Big Brother Watch

MPs table motion for 'internet bill of rights'

A cross-party collection of MPs have tabled an early day motion calling for new data protection controls to protect people against the rise in targeted advertising. The thirteen MPs signed the Commons motion which suggests an ‘internet bill of rights’ along with giving more power to the Information Commissioner’s Office to deal with privacy issues.

This follows widespread concern that the WPP group, a global advertising and marketing company, may have profiles of up to half a billion internet users, which the motion suggests may include almost all British citizens. They also criticise the behaviour of Google during the Street View project, where private wi-fi data was collected by the fleet of cars supposedly taking pictures for mapping.

Karen Fraser, the director at advertising think-tank, Credos said:

"People see the value in more relevant – and possibly fewer -- ads but are setting the same privacy boundaries on-line as in ‘real’ life.  If advertising is seen to be breaking those boundaries - interrupting conversations or reading another person’s diary – there is a very real risk of alienating people."

After the ICO allowed websites an entire year to conform with European regulations concerning cookies, it's good to see MPs ensuring privacy issues are debated in parliament.

The harrowing consequences of the Milly Dowler phone-hacking allegations: Blog by Frank Manning

Until yesterday, the News of the World phone-hacking fiasco had failed to truly enter the national consciousness. The majority of print media in Britain were keen to avoid reporting on it, and most of the ‘victims’ were celebrities whose regular publicity-seeking appearances in newspapers and magazines can sometimes be seen as a rejection of their own privacy rights . The revelation that the mobile phone of the kidnapped teenager Milly Dowler could have been hacked has changed the situation dramatically.

What is alleged to have happened goes beyond the basic issues of privacy. By deleting messages from her mobile, those responsible for the hacking were effectively destroying evidence and tampering with an investigation, with the sole purpose of finding a story to sell papers and further their career.

Police always monitor voice messages left on victims’ phones as they can be vital for an investigation. Perpetrators can sometimes leave messages of concern to try and exonerate themselves. Deleting them just to make space for more messages and therefore the possibility of more stories could have meant the murderer escaping capture.

When a child goes missing, parents and family will cling to any possibility of hope or any hint of life. Milly Dowler’s parents believed their daughter must have been alive when they discovered messages had been deleted, even going so far as to describe their remote feelings of optimism to, in a macabre irony, the News of the World.

Someone at the paper involved in the hacking must have known it removed this possibility, yet they did nothing to inform the family about this, allowing the pain and suffering to continue unabated.

The lawyer for the Dowler family has released the following statement:

“It is distress heaped upon tragedy to learn that the News of the World had no humanity at such a terrible time. The fact that they were prepared to act in such a heinous way that could have jeopardised the police investigation and give them false hope is despicable.”

At the time, Surrey police were suspicious of the information the media were receiving with regards to the case, however they were more concerned with finding the missing girl so these suspicions were never followed up on.

This is clearly not a case of one rogue reporter acting on their own, this level of espionage must have been authorised by someone with a high level of responsibility. The police investigation will seek to determine quite how far up the hierarchy this conspiracy went.

This entire fiasco began primarily as political point scoring between the British print media. The Guardian, initially seeing the phone-hacking scandal as a perfect opportunity to attack Rupert Murdoch’s News International empire, have now uncovered something far more important than the idiosyncrasies of Sienna Miller’s love life, or whatever messages Andy Gray ever received from Richard Keys. The Sun and the News of the World are still attempting to bury it today in the hope that it will disappear, but public feeling has become vociferous overnight, and if any of these allegations are proved to be true, they will be forced into one of the most grovelling apologies ever witnessed.

If elements of the British media are willing to stoop so low as to hack into the messages of a kidnapped teenager for profit then there is clearly the possibility that something similar has occurred before. Whatever the results of the investigation are, it seems unlikely the British media will be the same afterwards.

Frank Manning tweets at @BillyManning

Ban these referral fees which are costing millions of people thousands of pounds on inflated insurance premiums: An article by Frank Manning

Big Brother Watch has previously brought up the topic of insurance companies selling on referral data to no-win no-fee claim firms, which has now received widespread attention after being picked up by the media following an interview on the Today programme by Jack Straw. I personally received a text message a few weeks ago inviting me to claim “up to £3,450” after my “recent accident”.

This was news to me, considering I hadn’t been in an accident and my car was parked on the driveway undamaged. The logic of referring the contact details of people who have been in a crash makes sense despite it being morally destitute, although how they intended on securing me a payout without so much as a bump occurring seems very peculiar.

The system is fiendishly simple yet ludicrously expensive, creating a vicious circle which is making insurance ever more expensive. After a collision or a bump, a motorist must contact their insurer to inform them of the incident and detail any damage to the vehicle.

The insurer then passes on the contact details of the claimant, irrespective of whether any injury has occurred, to a no win, no fee firm, in return for a ‘referral fee’. This fee can be anything from £200 to £1,000 per case, giving a huge incentive for companies to pass on the information. Jack Straw has called for the banning of these fees to halt the rapid rise in premiums.

This system has led to spiralling insurance costs for everyone in the country. The multitude of comparison sites, deals and discounts only serve to confuse customers and disguise the rising cost of insurance. The statistics are truly shocking. The number of claims companies has doubled to 3,400 over the course of just two years, while the total cost of personal injury claims has doubled to £14 billion in ten years. This is at a time when cars are the safest they’ve ever been, vehicle crime has dropped and there are around 30% less accidents than in the late 1990s. Yet premiums still rocketed by 40% from 2009 to 2010.

Apart from the scandal of artificially high premiums supported by these dodgy practices, the passing on of personal contact details without your express permission needs to stop. We have received numerous calls from concerned people who have been bombarded with unsolicited calls and text messages at all hours of the day and night. This is a gross intrusion on privacy, especially considering it is purely for the financial gain of the claims firms, who have no real interest or consideration for the wellbeing of those in accidents.

When questioned on whether he thought it was morally acceptable behaviour, Nick Starling of the Association of British Insurers attempted to excuse it by claiming a variety of groups are doing it including the police, breakdown firms and garages as well as insurers. Basically, “We’re all at it”, despite the fact that whiplash cases cost insurance companies a shocking £2 billion.

Clearly the majority of this is suspicious, as the total cost of whiplash treatment to the NHS is £8 million, while it is notoriously difficult to diagnose. It seems odd that the insurance companies, ostensibly losing money as a result of these claims, have not campaigned and lobbied harder for the referral fees to be banned.

Law Society president Linda Lee said:

"Referral fees hinder access to justice, contribute to rising costs in the justice system, and go against the interests of the consumer. We have always argued for a total ban on referral fees. Jack Straw believes they should be banned, Lord Justice Jackson in his recent report on costs believes they should be banned, and now even the insurance industry agrees they should be banned. The government needs to wake up and take immediate action."

