Security experts are hugely nervous about the U.K. government's latest database plans, and have pointed out numerous grave security concerns over two of its proposed schemes.
The U.K. Home Office announced in December that the National Identity Register--the planned database behind the controversial ID cards scheme---would comprise three existing databases. The Department of Work and Pensions (DWP), the Identity and Passport Service (IPS) and the Immigration and Nationality Directorate (IND) databases would be combined to store people's biometric and biographic information. This plan, which negates the need to build a single new database, has sparked alarm in the security space.
The second U.K. government initiative worrying security experts is this week's proposals to relax data-sharing laws that govern how civil servants access and share citizens' personal data. At present, the privacy rights of the U.K. public are protected by the Data Protection Act. But, according to a Number 10 policy review published on Monday, "overzealous data-sharing rules may be an obstacle to improving public services". Relaxing these rules could help create a super-database, where public workers had greater access to the personal details of the public.
Security vendors see problems common to both initiatives. Principal among them are the increased opportunities for data theft, if more civil servants are accessing more data.
Greg Day, security analyst at McAfee, said that online data theft is increasing, through the use of software to log people's keystrokes and through attempts to dupe users into revealing personal details, a practice known as phishing.
"It's a simple reality that ID theft is on the up, and is growing online," Day told ZDNet UK. "There's been a 250 percent increase in keyloggers in the last two years, and a hundredfold increase in the number of anti-phishing alerts by the Anti-Phishing Working Group."
Day said that government-held personal details could be divulged easily. According to Zone-h, a Web site that reports on hacks and hacking, an investigation has been demanded recently into a "digital accident" at the Israeli Interior Ministry where Israeli Vital Population Registry information was leaked and posted on the Internet.
"The database is compiled by officials at the Interior Ministry and it includes information about all Israeli citizens and personal details that could potentially be used without authorization by Internet marketers, and of course cybercriminals," Zone-h reported.
Day also had technical concerns with the U.K. government plans, including proposals to allow the databases to be accessed over the Internet. This could lead to chaos, he warned.
"With the existing databases, they are trying to make them Internet-available. It would make me hugely nervous to have that personal information on the Internet," said Day. "With multiple databases mixing data they face lock fields, with multiple people trying to modify records simultaneously."
Shlomo Kramer, founder and chief executive officer of Imperva, a data-centre security specialist whose clients include governmental organizations, was also nervous about the plans for Internet facing databases.
"Last year more than 100 million user records were compromised in the United States alone," Kramer told ZDNet UK. "The issue is that when data is available online it can be compromised--especially [in conjunction with] Web services."
Even if the information is only available within governmental organizations, Imperva is seeing that within its user base there are many internal security issues--including abuse of credit card data, or abuse of privileges.
"Data is at risk if it is made available to a large community of users," said Kramer.
Security issues are compounded when multiple organizations are interacting in an SOA [service-oriented architecture] environment, sharing a single user record, said Kramer. It increases the security risk of data loss or theft.
Play video
There are currently no comments for this post.