Kable | Kable

IPS's double IT has risks, says commissioner

Tue, 09 Feb 2010 00:05:00 GMT

Identity commissioner Sir Joseph Pilling has expressed concerns about the Identity and Passport Service's two-stage approach to its core technology

"The IPS have gone for what they call a tactical and a strategic solution to the IT demands of running an ID scheme in this country," he told the Security Document World conference in London on 8 February 2010. One system has been put in place for the small-scale launch of the scheme, but another will be introduced when it is expanded by forcing passport applicants to enrol.

"I am not sure whether if you have two schemes in short order you double, treble or quadruple the risk or even more than that, but I am pretty clear that it is a quite ambitious approach to take, and I am particularly intending to take an interest in the transition from the tactical to the strategic," said Sir Joseph.

Having seen the identity card enrolment process first hand, he added he was not satisfied that all the best possible standards are being applied and that he intended to keep his attention focused on this.

However, Sir Joseph said that IPS is doing a good job in looking after data. "It is not one of those bodies in the public or private sector who have shoved millions of unencrypted records out into the public domain, unintentionally, carelessly or as the victim of some malevolent member of staff or consultant," he said.

He said he will take a detached view of the scheme: "My emphasis is independence, independence and independence. But I am not only independent of the government, I am also independent of the opposition, whether they become the next government in a few weeks time or not."

He reminded his audience of security specialists that after a general election, it could be that the UK will no longer have identity cards for British nationals. The Conservatives have pledged to scrap the scheme.

Agency introduces 'opt out' flood alerts

Mon, 08 Feb 2010 12:44:23 GMT

The Environment Agency is putting half a million homes on an automatic flood alert service

It will automatically provide them with telephone alerts if there is a flood warning in their areas. People not wishing to receive the alerts will have to opt out.

Previously the service has operated on an opt in basis, with people having to register to receive it.

A spokesperson for the Environment Agency told GC News the service will be targeted at areas with a relatively high flood risk, and that it has the landline phone numbers for all of the properties through an agreement with BT. He said these are kept in accordance with the terms of the Data Protection Act.

"It's all so we will be able to offer advanced, tailored warnings by phone," he said.
The agency is writing to people due to receive the service, informing them of the opt out option and the facility to receive the alerts by text message and/or email.

It plans to make the service available to 400,000 people by the end of this month, and to the other 100,000 over the following weeks. The spokesperson said it is looking at the possibility of extending it to more people.

The agency has also unveiled a new service to help local authorities provide localised flooding advice to the public through its existing Floodline 0845 988 1188 service. It said this will provide a one stop shop for flood advice, combining the agency's information on river and coastal developments with information from local authorities on surface water and drainage flooding.

Local authorities can join the service by paying an annual charge. They then provide the agency with answers to a range of frequently asked questions about local flood risk issues.

Craig Woolhouse, head of flood incident management at the Environment Agency said: "This new and improved Floodline service means homeowners and businesses only need to call one number to gain important initial advice on all types of flooding. The service has been developed with the help of local authority partners. Its success will depend on how many local authorities choose to join it. "

The first phase of this extended service started in December last year and involves 27 local authorities on a trial basis. The Environment Agency is looking to introduce the service across England and Wales by summer 2010.

European database has 500,000 access points

Mon, 08 Feb 2010 10:11:28 GMT

The EU has disclosed details of access to the EU's Schengen Information System, which includes police data on Britons

Large amounts of confidential personal information held about British citizens on a computer network spanning the European Union could be accessed through more than 500,000 terminals, reports The Observer.

The figure was revealed in a Council of the European Union document examining proposals to establish a new agency, based in France, that would manage much of the 27 EU member states' shared data. But the sheer number of access points to the Schengen Information System (SIS) – which holds information regarding immigration status, arrest warrants, entries on the Police National Computer and a multitude of personal details – has triggered concerns about the security of the data.

Statewatch, a group that monitors civil liberties in Europe, said it was aware of a case in Belgium where personal information extracted from the system by an official was sold to an organised criminal gang.

"It is well known that the greater the points of access, the greater the number of people who have access and the greater the chance that data will be misplaced, lost or illegally accessed," said Tony Bunyan, director of Statewatch. "The idea that mass databases can be totally secure and that privacy can be guaranteed is a fallacy."