This morning Justive minister Jonathan Djanogly criticised the payment of referral fees, but refused to guarantee the government would ban them. It is possible that the police use them to top up their finances, creating a disincentive to banning them. These forms of behaviour from insurers as well as the police need to stop; the government should reconsider banning referral fees outright.

 UPDATE: Axa have announced this afternoon they will no longer accept referral fees in personal injury claims. Hopefully they will be the first of many.

 

Frank Manning tweets at @BillyManning

Welsh Assembly Member suggests fingerprinting every single schoolchild in Wales

The sage of the school playground, Welsh Assembly Member Joyce Watson, has decided the process of getting lunch at schools in Wales is far too simple and it therefore requires fingerprint technology in every school canteen around the country. Her justification stems from the potential for embarrassment for children from poorer backgrounds in Welsh schools.

Supposedly some children from families with financial difficulties had previously felt stigmatised as their peers knew they were receiving free meals due to a ticketing system. Her solution to this problem simply beggars belief.

Ms Watson has suggested installing a fingerprinting system at every school in Wales, at a cost of at least £30,000 per school plus annual maintenance costs of £2,000.

In the middle of the largest international financial crisis seen for decades, it is absolutely shocking that an elected Assembly Member could consider this an effective use of taxpayers’ money.

Stephen Jones, the head teacher of Ysgol Glan-y-Mor in Burry Port, Carmarthenshire came out with this outlandish comment:

“The children like it. It's almost a fun element to having their lunch, the fingerprints. It's much quicker so they're happy about that.”

“The offshoot, I suppose, would be that parents can actually have computerised printouts of all the food and drink that their children consume and they can keep an eye on whether they're having a healthy diet or not.”

An alternative way of viewing it would be an effective method of brainwashing children into volunteering their biometric data without a second thought. Parents are also invited to spy on the diets of their children, an odd concept which many people may find intrusive and offensive.

The pernicious accumulation of biometric data in schools around Britain seems to continue despite constant complaints from parents and children. Pupils from poorer families should not be bullied for their financial circumstances, but there are a variety of other ways this problem could be solved.

A simple, cheap key card system would serve the same role without the excessive cost of £30,000 per school and the invasive use of fingerprint technology. Alternatively, an effective policy of dealing with bullying would remove the need for any kind of technology in school canteens.

There will be a debate in Cardiff bay on Tuesday 28^th June about the introduction of these systems, Big Brother Watch has received a number of complaints from concerned parents in Wales and a petition is currently circulating to raise awareness and express concerns about this ludicrously disproportionate method of providing children with lunch.

Links of the day 22nd June 2011

Please note these are articles and opinions we found interesting, however they do not necessarily represent the views of Big Brother Watch

Ed Miliband and David Cameron clash over DNA legislation

UK banks unaffected by European data breach crackdown

Police database to tackle intelligence failings

US plan to hold EU passenger data for 15 yrs 'unlawful'

 Commissioner orders disclosure of names of public sector workers earning over £150,000

Alleged LulzSec hacker still inside

MP calls for limited in-car smoking ban

LulzSec disavows alleged Census hack

 

Canadian privacy commissioner issues warning about smart phone and WiFi data collection

The Canadian Information Commissioner Ann Cavoukian has this week issues a warning to consumers about the risks associated with personal smart phones and other devices automatically collecting data on the user's location.

In a report published by her office, Cavoukian argues that privacy should be designed into these systems in order to avoid mobile operators and third parties building up vast logs of information about an individual's personal movemnents without their prior consent.  At present, the majority of people are unaware of the privacy implications of much of the technology they carry around in their pocket.

There is a reasonable expectation, when one uses a mobile phone, that their operator will from time to time assess their location in order to determine factors such as localised signal strength, yet there is no need for such information to be logged on an ongoing basis - just as it is at present.

You can view the full piece here.

Cavoukian's comments are a welcome contribution to the debate and will, one would hope, raise public awareness of this issue.  Only by increasing public awareness and concern surrounding this issue will mobile operators see a worth in adopting privacy concerns as a key business consideration.

Internet Eyes lambasted for failing to encrypt CCTV footage

Big Brother Watch has long had concerns about Internet Eyes, the website allowing armchair voyeurs to monitor private CCTV cameras from the comfort of their computer. Back in March one of the first schemes in three outlets of Budgens in Norfolk was shut down barely a week after it launched after concerned customers complained to the shop owner about the intrusive system.

The Information Commissioner’s Office (ICO) have now lambasted the site for allowing unencrypted footage from their cameras to end up on YouTube. Because the site does not track viewers’ activities, it is impossible to identify who is responsible for uploading the video. After an investigation from the ICO, they discovered that Internet Eyes did not encrypt any of the video on the site. They have now demanded that all images are encrypted and all viewer activity is monitored to ensure CCTV footage is not transferred to other websites.

In addition, from 31^st July no viewer will be able to access footage from cameras located within a 30 mile radius of their registered location in an effort to stop people viewing their neighbours.

Ever since its inception, Internet Eyes has been fraught with crisis after crisis, upsetting privacy groups, the ICO and the general public. It is a terrible idea which should never have seen the light of day. Big Brother Watch and the ICO will continue to monitor their activities to ensure no further abuses occur with the footage.

ICO Deputy Commissioner David Smith said:

“CCTV footage should not end up on YouTube when it shows someone simply out doing their shopping. A person’s CCTV image is their personal data. The law says that it should only be disclosed where necessary, such as for the purposes of crime detection, and not merely for entertainment.”

Daniel Hamilton, director of Big Brother Watch released the following comment:

“Today's ruling does little to address fundamental concerns many have about this system and its impact upon personal privacy. It's fundamentally wrong to hand untrained and unaccountable voyeurs the power to monitor CCTV images. This should be left to trained professionals.”

Links of the day Monday 13th June 2011

Daniel Hamilton: It’s time to defend our freedom and lift this ban

Toxic Plankton feeds on Android Market for two months

Royston's ANPR surveillo-plan goes to ICO

Labour and liberty: Do the rights thing

Taxman recruits tax-collecting robots

Turkey arrests Anonymous suspects after DDoS protest

Facebooking juror heads for trial

Hacker criminals plant fake news to discredit security researchers

Links of the day Monday 6th June 2011

Please note these are articles and opinions we found interesting, however they do not necessarily represent the views of Big Brother Watch

Top websites leaking our data to third party players

European Union "cookie" regulations are criticised

Airport security misery

Gov fails to have knowledge of itself on websites

Apple hit by new competition complaint as iCloud launches

Google acting as a 'political tool', says China

New Android app allows automated WiFi cookie intercepts

Eden's CCTV cameras switched off to save money

PSN hacking aftermath: Sony "Welcome Back" free gifts now available

Is the Olympic cultural events database being kept on an unsecured Excel spreadsheet?

