Andy Burnam Restricted Documents

[mattviatura]

Another ahole MP has 'apologised unreservedly' for leaving sensetive documents on a train.

How bleeding hard is it to look after the paperwork in your charge?

ahole

[spikeyhead]

http://news.bbc.co.uk/1/hi/uk_politics/8009440.stm

[quote=bbc_article}
Mr Burnham left the documents marked "restricted" in a case when he arrived at London's Euston station on Monday. The case was handed over at Glasgow.

The Department for Culture, Media and Sport said it would conduct a review of security procedures but that the papers did not contain sensitive information.
[/quote]

Why is his department saying that they don't contain sensitive information. The documents had been classified as "restricted" anyone else losing them would be questioned for breaches of the OSA.

[speedchick]

I don't understand why this cannot be classed as gross misconduct and hence a sackable offence, it would be out here in the real world.

[digger_R]

speedchick said:

I don't understand why this cannot be classed as gross misconduct and hence a sackable offence, it would be out here in the real world.

It's usually three strikes and your out with such material I believe (I stand to be corrected) in the my experience that's the way I've seen it applied. It would be a different ball game if it were secret or above

[Jasandjules]

speedchick said:

I don't understand why this cannot be classed as gross misconduct and hence a sackable offence, it would be out here in the real world.

They should be publicly flogged for the first offence.

Boiled alive for the second offence.

That should sharpen their minds.

[The Black Flash]

crucifixtion, surely.

"You'll probably get away with crucifixtion"
"GET AWAY with crucifixtion????"
"Yeah...first offence"

[Fittster]

And no laptops or documents are lost in commercial organisations.

[esselte]

Fittster said:

And no laptops or documents are lost in commercial organisations.

They are but someone usually goes if the data on them in critical....?

[digger_R]

a restricted document could hardly be classified as critical, if it were 'critical' it would have a much higher classification

[esselte]

digger_R said:

a restricted document could hardly be classified as critical, if it were 'critical' it would have a much higher classification

MAybe I should have used the word "important" then?

[Fittster]

esselte said:

Fittster said:

And no laptops or documents are lost in commercial organisations.

They are but someone usually goes if the data on them in critical....?

Not in the 3 * 60,000 employee organisation I've worked for over the last 10 years. A few people give lip service to data security but in the real world people have laptop stolen from cars, memory sticks are lost all the time and information is given to third parties without being scrambled.

I've never known anyone to get pulled up on it. Occasionally an audit comes round who is lied to and the world keeps spinning.

[Nicholas Blair]

Mybe he was putting on his mascara at the time - looks like he wears it - odd chap.

[jshell]

Fittster said:

esselte said:

Fittster said:

And no laptops or documents are lost in commercial organisations.

They are but someone usually goes if the data on them in critical....?

Not in the 3 * 60,000 employee organisation I've worked for over the last 10 years. A few people give lip service to data security but in the real world people have laptop stolen from cars, memory sticks are lost all the time and information is given to third parties without being scrambled.

I've never known anyone to get pulled up on it. Occasionally an audit comes round who is lied to and the world keeps spinning.

But perhaps they're not trying to justify holding personal info/DNA/Biometric data etc on the populace as a whole.....

[Fittster]

jshell said:

Fittster said:

esselte said:

Fittster said:

And no laptops or documents are lost in commercial organisations.

They are but someone usually goes if the data on them in critical....?

Not in the 3 * 60,000 employee organisation I've worked for over the last 10 years. A few people give lip service to data security but in the real world people have laptop stolen from cars, memory sticks are lost all the time and information is given to third parties without being scrambled.

I've never known anyone to get pulled up on it. Occasionally an audit comes round who is lied to and the world keeps spinning.

But perhaps they're not trying to justify holding personal info/DNA/Biometric data etc on the populace as a whole.....

These organisations did a lot of government work and had plenty of peoples personal and bank details. IT organisation will tell you how careful they are with your data, they are lying.

Learn to relax, your personal data is all over 100s if not 1000s of databases and you can bet that a fair few aren't that focused on data protection. A backup goes missing, a developer in India gets access to the production data, someone leaves their bag on the train but it doesn't make the papers. If companies went round sacking people everytime there was a potential security breach the number of people on the dole would be a lot higher.