The rapid expansion of the EU has played a significant part in increasing the size of the network. In 2003, there were 125,000 computer terminals across the EU with access to the system, according to official documents. But following EU enlargement, the number of computer terminals with access to the system increased dramatically.

According to the Council of the European Union Inter-institutional File, "the SIS is built around a central database that is networked, via national systems, to more than half a million terminals located within the security services of the member states".

The file goes on to explain that the system "currently contains more than 30m alerts," for wanted persons, stolen vehicles and stolen or lost identity papers and documents. While the SIS is credited by its supporters with helping to track wanted criminals and illegal immigrants, there are concerns that the personal data it holds could be invaluable for fraudsters.

English Heritage tenders for infrastructure

Mon, 08 Feb 2010 00:05:00 GMT

The historic monuments and buildings commission will pay up to £25m over five years for IT infrastructure management, support and services

The supplier will provide fixed line and mobile telephony support and data communications to 2,400 staff, English Heritage said.

According to the notice published in the Official Journal of the European Union on 5 February 2010, many staff will need remote services at various locations around England. The commission has 150 sites throughout the country.

The winning bidder will also provide service management, desktop support and data centre services, as well as ISP, network management and technology refresh services.

The supplier may host a small number of English Heritage's 170 servers, including associated applications and services. After the initial five year period the deal includes the option for a one year extension.

Becta tenders for assistive home technology

Fri, 05 Feb 2010 12:55:37 GMT

The government's educational technology agency will pay up to £24m over two years for specialist services for its Home Access programme

Software, internet connectivity, virus protection and a helpdesk will be provided under the framework agreement, Becta said.

According to the notice published in the Official Journal of the European Union on 4 February 2010, the assistive services will help around 12,000 eligible learners in England use its Home Access programme.

A maximum of six suppliers will participate in the contract, which may be extended after the initial two year period for a further two years. It may also be extended to other public sector organisations.

Becta has also published a separate tender for learner evaluation and case management services. It will pay between £1m and £4m over one year for data processing, document management and administration services, computer related management and professional services, also for its Home Access programme.

Pupil database free of breaches

Fri, 05 Feb 2010 11:28:16 GMT

A government minister has claimed a clean record on security breaches for the National Pupil Database

Baroness Morgan, under-secretary of state at the Department for Children, Schools and Families, said the stringent security procedures around the database have prevented any breaches since it was set up in 2002.

Access is confined to a team of seven staff at the department's Darlington office, and they disclose information only to prescribed people for purposes defined by the relevant regulations.

Morgan provided the information in response to a parliamentary question from Baroness Byford, the Conservatives' shadow minister for food and rural affairs in the House of Lords.

Morgan added that the database is used largely to measure school effectiveness and compare pupils' national curriculum assessments. It makes it possible to assess performance at school against factors such as being eligible for free school meals, where children live and ethnicity.

In response to a question about how long information is held on the database, Morgan said a retention policy, including archiving data with National Archives, is currently being developed.

Defra tenders for sheep tracking database

Thu, 04 Feb 2010 12:55:13 GMT

The Department for Environment, Food and Rural Affairs will pay £6m over five years for an animal movements reporting service

The electronic identification (EID) database will be used to track sheep and will link to an animal movement licensing system.

According to the notice published in the Official Journal of the European Union on 4 February 2010, the supplier will provide electronic submissions for 75% of sheep movements, so data can be re-used by markets and abattoirs. The supplier will also provide other database services.

In December 2007 the European Union agreed on 31 December 2009 as the obligatory implementation date for the introduction of EID for sheep and goats. England introduced new regulations requiring these animals to be tagged from that date, although rules on recording their movements are being phased in over the next two years.

LibDems would close Connecting for Health

Thu, 04 Feb 2010 00:10:00 GMT

The Care Records Service and Choose and Book would be scrapped under Liberal Democrat plans to improve informatics in England

The measure is set out in The NHS: a liberal blueprint, a party policy paper which outlines principles to modernise the NHS. It was launched on 4 February 2010 by shadow health secretary Norman Lamb.

Connecting for Health would be abolished as part of a "move away from a centrally imposed IT system". The paper also calls for the abolition of strategic health authorities (SHAs) and some other central organisations.

The document says that the Choose and Book booking system should be replaced by a simple online appointments booking service. It argues that the early signs are that Choose and Book has been less effective at offering patient choice than the government has claimed.

