And about bloody time too.

[DaveB]

PA Consulting contract axed after data loss

Hopefully people will start to realise that these kinds of security breeches have consequences and start to treat information security seriously.

[BrilloPad]

PA Consulting contract axed after data loss

Hopefully people will start to realise that these kinds of security breeches have consequences and start to treat information security seriously.

I hope they get sued for damages.

[KathyWoolfe]

I hope they get sued for damages.

Who by?

I think the only people who can sue are the people who are damaged, how do they prove that damage was caused?

[Moose423956]

I was talking to a friend of mine who used to work for PA, and he said it would be incredibly difficult to lose data in this way unless someone wanted to do it deliberately.

And thinking of the other instances, it appears to be either unbelieveable carelessness and stupidity, or maybe done deliberately to cause embarrassment to said organisation and the government in particular.

So, could it be a conspiracy?

[BrilloPad]

Who by?

I think the only people who can sue are the people who are damaged, how do they prove that damage was caused?

Hopefully there will be no damage caused. But there is potential. I appreciate as the law stands there is little hope of damages being awarded for potential loss. Some may consider the loss of contract damaging enough.

[DaveB]

I was talking to a friend of mine who used to work for PA, and he said it would be incredibly difficult to lose data in this way unless someone wanted to do it deliberately.

And thinking of the other instances, it appears to be either unbelieveable carelessness and stupidity, or maybe done deliberately to cause embarrassment to said organisation and the government in particular.

So, could it be a conspiracy?

It's not difficult at all. From the article the USB stick was left in an unlocked drawer in an unsecured office. Chances are it was pilfered by an opportunist.

If this is correct it points to either a complete lack of control over sensitive information, a blatant disregard for any controls that do exist or a catatstrophic failure to implement those controls correctly.

[Moose423956]

It's not difficult at all. From the article the USB stick was left in an unlocked drawer in an unsecured office. Chances are it was pilfered by an opportunist.

If this is correct it points to either a complete lack of control over sensitive information, a blatant disregard for any controls that do exist or a catatstrophic failure to implement those controls correctly.

That was my friend's point, the controls over sensitive data are very strict, and they are adhered to rigidly.

[DaveB]

That was my friend's point, the controls over sensitive data are very strict, and they are adhered to rigidly.

I'd still apply Hanlons' Razor.

Never attribute to malice, that which can be adequately explained by stupidity.

[HairyArsedBloke]

I am not a user of these stick thingys, so sorry if this is a silly question.

But ....

How do they know that this copy existed in the first place apart from someone saying "I copied so-and-so to a stick and now I can't find it"?

What is to stop someone creating a new copy and they saying "it's all right, I've found it now"?

[DaveB]

I am not a user of these stick thingys, so sorry if this is a silly question.

But ....

How do they know that this copy existed in the first place apart from someone saying "I copied so-and-so to a stick and now I can't find it"?

What is to stop someone creating a new copy and they saying "it's all right, I've found it now"?

AIUI The data was provided to PA by the Home Office on the data stick. This was apparently in line with the contract on the basis that PA would then look after it properly. Presumably the HO then asked for it back, at which point someone shat themselves.