"Roland Perry" wrote in message
...
In message , at 19:56:50
on Sun, 2 Dec 2007, Bob Eager remarked:
Rubbish, all the data on them is public information. It's a bit sad that
they've lost a whole lot of it, but nothing important for a general
"identity theft" scenario. The actual (and not much mentioned) threat is
that anyone with children is on the database, including some famous
people who try quite hard to disguise their addresses.

Actually, a major impact (not much mentioned) is the use of the FACT of
this loss as a lever inside phishing emails.

What kind of phishing email would that be? No-one should expect to respond
to one purporting to come from their bank, if it was asking for any
additional information.

The data that was lost didn't include email addresses (as far as I'm
aware) so it would have to be a specific phishing attack to all
[apparently] uk-based email addresses already in the phisher's databases.

Doesn't need to. Just phrase the phishing mail something like "Your details
need reconfirming due to the loss of these discs. Please enter your password
at here", and send it to the standard list of spamming addresses.

'course people should know that these mails are always lies, but there's a
proportion who believe them :-( Witness the regular letters in the money
columns saying "XXX is trying to sell me these shares/timeshare/lottery
ticket. Is it real?" - there are plenty of people out there who don't think
hard enough about these things.

cheers,
clive

In message , Roland Perry
writes
In message 4753016e@qaanaaq, at 19:03:10 on Sun, 2 Dec 2007, Andy
Hall remarked:
So where's *your* line between the many failings a day that don't
matter, and the ones that do?

All failings matter - it's a question of the impact, the potential
impact, whether it should have happened and steps taken afterwards to
correct it.

I repeat:

So where's *your* line between the many failings a day that don't
matter, and the ones that do?

In respect of the lost discs, the impact and potential impact are
enormous. Anybody with details on them would be foolish not to change
all bank account and other details.

Rubbish, all the data on them is public information. It's a bit sad
that they've lost a whole lot of it, but nothing important for a
general "identity theft" scenario. The actual (and not much mentioned)
threat is that anyone with children is on the database, including some
famous people who try quite hard to disguise their addresses.


No, what's really important is that it happened, that there were not the
mechanisms in place to prevent it from happening, and that it happened
time and time again

the data (or rather the sheer quantity of it) is what made people take
note, and realise the potential


--
geoff

In message , Roland Perry
writes
In message , at 18:45:57 on Sun, 2 Dec
2007, geoff remarked:
I'm trying to get this conversation into the real world. Only
football managers seem to suffer the "fired many times a week"
scenario. It doesn't happen to most people in the 'real world'.

but we're talking here of a lack of security which has such monumental
implications that it can't just be brushed aside

In which case you need to fire hundreds (possibly thousands) of people,
not just the minister. Not clear where you'd get replacements for all
of them.

No, it should not have been possible to download to a couple of disks
and just send it

It was a breakdown in a system which wasn't adequate


--
geoff

On Sun, 2 Dec 2007 19:49:56 +0000, Roland Perry
wrote:

In message 4753016e@qaanaaq, at 19:03:10 on Sun, 2 Dec 2007, Andy Hall
remarked:

In respect of the lost discs, the impact and potential impact are
enormous. Anybody with details on them would be foolish not to change
all bank account and other details.

Rubbish, all the data on them is public information.

How true that may well be...

--
Frank Erskine

In message , Roland Perry
writes
In message , at 18:45:57 on Sun, 2 Dec
2007, geoff remarked:
I'm trying to get this conversation into the real world. Only
football managers seem to suffer the "fired many times a week"
scenario. It doesn't happen to most people in the 'real world'.

but we're talking here of a lack of security which has such monumental
implications that it can't just be brushed aside

In which case you need to fire hundreds (possibly thousands) of people,
not just the minister. Not clear where you'd get replacements for all
of them.

You're an academic, aren't you

.... I can tell


--
geoff

On Sun, 2 Dec 2007 20:18:30 UTC, Roland Perry
wrote:

What kind of phishing email would that be? No-one should expect to
respond to one purporting to come from their bank, if it was asking for
any additional information.