It restricts patient choice by removing a hospital from the list of choices if it has a long waiting list, the Liberal Democrats claim. "It seems bizarre not to offer patients the option of waiting a bit longer to see their preferred specialist or the one their GPs have recommended," the paper says.

The paper also says that the Care Records Service (CRS) should be abandoned. It points out that the CRS is likely to be completed some four years late, has encountered enormous technical challenges and has raised serious concerns about the confidentiality of patient records. Moreover, a clinical and business case has still not been satisfactorily made for establishing a national database.

The Liberal Democrats recognise that contractual obligations with existing suppliers would have to be respected, but say that contract variations could be negotiated.

Following a similar policy to the Conservatives, the party would also put patients in charge of their own health records where possible. The document cites a pilot e-health record system at the New York Presbyterian Hospital, which gives full control of data to individuals.

It also highlights the potential for telemedicine to support people with chronic conditions and enable them to remain in their own homes. It says that the US Veterans Health Administration is using software which links 1,400 medical centres, community clinics and nursing homes. The system shows diagnoses, medications, scan and lab reports and has been able to reduce hospital admissions as a result.

Lamb said: "These proposals set out a liberal approach to the NHS which can drastically reduce costs, improve the quality of care and give people a say in how their local services are run. The NHS is far too important to the people of this country to ignore this challenge anymore - we must act now to secure its future."

Victor Almeida, senior health analyst at Kable, said: "These proposals have many similarities with the Conservatives, but the major difference is that they would close down Connecting for Health and the CRS.

"These measures could be beneficial to the NHS, which is currently tied up with complex software systems in long and delayed trials and roll outs.

"But it could take time before government can extricate itself from contractual obligations – reset negotiations can take months or even longer – and start afresh."

Buying Solutions to subsidise e-auctions

Thu, 04 Feb 2010 00:05:00 GMT

The procurement agency of the Office of Government Commerce has said it will provide financial support for some public sector electronic auctions

Buying Solutions said it will consider contributing to the set-up costs for any organisation committing to an e-auction before the end of the financial year on 31 March.

A spokesperson told GC News it has £100,000 available with the maximum for any one body set at £10,000 and decisions to be made on a case by case basis. The money has to be spent through Buying Solutions' framework agreements on ICT, energy, property and office solutions, professional services, payment solutions or travel.

The move is part of its effort, on which it has been working with the OGC Centre for e-Auctions, to increase their impact on the public sector.

The spokesperson said that Buying Solutions is considering another financial support package for next year.

It has highlighted a recent e-auction in which Derby City Council saved more than £250,000, 40% of its original projected cost, on new mobile phones for its workforce.

Rob Knapman, Buying Solutions' director of e-commerce, said: "We were delighted to provide Derby City Council with financial assistance to help to run what has been a hugely successful exercise - but because we would also like other organisations to share in the excellent results that e-auctions can clearly deliver, we decided to put this latest offer together.

"Secure, online e-auctions are increasingly being used across the public sector as an effective procurement tool providing an excellent value for money solution which encourages a heightened level of competition as the auction unfolds and optimises cost savings.

"We have recently facilitated e-auctions across mobile solutions, IT hardware and furniture, with customers benefiting from savings ranging from 13% to 45% across these categories. The benefits are not limited to these areas with products and services from most of our framework agreements suitable for an e-auction."

DNA pioneer criticises government position

Thu, 04 Feb 2010 00:05:00 GMT

The developer of DNA fingerprinting and profiling has said the government is wrong in retaining profiles of innocent people

Geneticist Sir Alec Jeffreys told MPs that he was "astonished, perplexed and deeply worried" about the existing management policy of the National DNA Database.

He was providing evidence to the House of Commons Home Affairs Select Committee in a session on the database on 3 February 2010. Currently everybody arrested in England and Wales has to provide a DNA sample, and the government has been heavily criticised for retaining profiles of people not charged or found innocent. The European Court of Human Rights ruled against the policy of indefinite retention in late 2008.

In response to a question from committee chair Keith Vaz MP on whether he stood by his criticism of the Home Office's revised proposals of retaining the DNA of anyone who is arrested for six years, Jeffreys replied: "Yes I do indeed, even six years is a unique situation. We are the only country in the world that keeps DNA for that length of time. New Zealand is the closest I can find. No other country is doing this."

