'This is not my Black Wednesday'

Alistair Darling has today called the loss of two CDs of data containing the personal information of up to 25 million people "catastrophic", "unprecedented" and "unforgivable", adding that the incident had shaken his confidence.

But the chancellor insisted today wasn't his "Black Wednesday".

The government yesterday disclosed that the personal records of 7.25 million families claiming child benefit, including individuals' dates of birth, addresses, bank accounts and national insurance numbers had been lost in the post, opening up the threat of mass identity fraud and theft from personal bank accounts.

They went missing in the internal post after a junior official at HM Revenue & Customs in Washington, Tyne and Wear, breached all government security rules by sending them by courier to the National Audit Office in London.

A frantic, secret police search was launched but it failed to locate the discs, containing information on half the British population.

In a round of interviews this morning, Darling said that the police had spoken to the people responsible for the loss and that as far as was known there was no indication that the two CDs - which the chancellor described as looking like "ordinary CDs of the sort people will be aware of" - had "fallen into the wrong hands or been used for fraudulent activity".

The chancellor admitted there had "almost certainly been breaches of the Data Protection Act" as a result of procedures.....continued below

Advertisement starts

Advertisement ends

not being followed.

Darling revealed that although the information on the CDs was encrypted, it was not password-protected.

"There are other things on these CDs that would put a barrier to finding out what was on them. But the sheer scale of this information should never ever have left the building in which it was stored."

He also defended the government's proposed ID card scheme against attacks that it would be wracked by similar losses of data.

"The advantage of ID cards is that using biometric [data] you can be sure the people who are using it are who they say they are," he said.

"Of course it shakes confidence... People are entitled to trust the government to look after information that was given to it."

The chancellor said he had appointed Kieran Poynter of PriceWaterhouseCoopers to look at the procedures in place at Revenues & Customs and recommend what can be tightened to make sure it does not happen again.

Asked about whether the 2005 merger of Revenue & Customs, the allegedly poor quality of IT systems in use and job cuts the service has been undergoing may have contributed to today's breach of security, the chancellor said: "It is not the merger, it is not the reduction in staff that led to procedures being breached.

"There are rules that mean you can't download this info and stick it in the post. And as for the computer systems, some are recent some are elderly but in asking ourselves what has gone wrong here the rules appear to have been breached with catastrophic results."

Darling said the government was working with banks to make sure those accounts that might be affected are protected. He has also asked members of the public to be vigilant.

Last night the information commissioner, Richard Thomas, conducting a broad inquiry on government data privacy, told the Guardian he was demanding more powers to enter government offices without warning for spot-checks.

He said he wanted new criminal penalties for reckless disregard of procedures. He also disclosed that only last week he had sought assurances from the Home Office on limiting information to be stored on ID cards.

"This could not be more serious and has to be a serious wake-up call to the whole of government. We have been warning about these dangers for more than a year.

"The frightening aspect of this episode is that it just does not matter what laws, rules, procedures and regulations are in place, if there is no proper enforcement of those rules."

The shadow chancellor, George Osborne, described the security breach as "catastrophic", urging Gordon Brown to drop his search for a vision and "just get a grip". He said: "Public confidence in the government and its ability to protect information has been destroyed."

Osborne insisted that the blunders were the "nail in the coffin" for ID cards.

The Revenue & Customs chief, Sir Paul Gray, who is generally well regarded in Whitehall, resigned yesterday.

"This is not the way I would have planned my departure," he said. He had apparently been concerned for months about security lapses inside his department.

It was not the first time that the information had been provided to the NAO. Details of every family with children under the age of 16 were sent to the spending watchdog in March and then returned.

But a second request led to a further dispatch via TNT in October and on that occasion the discs with the data went missing. A third dispatch was subsequently sent by registered post successfully.

The NAO pointed out that the information it had requested from Revenue & Customs, for an independent sample survey, was never meant to include personal addresses, bank information or details of the parents involved.

The HMRC official who sent the CDs did not tell senior officials about the loss because he assumed the package was delayed, the HMRC said.

The data went missing on October 18 but the loss was not reported to senior HMRC management until November 8, three weeks later.

Darling said he was informed on November 10, and told Brown within 30 minutes. He explained that the delay in telling parliament was partly due to banks requesting time to monitor potentially suspicious activity.

page: 1 | 2