Of course, no one should - but they do.

The data that was lost didn't include email addresses (as far as I'm
aware) so it would have to be a specific phishing attack to all
[apparently] uk-based email addresses already in the phisher's
databases.

The actual data are irelevant. But with everyone being very conscious of
what has happened, many gullible people might even expect email from
their bank in this 'unusual' situation.

--
The information contained in this post is copyright the
poster, and specifically may not be published in, or used by
http://www.diybanter.com

In message , at 20:30:10 on Sun, 2
Dec 2007, Clive George remarked:

Rubbish, all the data on them is public information. It's a bit sad that
they've lost a whole lot of it, but nothing important for a general
"identity theft" scenario. The actual (and not much mentioned) threat is
that anyone with children is on the database, including some famous
people who try quite hard to disguise their addresses.

Actually, a major impact (not much mentioned) is the use of the FACT of
this loss as a lever inside phishing emails.

What kind of phishing email would that be? No-one should expect to respond
to one purporting to come from their bank, if it was asking for any
additional information.

The data that was lost didn't include email addresses (as far as I'm
aware) so it would have to be a specific phishing attack to all
[apparently] uk-based email addresses already in the phisher's databases.

Doesn't need to. Just phrase the phishing mail something like "Your details
need reconfirming due to the loss of these discs. Please enter your password
at here", and send it to the standard list of spamming addresses.

What [extra] details do you think they'll be asking for?

--
Roland Perry

In message , at 20:30:40 on Sun, 2 Dec
2007, geoff remarked:
No, what's really important is that it happened, that there were not
the mechanisms in place to prevent it from happening, and that it
happened time and time again

That's an issue for centralised databases, I agree. And I don't for a
moment think that they should have behaved the way they did.

the data (or rather the sheer quantity of it) is what made people take
note, and realise the potential

Although there's almost no "potential" at all in the data that's been
leaked. Makes a good scare story, though.
--
Roland Perry

In message , at 20:35:59 on
Sun, 2 Dec 2007, Frank Erskine remarked:

In respect of the lost discs, the impact and potential impact are
enormous. Anybody with details on them would be foolish not to change
all bank account and other details.

Rubbish, all the data on them is public information.

How true that may well be...

For example, NI number. I'm sure everyone has told that to every
employer they ever had.
--
Roland Perry

In message , at 20:30:41 on Sun, 2 Dec
2007, geoff remarked:
I'm trying to get this conversation into the real world. Only
football managers seem to suffer the "fired many times a week"
scenario. It doesn't happen to most people in the 'real world'.

but we're talking here of a lack of security which has such
monumental implications that it can't just be brushed aside

In which case you need to fire hundreds (possibly thousands) of
people, not just the minister. Not clear where you'd get replacements
for all of them.

No, it should not have been possible to download to a couple of disks
and just send it

I agree, but there were hundreds (possibly thousands) of people who were
complicit in the decisions that made that possible.
--
Roland Perry

In message , at 20:41:16 on Sun, 2 Dec
2007, geoff remarked:
I'm trying to get this conversation into the real world. Only
football managers seem to suffer the "fired many times a week"
scenario. It doesn't happen to most people in the 'real world'.

but we're talking here of a lack of security which has such
monumental implications that it can't just be brushed aside

In which case you need to fire hundreds (possibly thousands) of
people, not just the minister. Not clear where you'd get replacements
for all of them.

You're an academic, aren't you

... I can tell

No, I'm not and have never been, an academic.
--
Roland Perry

In message , at 20:49:32
on Sun, 2 Dec 2007, Bob Eager remarked:
But with everyone being very conscious of what has happened, many
gullible people might even expect email from their bank in this
'unusual' situation.

And you don't think that the publicity that this leak has caused will
make people more wary?
--
Roland Perry

On 2007-12-02 19:11:15 +0000, Andy Champ said:

I actually quite like wind turbines - I've even gone to gawp at
windfarms - but we need to do something else, bigger.
Perhaps if fusion had been funded properly when I was a child my
children would be seeing it in production now, and that's be the
answer, but it isn't (yet). But *we must do something!*


Yes. It's called nuclear fission technology.