When asked by Liberal Democrat MP Tom Brake what additional controls should be added to the current system, he said innocent people should be taken off the database. He added that he would "object profoundly" if his own DNA was put onto the system.

"DNA is intimately different to fingerprinting, it carries incredibly intimate information about who you are, where you're from and your family," said Jeffreys. He made reference to a recorded suicide due to an innocent person's shame at being on the database and pointed out that the likelihood of a false match "was not zero".

The geneticist said England and Wales should follow Scotland's lead, where police only retain the DNA profiles of innocent people under specific circumstances, with those accused of sexual assaults having their profiles held for a maximum of five years.

Plans by the United Arab Emirates to introduce a mandatory database for the whole population should be watched closely by the UK "to see if it does impact on criminal protection", said Jeffreys.

Manchester police recover from Conficker

Wed, 03 Feb 2010 14:18:33 GMT

Greater Manchester Police is again able to run inquiries on the Police National Computer (PNC), after the force purged a Conficker worm infection from its network

The malware infection left police unable to run PNC checks on suspect persons or vehicles between the evening of Friday 29 January 2010 - when a decision to disconnect from the PNC database was taken in order to prevent the infection from spreading - and the morning of Wednesday 3 February, when links were restored, reports The Register.

Links to court systems were also suspended while the Conficker outbreak was brought under control. However, crime log systems were not affected by the outbreak.

The force stressed that it had no effect on day to day operations or its service to the public, as assistant chief constable Dave Thompson explained in a statement issued on 3 February.

"A team of experts has now removed the virus affecting GMP's IT over the weekend and all computer systems are now fully operational," he said. "The virus, Conficker, was identified on Friday 29 January 2010.

"We had systems in place to ensure this did not affect our service to the communities of Greater Manchester. It is still not clear where the virus has come from but we are investigating how this has happened and are taking steps to prevent this from happening again," he added.

Security experts reckon the malware was most probably introduced onto the GMP network through an infected memory stick. However, this remains unconfirmed.

Other victims of Conficker, which originally spread in November 2008 by taking advantage of a Windows vulnerability, have included the Ministry of Defence, Parliament and Manchester City Council. The council infection last February wound up costing taxpayers £1.5m in lost parking ticket revenue and security clean-up fees.

Borough reveals CCTV patrols on website

Wed, 03 Feb 2010 14:04:22 GMT

A London borough has placed a list of sites regularly patrolled by its traffic enforcement vehicles on its website

LB Waltham Forest said the moved is aimed at encouraging drivers to follow the rules at the locations disclosed, rather than maximising income from fines.

The sites are patrolled by five vehicles equipped with cameras, primarily for 'moving traffic' offences such as stopping in box junctions, driving in bus lanes and making banned turns, although they are also used for parking enforcement.

The council said the list of 33 locations was not exhaustive, so drivers could not be sure they would not be caught elsewhere. "In any enforcement, there has got to be an element of, you don't know we're coming," Bob Belam, the borough's cabinet member for the environment, told GC News.

But he added that it made sense to put the list of usual locations online, as the cars are already obvious on the road. "These are little Smart cars with cameras sticking out the roof, and they say CCTV," he said. "I don't think there's anything wrong with informing people."

Many councils have recently taken over traffic enforcement work from police, and now receive the income from fines. Belam said many people think councils use this as a form of income, but added that the enforcement work requires funding, as does road maintenance such as repairing pot holes.

"If I was trying to maximise the income, I wouldn't have five cars, I'd have 10," he added.

Police have more than 10,000 ANPR cameras

SA Mathieson — Wed, 03 Feb 2010 00:10:00 GMT

Police have confirmed that forces in England and Wales are passing up to 14m reads per day from automatic numberplate recognition cameras to a national database

All but two of England and Wales' police forces are passing data to the National ANPR Data Centre, run by the National Policing Improvement Agency (NPIA) on behalf of the Association of Chief Police Officers (Acpo).

Acpo told GC that the centre is currently taking data from 10,502 ANPR enabled cameras. Forces use their own equipment, but also take data from converted CCTV cameras run by local authorities. It added that the centre is currently recording 10m to 14m numberplates per day, although it has the capacity for 50m.