[jesusbuiltmycar]

speedchick said:

I don't understand why this cannot be classed as gross misconduct and hence a sackable offence, it would be out here in the real world.

If I was stupid enough to loose documents marked as Restricted I would expect the sack...

[Fittster]

jshell said:

Fittster said:

esselte said:

Fittster said:

And no laptops or documents are lost in commercial organisations.

They are but someone usually goes if the data on them in critical....?

Not in the 3 * 60,000 employee organisation I've worked for over the last 10 years. A few people give lip service to data security but in the real world people have laptop stolen from cars, memory sticks are lost all the time and information is given to third parties without being scrambled.

I've never known anyone to get pulled up on it. Occasionally an audit comes round who is lied to and the world keeps spinning.

But perhaps they're not trying to justify holding personal info/DNA/Biometric data etc on the populace as a whole.....

These organisations did a lot of government work and had plenty of peoples personal and bank details. IT organisation will tell you how careful they are with your data, they are lying.

Learn to relax, your personal data is all over 100s if not 1000s of databases and you can bet that a fair few aren't that focused on data protection. A backup goes missing, a developer in India gets access to the production data, someone leaves their bag on the train but it doesn't make the papers. If companies went round sacking people everytime there was a potential security breach the number of people on the dole would be a lot higher.

[Jasandjules]

Fittster said:

These organisations did a lot of government work and had plenty of peoples personal and bank details.

Well that explains it.

Same incompetence comes as standard.

In my bank if you left your desk untidy (clear desk policy) you got a warning. Second time you got a black plastic bag to put all your personal stuff in and were escorted out the building.

[Fittster]

Jasandjules said:

Fittster said:

These organisations did a lot of government work and had plenty of peoples personal and bank details.

Well that explains it.

Same incompetence comes as standard.

In my bank if you left your desk untidy (clear desk policy) you got a warning. Second time you got a black plastic bag to put all your personal stuff in and were escorted out the building.

The banks outsource to the same people as the government. There are probably 20 large IT oursourcing companies in the world and I've worked for a reasonable percentage and the generally IT geek/department aren't that focused on the issue. That doesn't mean there aren't documented policies and the like that can be waved under the noses of auditors but in the real world with real geeks it's really not considered a big issue.

The idea that private sector is good at security and public sector is bad is a load of old nonsense IMHO.

[Jasandjules]

Fittster said:

The idea that private sector is good at security and public sector is bad is a load of old nonsense IMHO.

My bank didn't outsource IT, we had our own teams (and well paid feckers they were too). We had encryption systems, and so much IT Security there was a desk who dealt purely with it. We even had a policy that if your password was provided to another member of staff, it was the sack. If you needed to use someone else's account when they were off, you had to get a Director to sign off that you needed that account and this was then countersigned, and provided to the IT Security Department... Anyone who breached these rules was sacked. I saw it happen twice in a week once.

As I said, if people made mistakes they paid for it, often with their jobs.

[Fittster]

Jasandjules said:

Fittster said:

The idea that private sector is good at security and public sector is bad is a load of old nonsense IMHO.

My bank didn't outsource IT, we had our own teams (and well paid feckers they were too). We had encryption systems, and so much IT Security there was a desk who dealt purely with it. We even had a policy that if your password was provided to another member of staff, it was the sack. If you needed to use someone else's account when they were off, you had to get a Director to sign off that you needed that account and this was then countersigned, and provided to the IT Security Department... Anyone who breached these rules was sacked. I saw it happen twice in a week once.

As I said, if people made mistakes they paid for it, often with their jobs.

Well your description is very much the exception to the rule (Most high street and investment banks having significant outsouring). Also IT pay doesn't reflect competency, as I've moved around my pay has significantly fluctuated my abilities haven't. A well paid geek isn't necessarily better at geekness than a poorly paid geek.

As for the rules, everyone has rules and information security officers and a hundred and one other things that are ignored on a day to day basis to get the job done. They may keep managers and auditors happy but the geeks happily ignore them.

The idea that financial services are any better than central government is wishful thinking.