A report on The Register has found a job vacancy on the London Organising Committee of the Olympic Games (LOCOG) website which seems to suggest that the organisation’s entire cultural events database is stored on a simple Excel spreadsheet.

The job description states:

“The majority of the Team and Database Administrators work will be to work with the Senior Operations Manager, and Business Manager, in management of the central cultural events database (held in excel)”

Any large-scale projects which involve computers and governmental organisations inevitably seem to end up in disaster in the United Kingdom, after well known problems with schemes such as the NHS database being a prime example.

After being questioned on the matter, LOCOG released the following statement:

“The document you're asking about is just a simple list of information relating to events, it's a tracking tool not a database. ExCel [sic] spreadsheets are a common corporate tool and we use them as and when appropriate.”

“Where data is of a more sensitive nature then we impose stronger security measures and platforms according to the risk profile. Information security is of the up most importance to LOCOG and we are confident that our data is held securely with the stringent security procedures we have in place.”

If there is any truth to this story; it is a catastrophe waiting to happen. This much data, some of it very sensitive, stored on a simple spreadsheet, could potentially be hacked or stolen leading to a massive data loss.

For the extended story, click here

The government must lift the ban on using intercept evidence

Regular visitors to the Big Brother Watch blog will be aware that BBW has long campaigned for a change in existing laws to allow intercept evidence to be used in terrorist trials.

Big Brother Watch Director Daniel Hamilton has today outlined the case for the ban to be lifted in an article for the Total Politics magazine's 'The Idea' feature:

"As long as the ban on the admissibility of intercept evidence remains in place, so do the many strange anomalies connected to it. While British courts cannot hear domestic intercept evidence, they frequently secure convictions based on overseas intercepts. Similarly, British intercepts can be used in prosecutions taking place overseas. While a conversation recorded on a hidden bug is admissible in court, a recorded phone call or intercepted email is not.

"To date, the government has opted to set aside fundamental privacy concerns in order to pursue the IMP. Such a programme, the British public has been told, will “make us safer”.

"Given that the majority of terrorist offences are committed by small groups of individuals, often operating outside the confines of mainstream society, it’s difficult to see how the IMP could possibly be successful in achieving that objective. Pinpointing terrorist activity among a database of billions of unique communications is akin to searching for a needle in a haystack. All the IMP achieves is the creation of the most invasive and intrusive database in history."

You can view the extended piece here.

Links of the day Friday 27th May 2011

Dominique Lazanski: How the EU 'cookie' directive is impacting the UK

Patriot Act surveillance provisions extended in nick of time

Kenneth Clarke data protection speech

Civil rights group calls for standardised European copyright laws

Google wants you to leave your wallet at home to get LBS discounts while you shop

Ratko Mladic arrested: Europe's most wanted man seized in Serbia

Dan Hodges - Creating a landslide

Shane Greer – Lock 'em up

Devizes' CCTV cameras face funding shortfall

 

Links of the day Thursday 26th May

Russia's occupation of Georgian territory must end

Instant View: Mladic's arrest is a historic moment for Serbia and for Europe

Thieves paint over CCTV cameras to steal eight tonnes of clothing from Fenland compound

Co-op error as 82,000 clients' data published online

UK banks breaching data protection rules - Which?

Ken Clarke raises data protection fears

Cookie law set to shake up UK websites, but won't be enforced for a year

US to hold details of British air passengers for 15 years

Fife police defend use of CCTV after high 'Big Brother' ranking

ICO delay enforcement of EU Privacy Directive

The long-awaiting EU Privacy and Electronic Communications Directive which was expected to come into force today has descended into farce as the Information Commissioner’s Office have announced companies have an entire year to comply with the regulations.

The directive is designed to regulate the use of ‘cookies’ on websites, stating that “explicit consent” must be sought and collected from all internet users to download them onto their computers. These cookies are text files which store browsing information and allow marketing companies to use targeting adverts which are far more profitable that standard advertisements.

Although the directive is now in effect, the ICO has agreed not to enforce it until May 26^th 2012. They warn companies that they will monitor progress throughout the year to ensure efforts are being made, although it seems unfeasible that an organisation can scrutinize thousands of websites over the course of the next 365 days. After the 12 months are up, companies who have failed to implement the legislation could be punished with fines up to £500,000.

Christopher Graham, the Information Commissioner said:

"The implementation of this new legislation is challenging and involves significant technological considerations. That's why we've already consulted a wide range of stakeholders.

"But we want to spread the net as wide as we can and would welcome further comments from others who have practical examples to share. This advice is very much a work in progress and doesn't yet provide all of the answers."

"Organisations and businesses that run websites aimed at UK consumers are being given up to 12 months to 'get their house in order' before enforcement of the new EU cookies law begins. This does not let everyone off the hook. Those who choose to do nothing will have their lack of action taken into account when we begin formal enforcement of the rules."

BT spies on the networks of their customers

BT officials have admitted to keeping tabs on the Local Area Networks (LANs) of their broadband customers. They claim to reserve the right to examine the networks of their broadband customers whenever they feel the information can improve the service they provide, or when the safety of their customers is placed at risk.

The practice was revealed last week, when BT contacted customers who were still using powerline networking (PLT) boxes which BT had discovered a manufacturing flaw in. The company had subsequently sent out replacements last October; however some customers had ignored the advice and continued to use the originals.

BT then sent out letters explaining that “remote diagnostic tests” had shown the potentially dangerous devices were still connected. Considering PLTs do not have an IP address to identify them by, the likely explanation is that BT runs a scan of Media Access Control (MAC) addresses from the main router. These are unique identifiers which help devices to communicate with each other on a network.

BT considers this process to be similar to Windows Update from Microsoft, but unlike that program it lacks an opt-out. There is a clear financial benefit for ISPs to have access to this information, as they can market certain products to customers based on what equipment they already have attached to their network. If they can identify useful products which aren’t connected, they can tailor their marketing towards these items. Alternatively, if for example an IP-capable TV is attached, they can advertise connected services which utilise this.

A statement from BT read:

“…there may be other circumstances in which we would carry out remote diagnostic tests of customers' equipment to make sure all is working. We don't believe that consent is necessary where the testing is necessary to the service that we are providing.”

The majority of everyday customers are unlikely to be troubled by this revelation, but those with concerns about privacy will wonder what BT intends to do with access to this sort of information, and how long it is stored for.