The numberplate data, including tightly cropped images of the plates, is held by the centre for two years. Acpo said it has no plans to extend this to five years, a figure cited in earlier police documents about the centre. "Acpo and the NPIA are currently working with the Information Commissioner's Office to ensure that data retention is appropriate and proportionate," said a spokesperson.

The ICO said it is still in discussions over the matter. "The ICO recognises that automatic number plate recognition can assist in the detection and prevention of crime. However, it is important that where large amounts of personal information are collected and retained adequate safeguards are in place to protect individuals' privacy," it said.

"Any prolonged retention would need to be clearly justified based on continuing value, not on the mere chance it may come in useful. We are currently speaking with the relevant organisations involved to ensure any retention period proposed is in compliance with the (Data Protection) Act."

Some police forces also use their ANPR cameras to capture larger images of drivers and passengers for up to one year, although these are not stored on Acpo's central database.

Police forces refuse to disclose the location of their ANPR cameras, although a few systems, such as London's congestion charging cameras, are known to provide such data to the police. Acpo refused to say how many cameras each force has in use.

The number of police cameras is significantly more than the 6,600 ANPR units run by the Highways Agency and Trafficmaster. These do not transmit full numberplates, as they are used to calculate the speed of traffic over sections of road.

Feature article from GC magazine: The ANPR secret

SA Mathieson

University team releases feedback plug-in

Wed, 03 Feb 2010 00:05:00 GMT

A team from the University of Lincoln has developed Wordpress software to encourage public feedback on important documents

Named digress.it, it is a free plug-in for the open source content management system, enabling readers to comment, discuss and annotate an online document.

It was created with funding of £26,000 from the Joint Information Systems Committee (JISC), as part of the JISCPress project. This is run by Joss Winn, technology officer at the University of Lincoln's Centre for Educational Research and Development (CERD), in partnership with Tony Hirst, an academic at the Open University.

The development has been based on their experience over the past year of inviting public comment on Crown Copyright documents through an earlier version of the software on the WriteToReply website. They said they have obtained numerous responses on documents such as last year's Digital Britain Interim Report, and have now been asked to collate online responses to the Cabinet Office's new UK Government ICT Strategy.

Winn said: "We think it's a great way of joining up public documents and their responses on the web.

"In the past, people would simply be asked to download a PDF and email their responses to a public consultation. WriteToReply and the software that we've developed during our project allow people to direct their comments to any specific paragraph and respond to other people's comments, making the consultation process more deliberative."

He added that it is possible to link specific paragraphs to other documents, and that users of other sites such as Facebook or Twitter can share links to specific points.

Policing: The ANPR secret

SA Mathieson — Wed, 03 Feb 2010 00:05:00 GMT

Police forces are making extensive use of their numberplate cameras, but proving coy about their locations

Automatic numberplate recognition (ANPR) is almost inescapable in cities and on major roads in Britain. There are thousands of cameras equipped with software to read numberplates automatically.

Many of these cameras are less of an intrusion on privacy than may be feared: the 6,600 ANPR traffic monitoring cameras run by the Highways Agency and Trafficmaster do not transmit numberplates. But according to the Association of Chief Police Officers (Acpo), there are 10,502 ANPR cameras collecting data for police forces – including cameras run by councils, which pass data on – which transmit full registration numbers, and in some cases photos of drivers and passengers, with the former held for two years at the National ANPR Data Centre (NADC).

The centre, which is run by the National Policing Improvement Agency on behalf of Acpo, currently records 10m-14m numberplate spottings a day from nearly all forces in England and Wales. The fact that the system has been designed to handle 50m spottings suggests there is plenty of potential for growth.

NADC, which becomes fully operational later this year, stores both the numberplate and the digital images from which the data has been derived for two years. Acpo says there are no plans to extend this retention period to five years, a figure quoted in earlier police documents on plans for the centre.

"Acpo and the NPIA are currently working with the Information Commissioner's Office to ensure that data retention is appropriate and proportionate," says a spokesperson, adding that some forces also store photographs of drivers and front seat passengers for up to a year, although on local systems rather than the national database.

As with the National DNA Database, the legal data controllers are the chief constables of the forces which gathered the data.

