to be purely human domains the protection of key information for each person either becomes deathly important or our ideas about how to verify identity have to be re-designed on a global scale.

Daunting, serious issues that will probably not be addressed until there are truly severe consequences to either the financial system or civil liberties. These are the core issues I set out to explore in this blog originally. In the simplest terms, the software engineering and the software design of the world's information systems need to grow up. And fast.

Unfortunately, the concept of "data guardian" feels like a hack and not a good one. I think we need to design information systems that obviate the need to keep PII secret at all... or systems that eliminate the need for the transmission of PII. Such systems would probably have to operate in radically different ways on the human level.

A fundamental property of information is that it is easily replicated the idea that we must prevent the spread of a specific class of information is like fighting the tide. Instead redefine identity and authority. If you must have a "secret ID key" (aka Social Security Number in the US) allow it to be easily changed.

Until society adapts to these ideas we all must carefully protect our personal information and those of us that write software to deal with credit, visas, or medical data must be vigilant beyond the immediate call of duty. Your web application might lead to someone's identity being stolen. Please think about that.

Bi-Tek

Johnston County in North Carolina has gotten a temporary court order to get Google to remove a page from cache. The page contained the personal information of county residents including social security numbers and cell phone numbers. The news has focused the fact that Google did not respond instantaneously causing Johnston County to seek a court order from an NC judge and not the fact that one of the county's contractors was negligent in its handling of sensitive data.

While it is disturbing that Google doesn't respond faster to requests to clear Personally Identifiable Information from its cache... Johnston county did leave the information languishing on the Internet for six weeks. And, how did this information make it to the web anyhow?

The News and Observer Article states that Bi-Tek creates a file that is posted to the Johnston county website and this file is supposed to contain only names, addresses, and non-private account numbers. Bi-Tek made a mistake that instead posted private data to the Internet.

Earlier this year the VA had its own incident where it potentially exposed the personal information of millions of veterans. Proving that large and small organisations alike have to fight employee ignorance, malice, and indifference regarding sensitive data. The questions that the press should really be asking might be:

1. What is going to happen to Bi-Tek for this mistake?
2. What are they going to do at Johnston County to make sure this never happens again?
3. Will Google be motivated to create a special "Oops! I posted my credit card number on a bulletin board!" call center?
4. Should software companies that handle sensitive banking, tax, and accounting data have to be certified? And, would an incident like this revoke the license of such a company? Should they ever get it back?
   

If you pay taxes in Johnston County, North Carolina you should be concerned about the security of your tax information and you should be asking questions about Bi-Tek, Johnston County's website, and what they are doing to safe guard your personal information that they have stewardship over.