On 2007-12-02 19:49:56 +0000, Roland Perry said:

In message 4753016e@qaanaaq, at 19:03:10 on Sun, 2 Dec 2007, Andy
Hall remarked:
So where's *your* line between the many failings a day that don't
matter, and the ones that do?

All failings matter - it's a question of the impact, the potential
impact, whether it should have happened and steps taken afterwards to
correct it.

I repeat:

So where's *your* line between the many failings a day that don't
matter, and the ones that do?

In respect of the lost discs, the impact and potential impact are
enormous. Anybody with details on them would be foolish not to change
all bank account and other details.

Rubbish, all the data on them is public information.

Bank account details? I don't think so.


It's a bit sad that they've lost a whole lot of it, but nothing
important for a general "identity theft" scenario. The actual (and not
much mentioned) threat is that anyone with children is on the database,
including some famous people who try quite hard to disguise their
addresses.

That too.....

On 2007-12-02 19:51:20 +0000, Roland Perry said:

In message , at 18:45:57 on Sun, 2 Dec
2007, geoff remarked:
I'm trying to get this conversation into the real world. Only football
managers seem to suffer the "fired many times a week" scenario. It
doesn't happen to most people in the 'real world'.

but we're talking here of a lack of security which has such monumental
implications that it can't just be brushed aside

In which case you need to fire hundreds (possibly thousands) of people,
not just the minister. Not clear where you'd get replacements for all
of them.

They are civil servants. There needs to be a cull anyway.

Roland Perry wrote:

Actually, a major impact (not much mentioned) is the use of the FACT of
this loss as a lever inside phishing emails.

What kind of phishing email would that be?

Already covered he

http://www.bbcnews.co.uk/1/hi/england/7123479.stm


--
Cheers,

John.

/================================================== ===============\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\================================================= ================/

On 2007-12-02 19:51:42 +0000, Roland Perry said:

In message 4753001d@qaanaaq, at 18:57:33 on Sun, 2 Dec 2007, Andy
Hall remarked:
I'm trying to get this conversation into the real world. Only football
managers seem to suffer the "fired many times a week" scenario. It
doesn't happen to most people in the 'real world'.

Don't you believe it....

Perhaps you can quote an example.

Just take a look at major companies on a worldwide basis. CEOs are
on the line the whole time. Ask Ed Zander.

In message 47531ceb@qaanaaq, at 21:00:27 on Sun, 2 Dec 2007, Andy Hall
remarked:
Rubbish, all the data on them is public information.

Bank account details? I don't think so.

On every cheque anyone ever wrote. Didn't seem to bother them much.

And all you can do with the data is pay money *in*.

Please let us know when you last had to provide a bank account number as
identity verification.
--
Roland Perry

On 2007-12-02 19:18:30 +0000, Tony Bryer said:

On Sun, 2 Dec 2007 18:21:49 +0000 Roland Perry wrote :
I'm trying to get this conversation into the real world. Only
football managers seem to suffer the "fired many times a week"
scenario. It doesn't happen to most people in the 'real world'.

And top brass in the private sector who, voluntarily or otherwise,
do fall on their swords generally have the pain ameliorated by a
mega million severance package - up to $81m for the boss of
Citibank according to press reports. In contrast to a Cabinet
minister who resigns and loses his salary and perks with, AFAIK, no
compensation, just lurid press headlines.


But they went into it knowing the benefits and the risks.

On 2007-12-02 19:52:52 +0000, Roland Perry said:

In message , at 19:18:30 on Sun,
2 Dec 2007, Tony Bryer remarked:
On Sun, 2 Dec 2007 18:21:49 +0000 Roland Perry wrote :
I'm trying to get this conversation into the real world. Only
football managers seem to suffer the "fired many times a week"
scenario. It doesn't happen to most people in the 'real world'.