Links of the day: Tuesday 24th May 2011

Alex Deane: We must welcome the report of the Red Tape Taskforce as a step towards making volunteering less bureaucratic

Wikipedia founder opens new front in privacy battle

Identity scheme echoes ID cards, say campaigners

A whole new era for cookies begins tomorrow

Your guide to the EU Privacy Directive

Do-not-track off to a slow start, Mozilla adds support for Android

LinkedIn slashes cookie lifespan after research exposes security flaws

Exploited Hotmail bug stole email without warning

PlayStation Network breach will cost Sony $171m

Privacy, the Press and Twitter: some uncomfortable truths

Police hand over details of 30,000 people a month for costly ‘customer satisfaction’ surveys

This story slipped in under the radar recently, but it is important that it gets more exposure. Freedom of Information requests recently revealed that police departments in Britain are routinely paying marketing companies huge fees to carry out ‘customer satisfaction’ surveys. The cost of these surveys is around £1,000,000 per year.

Beyond the obvious complaints about taxpayers’ money being used for this rather than frontline policing, more concerning is the fact that the police are handing over the contact details of approximately 30,000 people per month who have been in touch with the police.

The practice was revealed after Jonathan Hall received an unsolicited phone call six weeks after calling 999 to report a violent altercation in Guildford. He was angry to discover that police had passed on his details to Bostock Marketing Group without his consent. Mr Hall, 24, from Hove in Sussex, said:

“A man who spoke very poor English rang me six weeks after the incident and asked how I had been treated by the police. I was stunned and wanted to know how he had got my details. He told me they had come from Surrey Police.”

After the call, he decided to submit FOI requests to fifteen police forces, and was shocked by the results. Surrey Police spent £108,000 on the surveys, only topped by the Metropolitan Police who spent £176,000.

A Surrey Police spokesman said:

“The Home Office requires us to carry out customer satisfaction surveys. Satisfaction levels have risen to 85 percent because we listen to feedback and act on it.”

While it may be beneficial for police to receive feedback on their performance, it is unacceptable for them to pass on the details of 30,000 innocent people every month to market research companies without their express permission. This needs to stop now.

Links of the day Monday 23rd May 2011

3.2 million records on police database

Cloud computing: Hidden danger to everyone's civil liberties? Exclusive

Websites risk breaking 'cookie' law

School toilet camera plan ‘under review’

Coalition plans to enlist private firms to speed ID authentication

ICO launch Information Rights Strategy

Where is your data?

Research team moves towards on-site DNA fingerprinting

99.7% of Android mobile phones vulnerable to data leak

Following on from the concerns regarding location data in mobiles, new evidence discovered by German security experts at the University of Ulm has indicated that up to 99.7% of phones with the Android operating system are vulnerable to a serious data leak. Using an ‘impersonation attack’, hackers can access phones and view, modify or delete calendars, contacts and private pictures.

With the market share of Android rapidly expanding, and more than 400,000 Android phones activated every day, the potential risks for this leak are huge. Considering a vast amount of these phones are for business and corporate use, there is also the potential for industrial espionage or blackmail.

Hackers can exploit this loophole by stealing authentication ‘tokens’ used to identify the phone, then using this information to log on to websites as the legitimate owner, without their knowledge.

In a blog on the university website, the researchers explained:

“The adversary can gain full access to the calendar, contacts information, or private web albums of the respective Google user.”

“An adversary could change the stored e-mail address of the victim’s boss or business partners hoping to receive sensitive or confidential material pertaining to their business.”

Mark Evans, director at IT services provider, Imerja, said:

“That such an enormous proportion of Android phones could potentially be leaking users’ personal data is shocking. Mobile devices are increasingly used for business, more so than laptops, and their security is essential to protect organisations against data breach or other ill-intentioned activities.”

“The message to companies is clear; mobile devices must be properly secured. They should be implementing robust and enforceable security policy structures to support effective mobile working, such as encryption.”

A spokesperson for Google said:

"We are aware of this issue, and have already fixed it for calendar and contacts in the latest versions of Android. We are working on fixing it in Picasa.”

Unfortunately, not all Android phones can be updated to the latest version (2.3.4.) and over 99% are still using previous versions, so the threat is still very real. Although the researchers did not find evidence of hackers utilising the leak yet, it seems inevitable that they will in time.

Google needs to ensure all versions of the operating system are secure against this risk, and all phones are updated automatically as a matter of course to avoid a privacy catastrophe which will rival the recent Playstation Network incident in terms of scale and scope. In the meantime, the Daily Mail lists some suggestions on protecting your Android phone.

Does the UK need a privacy law?

Over the past few days there have been fervent discussions in British newspapers about the future of privacy laws in the United Kingdom. 

The arguments both in favour and against introducing a privacy law have been predictably emotive, the Guardian mentioning the allegations of foul play leveled against Kate and Gerry McCann as a reason why such a law is needed, while the Daily Mail have referenced the case of Dominique Strauss-Kahn as grounds for why Britain should "never" impose privacy legislation.

Angus McBride in The Guardian, arguing in favour of a privacy law, argues:

"It is said that only the rich and famous have access to the law. But it is generally the rich and famous that are of interest to the prurient press, so are more likely to require the protection of the courts. And is there really a public interest in the private lives of footballers or entertainers? What right do we have to pry behind their bedroom doors?

"In any case, is not the real scandal that ordinary members of the public without access to football-sized wage packets do not have protection against the power of the press? Legal aid should be available to those without the means to hire expensive lawyers.

"...I am reminded reading Kate McCann's deeply moving book that on their return from Portugal, having been declared suspects in their daughter's disappearance, Gerry and Kate McCann asked me to visit newspaper editors to explain that there was no truth in any of the allegations made in the more scurrilous parts of the Portuguese press, and that the material was the product of vindictive leaks. I explained to each editor that uncorroborated evidence from a sniffer dog and inconclusive DNA (which could have been attributable to any member of the family) found in the boot of a hire car driven by the McCanns created not even a prima facie case... Bile-infested internet comment on the McCanns was fuelled by this early reporting, and continues to this day."

In contrast, the Daily Mail's Stephen Glover says:

"The super-injunctions issued on behalf of footballers do not in themselves greatly concern me. The question is where they are leading. We should be concerned by the orders being handed out by judges to shield more significant public figures. If this process continues, in a few years’ time we will find ourselves with the kind of privacy law that has protected Mr Strauss-Kahn.

"Where there is evidence of sexual impropriety, it is usually a safe bet that evidence of other impropriety will follow. It does not at all surprise me that Mr Strauss-Kahn was once forced to resign from the Socialist Party over a financial scandal, though he was later acquitted.

