Security experts criticise government database plans

Security experts are hugely nervous about the government's latest database plans, and have pointed out numerous grave security concerns over two of its proposed schemes.

The Home Office announced in December that the National Identity Register — the planned database behind the controversial ID cards scheme — would comprise three existing databases. The Department of Work and Pensions (DWP), the Identity and Passport Service (IPS) and the Immigration and Nationality Directorate (IND) databases would be combined to store people's biometric and biographic information. This plan, which negates the need to build a single new database, has sparked alarm in the security space.

The second government initiative worrying security experts is this week's proposals to relax data-sharing laws that govern how civil servants access and share citizens' personal data. At present, the privacy rights of the UK public are protected by the Data Protection Act. But, according to a Number 10 policy review published on Monday, "overzealous data-sharing rules may be an obstacle to improving public services". Relaxing these rules could help create a super-database, where public workers had greater access to the personal details of the public.

Security vendors see problems common to both initiatives. Principal among them are the increased opportunities for data theft, if more civil servants are accessing more data.

Greg Day, security analyst at McAfee, said that online data theft is increasing, through the use of software to log people's keystrokes and through attempts to dupe users into revealing personal details, a practice known as phishing.

"It's a simple reality that ID theft is on the up, and is growing online," Day told ZDNet UK. "There's been a 250 percent increase in keyloggers in the last two years, and a hundredfold increase in the number of anti-phishing alerts by the Anti-Phishing Working Group."

Day said that government-held personal details could be divulged easily. According to Zone-h, a website that reports on hacks and hacking, an investigation has been demanded recently into a "digital accident" at the Israeli Interior Ministry where Israeli Vital Population Registry information was leaked and posted on the internet.

"The database is compiled by officials at the Interior Ministry and it includes information about all Israeli citizens and personal details that could potentially be used without authorisation by internet marketers, and of course cybercriminals," Zone-h reported.

Day also had technical concerns with the government plans, including proposals to allow the databases to be accessed over the internet. This could lead to chaos, he warned.

"With the existing databases, they are trying to make them internet-available. It would make me hugely nervous to have that personal information on the internet," said Day. "With multiple databases mixing data they face lock fields, with multiple people trying to modify records simultaneously."

Shlomo Kramer, founder and chief executive officer of Imperva, a data-centre security specialist whose clients include governmental organisations, was also nervous about the plans for internet facing databases.

"Last year more than 100 million user records were compromised in the US alone," Kramer told ZDNet UK. "The issue is that when data is available online it can be compromised — especially [in conjunction with] web services."

Even if the information is only available within governmental organisations, Imperva is seeing that within its user base there are many internal security issues —  including abuse of credit card data, or abuse of privileges.

"Data is at risk if it is made available to a large community of users," said Kramer.

Security issues are compounded when multiple organisations are interacting in...

...an SOA [service-oriented architecture] environment, sharing a single user record, said Kramer. It increases the security risk of data loss or theft.

Sarah Burnett, senior research analyst with Butler Group, who specialises in public sector IT schemes, praised the idea behind the data-sharing recommendations, but said it was unworkable in practice. Support for the scheme from employees would just not be consistent, according to Burnett.

"We all want to modernise government services, but there has to be buy-in from the people on the ground. They need to deliver data of a consistent quality," said Burnett. "Whether it's single sign-on or a super-database, such a huge thing will never work because you won't get everybody committed and delivering quality data all of the time."

Sharing data between the DWP, IPS and IND databases would lead to serious problems because of the differences and incompatibilities in the systems, according to Burnett.

"Different systems have different data and different reference systems. I've been involved in projects where the local police share data with the local fire brigade, where, because they are independent organisations, no-one takes the lead," said Burnett. "IPS has accurate data, but when merging with the DWP — which has an absolutely vast database — the challenge will be getting it to operate in a similar way."

Burnett said that the recommendations to relax the Data Protection Act, which have alarmed the Information Commissioner's Office, would have far-reaching consequences both for individuals and businesses.

"Whatever they do to the DPA will affect the private sector. Potentially we could go back to the days of personal data being shared without our knowledge. I'm sure some parts of the private sector would love that, but as individuals we wouldn't like it very much. We need some level of control. Changing how IT records systems and policies operate will cost businesses money," said Burnett.

Paul Davie, founder and chief executive officer of database security company Secerno, is concerned that the creation of a government super-database would create far too tempting a target for identity thieves.

"What worries me is the increased risk," Davie told ZDNet UK. "There has been a rise in identity theft, with 1.6 billion attempts over the last three years in the UK, with an individual street price of $25 (£13) to $50 for personal details. If you're joining databases, you're creating a tremendously more valuable resource for ID thieves. Because you're data sharing, you can get at so much more data."

Most database security revolves around authenticating users onto a system and granting access privileges. However, that model is open to serious abuse, according to Davie.

"If you have a system with many more authenticated users, you need to control who uses the system and what they're doing. You may think you know who is using a system, but it could be someone using a colleague's machine. With authentication there's no emphasis on who is doing it."

McAfee's Greg Day agreed that the government plans raised many security questions.

"There are a number of security questions if [the government] are sharing between three databases. How secure are the links between them? Are there going to be duplicates of the records? How will they link the two? What if one becomes corrupted? What's the recovery time for the computer record, and where do you go to get [erroneous] details amended?" said Day.

"A huge question revolves around the security of the entire system. Who has access, and how are they validated? We've seen in India call-centre people selling off customer records for £4 a shot," Day added.