And top brass in the private sector who, voluntarily or otherwise,
do fall on their swords generally have the pain ameliorated by a
mega million severance package - up to $81m for the boss of
Citibank according to press reports.

And what's most relevant to this thread - their replacement isn't fired
a few days later, and his replacement a few days after that, and his
replacement a few days after that...

Obviously not. A reasonable time is required to put the house in
order. There should be visibility of changes made including
dismissal of middle management.

In message , at 21:03:28 on Sun, 2
Dec 2007, John Rumm remarked:
Actually, a major impact (not much mentioned) is the use of the FACT of
this loss as a lever inside phishing emails.
What kind of phishing email would that be?

Already covered he

http://www.bbcnews.co.uk/1/hi/england/7123479.stm

"Sorry, the address you are looking for is not available."
--
Roland Perry

In message 47531dc4@qaanaaq, at 21:04:03 on Sun, 2 Dec 2007, Andy Hall
remarked:
I'm trying to get this conversation into the real world. Only
football managers seem to suffer the "fired many times a week"
scenario. It doesn't happen to most people in the 'real world'.
Don't you believe it....
Perhaps you can quote an example.

Just take a look at major companies on a worldwide basis. CEOs are
on the line the whole time. Ask Ed Zander.

You are out by several orders of magnitude. Some CEOs lose their job,
and a very small number of their direct successors lose their job a year
later.

There's no history of all (or even a noticeable number of) CEOs losing
their jobs several times a week.
--
Roland Perry

On Sun, 2 Dec 2007 20:58:51 UTC, Roland Perry
wrote:

In message , at 20:49:32
on Sun, 2 Dec 2007, Bob Eager remarked:
But with everyone being very conscious of what has happened, many
gullible people might even expect email from their bank in this
'unusual' situation.

And you don't think that the publicity that this leak has caused will
make people more wary?

Yes...but not of phishing.
--
The information contained in this post is copyright the
poster, and specifically may not be published in, or used by
http://www.diybanter.com

In message 4752d820@qaanaaq, at 16:06:55 on Sun, 2 Dec 2007, Andy Hall
remarked:
Our government just spent ten times that bailing out a
second-division building society especially popular with
voters in its core constituencies.

That's true, and of course both should have been allowed to go to the wall.

An interesting comment in a d-i-y newsgroup. I can see why subscribers
to such a newsgroup would relish a housing crash, as would have
inevitably followed from a Northern Rock bankruptcy.
--
Roland Perry

In message , at 21:11:17
on Sun, 2 Dec 2007, Bob Eager remarked:
And you don't think that the publicity that this leak has caused will
make people more wary?

Yes...but not of phishing.

A very curious point of view. Care to say why?
--
Roland Perry

On 2007-12-02 20:55:21 +0000, Roland Perry said:

In message , at 20:30:40 on Sun, 2 Dec
2007, geoff remarked:
No, what's really important is that it happened, that there were not
the mechanisms in place to prevent it from happening, and that it
happened time and time again

That's an issue for centralised databases, I agree. And I don't for a
moment think that they should have behaved the way they did.

the data (or rather the sheer quantity of it) is what made people take
note, and realise the potential

Although there's almost no "potential" at all in the data that's been
leaked. Makes a good scare story, though.

How do you know?

Civil servants have left laptops on trains before now....

On 2007-12-02 21:04:06 +0000, Roland Perry said:

In message 47531ceb@qaanaaq, at 21:00:27 on Sun, 2 Dec 2007, Andy
Hall remarked:
Rubbish, all the data on them is public information.

Bank account details? I don't think so.

On every cheque anyone ever wrote. Didn't seem to bother them much.

And all you can do with the data is pay money *in*.

Please let us know when you last had to provide a bank account number
as identity verification.

Combination of name, address, NI number, bank details,......

In message 47531e67@qaanaaq, at 21:06:46 on Sun, 2 Dec 2007, Andy Hall
remarked:
And what's most relevant to this thread - their replacement isn't
fired a few days later, and his replacement a few days after that,
and his replacement a few days after that...