"I don’t want people like him thriving in British public life, doing virtually what they please in the knowledge that they cannot be written about in the Press."

Big Brother Watch supporters are unlikely to have a united position on this issue.  Do post a comment letting us know what you think.

Big Brother Watch is hiring...

Just a reminder, following the posting of our advert a couple of weeks ago, that Big Brother Watch is looking to hire a new Research Director / Head of Research.

Candidates must:

• be unafraid to challenge orthodoxies or authority.
• have experience of leading research projects, including awareness of the Freedom of Information Act.
• be able to work under pressure and be part of a dynamic national campaigning team.
• have a excellent knowledge of national and regional media and politics.
• be sympathetic with the aims of Big Brother Watch.
• be confident and competent in oral and written communication.

Click here for more information about how to apply.

Police 'Geotime' software to track suspect movements

A report published by the Daily Mail this morning has highlighted the fact the Metropolitan Police have ordered a software package called 'Geotime' - "a security programme used by the U.S. military which tracks suspects' movements and communications and displays them on a three-dimensional graphic".

The software, which will be trialled in London before any decisions are made about its use across the UK, brings together information from social networking websites such as Facebook, financial transactions and mobile 'phone records in order to present an in-depth picture of an individual's movements.

While the BBW team are not luddites and are indeed keen to see the Police adopt new technology in order to fight crime, their decision to adopt technology designed for theatres of war in order to track members of the public is deeply concerning.  Quite simply, the ability to build up such a comprehensive record of any person's movements represents a significant threat to personal privacy.

It is crucial, if this technology is to be rolled out further than London, that Police forces reassure the public that this technology will be used in only the most serious of cases, not as a tool to help solve low-level crimes.

Devon and Cornwall Police may be forced to reveal locations of ANPR cameras

Devon and Cornwall police are fighting to keep the locations of their fleet of Automatic Number Plate Recognition a closely guarded secret, despite a landmark ruling demanding they release the information within 35 days. Senior officers have used the excuse that exposing the information would put the public “at risk” and affect investigations into organised crime.

Steven Mathieson, the news editor at Guardian Government Computing sent a Freedom of Information (FOI) request in July 2009 asking for the location of the cameras. The police force refused, claiming that revealing where they had been placed would "be likely to prejudice the prevention of crime”. Mr. Mathieson then appealed to the Information Rights Tribunal, which found in his favour last month and decided on the 35 day limit for disclosure. Their ruling stated:

"The tribunal considers that there was, overall, a weak case made by the additional party (Devon and Cornwall Police) as to why it thought that disclosure of the information sought would be likely to prejudice policing."

"The tribunal considers that in all the circumstances, the public interest falls on the side of disclosure in this case, so as to allow for debate about the strategic use of the cameras and the reasons for their deployment."

The police consider revealing this level of detail to be “frankly ridiculous” and may put the public at risk, but they offer no explanation as to why. The 69 ANPR cameras under the control of Devon and Cornwall Police have recorded the movement of almost 79 million vehicles in the last year alone. This data is then stored on a central database for years, allowing mass surveillance of millions of innocent people. Despite the concerns of MPs and civil liberty groups such as Big Brother Watch, the police still insist on expanding the network by stealth. A spokesman for Devon and Cornwall Police said:

"The force believes that revealing the exact location of ANPR sites will seriously reduce their impact as a crime fighting tool in identifying suspects and offenders. There is no doubt that since the advent of ANPR the police's ability to proactively target criminals on the road network has increased dramatically.”

"Showing a criminal the exact location of a camera will make those cameras easier to avoid and thus make capturing criminals more difficult. While the force accepts the need for transparency and the public's right to information whenever possible, revealing the location of covert policing resources goes far and beyond this."

This ruling could potentially change the landscape of CCTV in the country. Residents have been relatively unfazed by ANPR cameras so far, largely because they have been installed quietly with little fanfare and virtually no public consultation. If all police forces around the country are forced to reveal the quantity of cameras and their locations, detailing the giant network that now exists to track the movements of tens of millions of innocent people, public opinion may force the police to stop the proliferation of cameras. Devon and Cornwall Police are now looking to challenge the ruling in the Court of Appeal, while ultimately the legal battle could reach the Supreme Court. We will be watching developments closely.

One Year On: The Coalition and Civil Liberties

Big Brother Watch has today (11th May) released a research paper outlining the progress the Coalition Government has made on civil liberties issues during its first year in office.

The paper concludes that, while real progress has been made, many of the Coalition's promises to roll back the power of the state remain unfulfilled.

Click here to download the report

Commenting on the report, Big Brother Watch Director Daniel Hamilton said:

"The Coalition has some real achievements to speak off. 

"Ministers should be congratulated for taking steps to scrap ID cards and remove the profiles of the one million innocent people held on the national DNA database.   They should also be praised for doing away with the ContactPoint database of children’s details and reforming the criminal record check regime.

"They do, however, have more work to do. 

"Police stop and search powers remain in place, Control Orders remain virtually unreformed and there has been no opt-out from the European Arrest Warrant.  When it comes to E-Borders, the Summary Care Record and Intercept Modernisation Programme, they have continued to implement the previous government’s policies – warts and all." 

TomTom sell location data to Dutch government

The GPS system manufacturer TomTom have received widespread criticism in the past few days due to selling location data to the Dutch government for a profit. This has coincided with TomTom reporting first quarter net profits of £9.6million, up from £2.7million in the same period a year later.

In recent years TomTom have including location monitoring devices in their products, supposedly to improve the directions it suggests to motorists by adjusting routes due to traffic and average speeds. Few would have thought this information would be sold on to authorities, but this is what TomTom have been forced to admit.

The location data was aggregated and sold on to the Dutch authorities, who passed it on to police to ensure speed cameras were in areas with the highest potential for revenue making. Supposedly TomTom thought the data would be used to help the government understand causes of congestion and accidents. However, the police did not consider this to be cost effective, so they came up with the idea of using the data to set targeted speed traps, which has angered users.

TomTom have denied having previous knowledge that the data would be used as a means to creating higher revenue by police. They said:

“We make this information available to local governments and authorities. It helps them to better understand where congestion takes place, where to build new roads and how to make roads safer.”

“We are now aware that the police have used traffic information that you have helped to create to place speed cameras at dangerous locations where the average speed is higher than the legally allowed speed limit. We are aware a lot of our customers do not like the idea and we will look at if we should allow this type of usage.”

The market for personal navigation devices is expected to shrink by at least 15% in 2011 due to a combination of global recession and competition from substitutes such as smartphones and tablet computers, which contain software that performs the same tasks. TomTom considers the sale of location data to be a potential revenue stream to offset the fall in sales of GPS hardware products, which are far more profitable than software.