ANPR cameras have been in use for more than two decades. According to Denying Criminals Use of the Roads, a 2004 document from Acpo's National ANPR User Group, the technology was developed in the 1980s when covert devices were used for counter-terrorism. City of London Police installed such cameras in a ring around the city in 1997, and by 1999 15 forces were using the technology. By 2002, all in England and Wales had adopted it.

Some forces have since moved from using a few mobile units to a network of fixed cameras. Transport for London passes the ANPR data from its congestion charge cameras around central London to the Metropolitan Police. In 2008, Greater Manchester Police said it was setting up 12 fixed cameras around the city centre to record 660,000 journeys through the area every day. A similar ring of police cameras is in place around the centre of Birmingham.

Senior police officers say the technology is important in tackling crime, and it has been used in some high profile court cases, including terrorism trials. It can also be used for vehicle related crime: as well as storing the data, the NADC analyses it, An example is looking for the same plate apparently moving from one part of the country to another at an impossible speed, implying a cloned plate.

It is also used in more controversial circumstances: ANPR systems have led to police officers stopping a hire car which was used to steal petrol weeks earlier, someone whose insurer failed to remove her from a database of uninsured drivers, and anti-war campaigners whose vehicle had been added to a watchlist after police noted it at protests.

Leaving aside its proportionality, there is question over how effective ANPR can be in much of the country. Department for Transport research says that road vehicles in Britain cover around 866m miles every day, implying a driver would currently be captured once every 72 miles. However, most of the cameras seem to be in cities, with very few elsewhere.

The locations of the cameras are, in most cases, a secret. GC made Freedom of Information requests to four non-metropolitan forces to disclose the location of their fixed ANPR cameras and their spending on the technology. All refused on the former, and just one force provided information on the latter.

Thames Valley Police replied that it had spent £1.94m on ANPR by October 2009, and that this will have reached £2.6m by March 2010. It has requested further funds for the following three years, although these have not yet been allocated. Last August, it awarded a framework contract, worth up to £10m, to five firms for ANPR equipment and services.

Arrests and recoveries

Thames Valley, which describes itself as one of the leading forces in the country in its use of ANPR, recently opened a unit to monitor the cameras' output 24 hours a day. "In the last two months, the unit has been directly responsible for 53 arrests, the recovery of 26 stolen motor vehicles and recovery of property to the value of almost a quarter of a million pounds," says ANPR manager John Knight. "It is anticipated these figures will continue to rise."

He adds that the camera network reduces the need for on-the-ground surveillance, in turn cutting costs and risk to officers, along with data analysis of suspects' movements. "It is difficult to show this in financial savings, but Thames Valley Police is fully committed to the use of ANPR and believe it is an invaluable tool in the fight against crime," Knight says.

Last year, the force said it had 47 fixed ANPR systems in place, and planned to add 34 more, each costing £35,000. But even when it has completed this, the force will have 81 fixed ANPR systems for all of Berkshire, Buckinghamshire and Oxfordshire, a large chunk of south-east England covering 2.1m people. Particularly outside cities, anyone who does a little visual research should be able to avoid driving past such cameras if they wish – presumably including criminals.

One set of ANPR cameras in the Thames Valley area provide an example of how easy it can be to avoid being spotted: they are installed on the main road through a town, but are the only roadside cameras of any kind in the area, and are easy to get around.

Observation suggests that the same may also be true on many motorways. ANPR cameras used for traffic monitoring only need to capture a sample of numberplates to calculate average speeds, so they tend to monitor just one lane. (They also have a distinctive colour and shape.) They are very common, whereas multiple-lane camera installations – presumably used by the police to capture traffic in every lane – are very rare, with just one set visible on the 100 miles of the M5 between Cheltenham and Exeter.

Except when used in rings such as around big cities, the fixed ANPR cameras used by the police are reliant to some extent on the position of highly visible equipment remaining a secret. Security experts call this 'security by obscurity,' with many arguing that a system which relies on poorly guarded secrecy is likely to be of limited value, which will fall as the 'secret' spreads.

Police secrecy over locations and, in many cases, spending makes the usefulness of fixed ANPR cameras hard to assess. But in at least one area, that assessment is starting to be made: in December, Thames Valley Police Authority asked its force to justify the planned further spending on ANPR on value for money grounds. The force was planning to produce a report on this during January.

This article was first published in the February 2010 issue of GC magazine. Click here to apply for a subscription.

SA Mathieson