Obviously not. A reasonable time is required to put the house in
order.

Exactly, and you will find very few ministers who stay that long (even
in the absence of being shuffled for bad behaviour).

--
Roland Perry

On 2007-12-02 20:57:21 +0000, Roland Perry said:

In message , at 20:30:41 on Sun, 2 Dec
2007, geoff remarked:
I'm trying to get this conversation into the real world. Only football
managers seem to suffer the "fired many times a week" scenario. It
doesn't happen to most people in the 'real world'.

but we're talking here of a lack of security which has such monumental
implications that it can't just be brushed aside

In which case you need to fire hundreds (possibly thousands) of people,
not just the minister. Not clear where you'd get replacements for all
of them.

No, it should not have been possible to download to a couple of disks
and just send it

I agree, but there were hundreds (possibly thousands) of people who
were complicit in the decisions that made that possible.

I am sure that it will be possible to prepare P45s for all of them.

In message , Roland Perry
writes
In message , at 20:30:40 on Sun, 2 Dec
2007, geoff remarked:
No, what's really important is that it happened, that there were not
the mechanisms in place to prevent it from happening, and that it
happened time and time again

That's an issue for centralised databases, I agree. And I don't for a
moment think that they should have behaved the way they did.

the data (or rather the sheer quantity of it) is what made people take
note, and realise the potential

Although there's almost no "potential" at all in the data that's been
leaked. Makes a good scare story, though.

You just can't see it, can you

it's not the data loss, it's they system


--
geoff

In message , John Rumm
writes
Roland Perry wrote:

Actually, a major impact (not much mentioned) is the use of the FACT of
this loss as a lever inside phishing emails.
What kind of phishing email would that be?

Already covered he

http://www.bbcnews.co.uk/1/hi/england/7123479.stm


Too late - someone already nicked it

--
geoff

Roland Perry wrote:

the data (or rather the sheer quantity of it) is what made people take
note, and realise the potential

Although there's almost no "potential" at all in the data that's been
leaked. Makes a good scare story, though.

There is massive potential. Even if there were not enough on its own to
commit fraud (and in reality there was plenty - how much info do you
need to setup a direct debit?), possession of it enhances the value of
any other previously low value information you can acquire since there
is now a very good possibility of being able to match up your new
information with one of the 25m entries that were lost.

Also think of the extra information that could be generated with a
little bit of "applied inference"... You have bank account details,
name, address, NI details etc, what else would you like? Mothers maiden
name? Fair chance you could guess that for a good proportion of the
cases where the parents surnames don't match and the mothers title is
Miss. With 25m records to play with, you are going to be able to guess
right for a good few hundred thousand records.


--
Cheers,

John.

/================================================== ===============\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\================================================= ================/

In message 475320cb@qaanaaq, at 21:16:59 on Sun, 2 Dec 2007, Andy Hall
remarked:
Although there's almost no "potential" at all in the data that's
been leaked. Makes a good scare story, though.

How do you know?

I now that the limited data that's been leaked is of little because I've
spoken to people in the banking industry who have confirmed my common
sense first impressions.

Please tell us how you can get funds from me by knowing my bank details
and NI number.

Civil servants have left laptops on trains before now....

Of course. Different data, different risks. Private sector companies
have had just as many such incidents
--
Roland Perry

On 2007-12-02 21:09:54 +0000, Roland Perry said:

In message 47531dc4@qaanaaq, at 21:04:03 on Sun, 2 Dec 2007, Andy
Hall remarked:
I'm trying to get this conversation into the real world. Only football
managers seem to suffer the "fired many times a week" scenario. It
doesn't happen to most people in the 'real world'.
Don't you believe it....
Perhaps you can quote an example.

Just take a look at major companies on a worldwide basis. CEOs are
on the line the whole time. Ask Ed Zander.

You are out by several orders of magnitude. Some CEOs lose their job,
and a very small number of their direct successors lose their job a
year later.

There's no history of all (or even a noticeable number of) CEOs losing
their jobs several times a week.