After a variety of recent revelations concerning location based products such as smartphones and now Sat Navs, people should be aware that any and all products with GPS functions have the potential to track your movements. Even if the companies involved do not pass the information on to other authorities, there is always the possibility of an online attacker being able to steal this data, as has happened with Sony’s Playstation 3 in the last month.

Where does the information from your mobile phone go?

The recent revelation that iPhones store personal geolocational data shouldn’t really surprise anyone, but Big Brother Watch has discovered some evidence of the potential uses of this information. Firstly, we hear the story of Green Party politician Malte Spitz in Germany, who sued his network provider Deutsche Telekom to force them to hand over six months of his phone data. He then passed this on to Zeit Online, a German website, who combined the geolocational data with readily available information from online resources such as Twitter, blog entries and websites.

What they have created with this data looks like something out of the film Enemy Of The State. The video shows where Mr Spitz was at all times, how many phone calls he made and received, how many text messages he sent, how long he spent on the internet, and what he was doing at those locations. They opt not to show the content of his text messages, but obviously they are also contained within the data his network possessed. The government can request this data for a variety of security-based reasons, and any hacker who can bypass the online security of mobile networks can easily access it. Is the usefulness of Google Maps worth wilfully disclosing this information?

Meanwhile, in Michigan, USA, the American Civil Liberties Union (ACLU) has uncovered the use of data extraction devices by police. Designed by an Israeli company called Cellebrite, it can extract location history, text messages, call history, photos, videos and user passwords, even after deletion, from over 3,000 types of mobile phones. The Michigan State Police have been using it to collect information from the mobiles of people they question for traffic violations. They were forced to reveal the purchase of these devices due to a Freedom of Information request from the ACLU, but they have claimed that due to the costs of retrieving and assembling the relevant documents, the ACLU must pay $272,340 before they disclose any information about them, and $544,680 to reveal how all five of the devices are being used.

Mark Fancher, a staff attorney at the ACLU, said:

“Transparency and government accountability are the bedrocks of our democracy. Through these many requests for information we have tried to establish whether these devices are being used legally. It's telling that Michigan State Police would rather play this stalling game than respect the public's right to know.

"We should not have to go on expensive fishing expeditions in order to discover whether police are violating the rights of residents they have resolved to protect and serve.”

There is no legitimate reason for a police force to be secretly collecting the data from mobile phones. This would not be permissible as evidence in court, so who sanctioned their purchase, and what use did they have in mind? Big Brother Watch is extremely concerned that these devices will turn up in the UK. When the media is full of stories relating to phone hacking, this represents a dangerous incursion into private information. We will be campaigning to have these devices pre-emptively banned in the UK. No police force should have unauthorised access to the personal phone data of innocent people.

Your iPhone is tracking your movements

A report on The Atlantic today has brought our attention to the investigation carried out by a group of security researchers into secret files held on Apple iPhones.  According to the report, researchers have uncovered a hidden application which contains "the latitude and longitude of the phone's recorded coordinates along with a timestamp" of every location a user visits.  Anyone who has been using the Apple 4 operating system will have a one-year-long log of their movements stored on their phone already.

iPhone users will rightly be concerned that their movements are being covertly monitored in this way. 

It goes without saying that people ought to be able to move around freely without accumulating a digital record of all their movements.  There is significant scope for this kind of technology being used for malign purposes.  It could, for example, be accessed by jealous spouses or business rivals keen to know someone's location at a particular time. 

While it is a disgrace that iPhones were pre-loaded with this software in the first place, it ought to now fall on the company to provide its customers with information about how to either delete or permanently disable the application.

ICO: We don't need to use our "big stick"

At Big Brother Watch, we've long been critical of the repeated refusal of the Information Commissioner Christopher Graham (a very nice man) to use the powers he has to prosecute those who violate the UK's data protection laws. 

In an article published today on Public Service Online, the Commissioner stated that the "big stick is there, but doesn't need to be deployed all the time to have an effect".

We disagree.

The Information Commissioner has proved himself to be hugely effective at policing public bodies who fail to discharge their obligations under the Freedom of Information Act - naming and shaming the worst performers, from central government to local authorities.  He has also demonstrated an occasional willingness to get tough with organisations who lose sensitive personal information (the example of the large fine handed to Ealing and Hounslow Councils recently being one such example).

He has not, however, been pro-active in taking action to protect members of the public from online privacy infringements.  In particular, he refused to pursue what he termed "knee-jerk" action against Google after they collected sensitive personal information from the home WiFi systems of thousands of people and has yet to pick a fight with any of the numerous online shops who have irresponsibility leaked client information.

While we appreciate the ICO is attempting to take a softly-softly approach in order to achieve long-term incremental improvements, he has his "big stick" for a reason.  Occasionally, he needs to hit someone with it.

Southwest Ambulance involved in data theft

It has been revealed that a former employee of Southwest Ambulance in Arizona took the patient records of 581 people, including their names as well as their financial and medical information. The records were subsequently recovered and the affected customers were made aware of the data breach.

The data theft was discovered when a landlord cleared out the employee’s residence after they had moved out. According to the company, the records had been taken over the course of a number of years, and used primarily for training purchases. However, Southwest Ambulance have refused to disclose anything about the employee, including whether they left the company before or after the incident was discovered. In a bid to rectify the situation, Southwest have agreed to pay for credit-monitoring services for customers affected by the data breach.

Company officials claim there is no evidence that the stolen information was shared with any third parties or used inappropriately, although there is always the threat of targeted ‘phishing’ attacks. Holly Walter, spokesman for Southwest Ambulance, said this:

"We found nothing to indicate those records were used inappropriately,"

The company consider the breach to be an isolated incident, and assured customers that they regularly train their employees in how to handle and protect sensitive medical information.

It is shocking that someone involved in healthcare could abuse their position in this way. People have a right to expect their confidential financial and medical information to be kept safe.

Teaching union slams "luddite" opponents of pupil fingerprinting

The Association of School and College Leaders (ASCL) have claimed that the much-needed controls on biometric systems and CCTV in schools are a “Luddite Solution”.

The new legislation will require the written permission of both parents, plus any other person with parental responsibility for a child. Without this, schools will be unable to use a biometric system on children.

ASCL general secretary Brian Lightman said:

"ASCL completely agrees that parents should have a say in whether their children take part in biometric systems in schools, and they should have the right to opt out if they have concerns or are opposed in principle.”

“However, if the bill goes through, the hoops that schools and colleges will need to go through to use these systems will be completely disproportional. The reality is that in the next few years, we will be using finger recognition to log onto our laptops. This is the future and it is already in one in every three secondary schools. To enact this legislation is a Luddite reaction and a huge backward step."

A spokesman for the Department for Education (DfE) said:

"We've got no problem with heads using the latest biometrics to speed up lunch queues or registration - that's their choice. The bottom line is that parents should have the right to opt their children out if they are concerned about its use. Biometrics is always a sensitive issue - the onus should be on schools to explain and persuade parents of these systems' merits. You can't assume families will just go along with whatever a head says, when it comes to using and storing their children's personal data. It's common sense that alternative systems are available for those who those that want it."

Biostore Solutions claim that in the schools which use biometrics, 99.8% of parents have no objection to it being used on their child. This seems an extremely suspicious statistic, especially considering it comes from a company with a huge conflict of interest. In fact, the statistic does not come from a survey of parents; instead it is based on the number of pupils who refused to take part in the system. Most pupils will have been subjected to a huge amount of pressure to accept the system from teachers who they are taught to respect.

Without this legislation, schools will install hugely intrusive biometric systems and CCTV cameras to monitor the movement of children without the permission of parents, who may not even know about the systems. The government is right to make these changes, and should ignore the complaints of the ASCL.

Privacy and the Unique Learner Number system

By James Hargrave, a prison administrator

A Unique Learner Number (ULN) is a 10-digit identifier that will eventually enable any student over the age of 14 - in England, Northern Ireland and Wales - to build a lifelong record of their learning achievements.

ULNs are issued and held by MIAP's (Managing Information Across Partnerships) web-based Learner Registration Service (LRS).”

Most people don’t even know they have one. But as of a few years ago every child in the British education system will have been allocated one, and if you’ve engaged in any adult learning recently you’ll have one too.

On this national database all your education records can now be seen by anyone who has access. A fully populated Learner Record will show your literacy and numeracy levels, employment and training you have engaged in and your grades from examining bodies.

They even create one now when you apply for a passport. Although these records are badly populated at the moment (because the system is still being rolled out) a fully populated one would contain your date of birth, address, nationality and educational records.

The way the system has been designed is supposed to maintain a level of anonymity, in that you would not necessarily be able to tell where someone received their qualification. However as a caseworker in Prisons who has to use the database to update education records I can tell you that you very quickly notice the patterns.

I can also say that because the system uses postcodes (which are subject to change) as a way of identifying individuals it is far from full proof. Individuals regularly end up with more than one profile and as such can end up with partially populated records. Half of your qualifications could end up on one profile and the other half on another.

Furthermore as the administrators who use this service do not often know a clients postcode (or in my case my clients often don’t have one) a default one is used (ZZ999ZZ) instead. Therefore if you have a common name there is every chance that mistakes will be made and the wrong record could be updated.

On the face of it this may not sound like too much of a problem but as the service expands and colleges (and possibly employers in the future) rely on the information on the LRS it will be increasingly important to ensure the information is accurate. At the moment it rarely is.

At a time when so much of our information is on display somewhere do we really want this kind of detail so readily accessible?

Six year old girl frisked by airport security

It has been a little while since Big Brother Watch last reported on airline security officers and the intrusive procedures government rules force them to carry out on members of the public before they are allowed to undertake air travel.

Regrettably, a supporter has been in touch this afternoon to alert us of the case of six year old Anna Drexel who was forced to undergo a body-search at New Orleans airport.  According to a news report published in The Telegraph, the child was left upset and confused following the process. 

Cases like this only serve to illustrate the increasingly irrational approach airport staff are forced to take towards airline security.  Common sense should surely dictate that a six year old child should not be subjected to such an intrusive procedure.  After all, as the mother of the girl in question said, such searches are "inappropriate for children because they are usually told not to let adults touch them in sensitive areas". 

Hat-tip: JS

Microsoft launch Streetside website

Over the past few days, Big Brother Watch has received many enquiries from the press and members of the public regarding Microsoft's new StreetSide service.  While Microsoft are taking a slightly different approach to the Google StreetView service, the two websites will appear virtually indistinguishable from one another to most users.

While services like Streetside and Google Street View can undoubtedly prove useful, they can also pose a significant threat to personal privacy.  Our concerns about the nature of this technology were not helped by the discovery late last year that Google had captured passwords and credit card information from WiFi networks while establishing the Street View service.

It's very early days, but we are encouraged that Microsoft has taken concrete steps to engage with privacy groups such as our own and Privacy International to ensure that public concerns about the risk of the system being misused are fully taken into account.  Microsoft must work diligently to ensure they don't repeat Google's mistakes.  That means ensuring personal data cannot be captured by its recording devices and operating a transparent process through which people can remove images from the website if they so wish. 

The proof of the pudding will be in the eating.  Big Brother Watch... will be watching!

The NHS breaches public trust... again

Two UK healthcare bodies have received serious warnings from the Information Commissioner’s Office after the mishandling of paper records led to breaches of the Data Protection Act. NHS Liverpool Community Health lost papers relating to the medical history of 31 children and their mothers when they moved premises in October 2010. After a full investigation, the ICO ruled that NHS Liverpool had failed to enter into a contract with the removal company to organise the handling of personal data. In addition, no processes had been created to ensure the data being moved was secure.

In an unrelated incident, the Council for Healthcare Regulatory Excellence (CHRE) were also found to be in breach of the Data Protection Act after a possible loss of documents from complaint review files, which contained sensitive personal data. The ICO was particularly unimpressed that due to the data management failings of the CHRE, they had no idea whether the data had fallen into the wrong hands, been lost or destroyed.

Sally Anne Poole, enforcement head at the ICO, said:

"These incidents highlight significant weaknesses in both organisations' data handling procedures. These incidents should act as a warning to other organisations who handle sensitive papers of the need to make sure their paper records management processes are as robust as their electronic data systems. The protection of data in all formats must be taken seriously."

Bernie Cuthel, the chief executive of NHS Liverpool, has signed a formal undertaking stating they will ensure written contracts are always in place with third parties responsible for the handling of personal data in future. Staff will also receive additional training on how to keep information secure when moving offices.

Harry Cayton, chief executive of the CHRE, has also signed an undertaking with the ICO, assuring them that all future information containing personal data sent between the data controller and regulators will be adequately protected.

We entrust health bodies such as these with some of the most personal and private data that exists about us, our medical histories, and we expect them to take their protection far more seriously in the future. These undertakings must be acted upon, and the ICO should monitor the behaviour of these organisations to ensure mistakes such as these do not happen again.