I didn't say that there was. However, there is no question of
security of tenure in the event of a gargantuan failure to produce the
goods. This situation is exactly equivalent to that. These people
have been paid out of public money to do a proper job. It is reasonable
to expect a higher standard from public sector employees than from the
private sector. They have singularly failed and this should result in
loss of employment.

On 2007-12-02 20:57:55 +0000, Roland Perry said:

In message , at 20:41:16 on Sun, 2 Dec
2007, geoff remarked:
I'm trying to get this conversation into the real world. Only football
managers seem to suffer the "fired many times a week" scenario. It
doesn't happen to most people in the 'real world'.

but we're talking here of a lack of security which has such monumental
implications that it can't just be brushed aside

In which case you need to fire hundreds (possibly thousands) of people,
not just the minister. Not clear where you'd get replacements for all
of them.

You're an academic, aren't you

... I can tell

No, I'm not and have never been, an academic.

Are you, or have you ever been employed in the public sector?

In message 4753210f@qaanaaq, at 21:18:07 on Sun, 2 Dec 2007, Andy Hall
remarked:
Please let us know when you last had to provide a bank account
number as identity verification.

Combination of name, address, NI number, bank details,......

When were those asked for as identity verification?
--
Roland Perry

Andy Hall wrote:
On 2007-12-02 19:51:42 +0000, Roland Perry said:

In message 4753001d@qaanaaq, at 18:57:33 on Sun, 2 Dec 2007, Andy
Hall remarked:
I'm trying to get this conversation into the real world. Only
football managers seem to suffer the "fired many times a week"
scenario. It doesn't happen to most people in the 'real world'.

Don't you believe it....

Perhaps you can quote an example.

Just take a look at major companies on a worldwide basis. CEOs are on
the line the whole time. Ask Ed Zander.

Pretty standard fare in many commissioned sales jobs as well - Nice
little notes from the boss saying "you are fired, unless you achieve
target X by the end of this month..."

--
Cheers,

John.

/================================================== ===============\
| Internode Ltd - http://www.internode.co.uk |
|-----------------------------------------------------------------|
| John Rumm - john(at)internode(dot)co(dot)uk |
\================================================= ================/

In message , Roland Perry
writes
In message 4752d820@qaanaaq, at 16:06:55 on Sun, 2 Dec 2007, Andy
Hall remarked:
Our government just spent ten times that bailing out a
second-division building society especially popular with
voters in its core constituencies.

That's true, and of course both should have been allowed to go to the wall.

An interesting comment in a d-i-y newsgroup. I can see why subscribers
to such a newsgroup would relish a housing crash,

Well, I would

as would have inevitably followed from a Northern Rock bankruptcy.

--
geoff

Andy Hall wrote:

On 2007-12-02 19:11:15 +0000, Andy Champ said:

I actually quite like wind turbines - I've even gone to gawp at
windfarms - but we need to do something else, bigger.
Perhaps if fusion had been funded properly when I was a child my
children would be seeing it in production now, and that's be the
answer, but it isn't (yet). But *we must do something!*


Yes. It's called nuclear fission technology.

There's no doubt it can make a huge difference to a nation's CO2
emissions. Compare England to France. Similar populations, similar
industrialisation, similar natural resources.

RANK NATION CO2_TOT
8 UNITED KINGDOM 160179
15 FRANCE (INCLUDING MONACO) 101927

True, France has a long way to go, but it emits just 63% of the CO2
emitted by the UK. The major difference between the two countries is
that France has invested in nuclear energy. Another (lesser) difference
is that France has not listened to whining eco-loonies when it comes to
the subject of generating energy from natural resources and has
instituted a program of developing tidal and HEP to a level that is
unknown in the UK. This is not because the UK is incapable of
engineering and financing such schemes, it is because we let ourselves
be weighed down by the "save the lesser spotted green tench" brigade
whose prognostications of doom if we do (X) inevitably turn out to be
hysterical crap.

Roland Perry wrote:

No, I'm not and have never been, an academic.

Oh I dunno, I'd say your points here are entirely academic.