Millions of email addresses stolen from Marks & Spencer

The email addresses of millions of customers on Marks and Spencer’s database were stolen by hackers recently as part of a major data breach of the internet marketing firm Epsilon. Epsilon, who call themselves “the leading provider of multi-channel marketing services”, have 2,500 corporate clients worldwide and send 40 billion emails a year to their customers.

Files containing the names and email addresses of customers were accessed by unauthorized entry into their computer system. Tesco are also known to use Epsilon for their marketing, however they categorically deny that any of their customers’ details have been stolen.

M&S were forced to send an email to all their customers stating:

'We have been informed by Epsilon, a company we use to send emails to our customers, that some M&S customer email addresses have been accessed without authorisation. We wanted to bring this to your attention as it is possible that you may receive spam email messages as a result. We apologise for any inconvenience this may cause you. We take your privacy very seriously, and we will continue to work diligently to protect your personal information.’

M&S refused to release the amount of customers affected by the data breach. After realising the hack had occurred on April 4^th, Epsilon released a statement regarding the incident:

"A rigorous assessment determined that no other personal identifiable information associated with those names was at risk."

Coming after the recent debacles involving Play.com and Trip Advisor, it no longer seems possible to use the internet without seriously threatening the security of your information. As the hack is thought to have occurred on Epsilon’s American servers, the Information Commissioner’s Office are powerless to intervene.

Internet security expert Dr Stefan Fafinski, explained how spammers will use the information:

“Spammers will have a list of good, known and verifiable email addresses that comes straight out of M&S. Once they have names as well as email addresses, the spammers can personalise the emails they send out to look much more like a genuine company communication.”

Marks and Spencers has a diverse demographic of customers, many of whom will not be fully aware of the dangers of internet scams and ‘phishing’. For advice on how to spot these types of emails, visit www.scambusters.org

Royal Cornwall Hospitals Trust reprimanded by ICO

The Royal Cornwall Hospitals Trust has been reprimanded by the Information Commisioner’s Office (ICO) after it breached Data Protection rules twice in the last year. The first occurred in July 2010, when an individual received information relating to a different person when they submitted a subject access request. The second was in December 2010, when the very same person submitted a second subject access request, and again received information for a completely different person.

The ICO found that both events breached the Data Protection Act, and forced the chief executive of Royal Cornwall Hospitals to sign an undertaking to ensure that procedures for dealing with subject access requests are clearly defined and managed and that all staff receive the appropriate training and support in how to follow them.

Acting head of enforcement at the ICO, Sally-Anne Poole, said:

“More and more people today want to find out exactly what information their GP or hospital holds about them, making subject access requests an increasingly popular tool. However, just because staff are busy with requests, this does not mean they can stop doing adequate checks before information is sent out. I am pleased that Royal Cornwall Hospitals NHS Trust has agreed to take the necessary steps to make sure this sort of incident doesn't happen again.”

It is absolutely shocking that this NHS Trust managed to make an identical mistake to the same person twice. We hope they take the undertaking to improve their approach to data protection very seriously, and avoid making similar mistakes again. People have a right to expect their private medical histories to be kept secure.

Why you should conceal your face at protests and demonstrations

Guest post by A. Nonymous

The use of balaclavas and scarves has been branded in the mainstream press as anything from a signal of thuggish criminality, to a pathetic aspirational-revolutionary fashion statement. This kind of ‘analysis’ exposes the distance between so-called journalists and demonstrators. They really have no idea about the social movement taking place before their eyes.

Concealments such as balaclavas, scarves, and notably ‘V for Vendetta’ masks, are being used as political constructions – wearing them at demonstrations indicates a concerted meaning, not simply a by-product of criminality. We are intentionally striving to remain anonymous, and we have very good reasons why.

Kingston CCTV car snapped on double yellow line

In this week's Kingston Guardian there's an amusing story about a CCTV car which was captured parking on double yellow lines outside a Police station.   Residents rightly feel aggrieved that these expensive vehicles have the right to snoop on us at will also feel free to disobey the rules the rest of us must follow, for fear of being hit with extortionate fines.

A Kingston Council spokesman said: “Stopping on the double yellow line is permitted while undertaking enforcement. The CCTV vehicle was enforcing an appropriate restriction, where loading/unloading is not permitted on Kingston Hall Road.”

That's us told!  It's one rule for them, one for the rest of us...

Lancashire Police officers dismissed for breaching data laws

The residents of Lancashire, like most people in Britain, hope that the police are there to protect them. So they will be shocked and disappointed today to find out that dozens of police have been using police equipment to spy on their partners and neighbours for the last three years. There were a total of 84 beaches of data protection laws, which have led to 13 dismissals, 7 resignations and numerous final warnings.

The majority involved officers accessing police computer systems to view classified data about current or ex-partners, neighbours, family members and even the history of cars. This information was then utilised for personal gain or passed on to third parties.

In one of the most serious cases, a superintendent was alleged to have used the system to check the whereabouts of an ex-partner and information about her current boyfriend.

A spokesperson for Lancashire Constabulary said the force would always take

“...robust action to investigate when necessary. Lancashire Constabulary expects the highest standards of professional behaviour from all employees in relation to information security. The public rightly expect that we maintain the security and integrity of all information held on police databases and it is paramount that we maintain their confidence in our ability to do so.”

“We audit how our staff access information to ensure that it is for policing purposes and that they are using that information lawfully and appropriately. The misuse of police systems by any individual staff member will not be tolerated.”

This is a massive abuse of the trust of the local populace, and the fact that it involved so many officers, rather than being simply an isolated incident, makes it all the more worrying. Effective policing requires trust and communication between the police and the people they are employed to protect. If this breaks down, it can take years to rebuild the relationship. The Lancashire Constabulary website does not currently display an apology for the actions of these individuals, or even acknowledge that the breaches occurred.

BP loses the data of 13,000 oil spill victims

As if the oil spill which hit the US's Gulf Coast last year causing significant environmental damage and economic hardship for home and business owners wasn't bad enough, it has today been revealed that the details of 13,000 of the victims of the disaster have been lost by BP.

According to a report published on the Info Security website, full details are still emerging of exactly how the data loss occured but it appears likely that it happened following the loss of a company laptop.  Rather than encrypting the details of the 13,000 people whose information was held on the laptop, it appears that the computer was only protected with an easy-to-circumvent Windows password.  In specific, the laptop contained the details of those who had made claims to the company for financial compensation. 

Sadly, cases like this are all too common - be they the loss of personal medical information by the NHS at one end, or the compromising of the data of 7 million users of the Play.com website.  It is absolutely crucial that, in order to avoid mass data losses such as this, that information held on USB sticks or laptops is fully encypted so as to render it useless in the event is is stolen or misplaced.

You can view the whole story here.