UK government dragged for incomplete security reforms after Afghan leak fallout
- Reference: 1756467910
- News link: https://www.theregister.co.uk/2025/08/29/uk_government_breach_review/
- Source link:
Chi Onwurah, chair of the committee that pushed for the secret review to be published on Thursday, said the previous government that oversaw the investigation has questions to answer over why only 12 of the 14 changes have been made.
Senior minister Pat McFadden and Information Commissioner John Edwards have been asked to explain the context around the review and how the government plans to prevent sensitive breaches from happening again.
[1]
The existence of the [2]review , carried out in 2023, has never been publicized.
[3]
[4]
It examined 11 major UK data breaches between 2008 and 2023, including the Ministry of Defence's (MoD) [5]dangerous email blunder that exposed the details of Afghans who worked with British forces during the conflict with the Taliban, as well as British troops and spies.
The others included a similar email mistake made by the [6]Police Service of Northern Ireland , [7]Norfolk and Suffolk police forces , Digital ID, another [8]MoD leak of data to Malian recipients instead of US military (.ml/.mil), and more in the public sector.
[9]
Overall, the review found that each case had unique qualities, but common themes included a lack of controls over downloads, leaked information via "wrong recipient" emails, and hidden personal data in spreadsheets in spreadsheets published online.
The full list of recommendations had deadlines ranging from November 2023 to August 2024, and included matters such as ensuring the proper technical controls are in place and data protection processes are clearly visible on staff intranets.
A committee spokesperson told The Register that it knows only 12 of the 14 have been implemented, but it does not yet know what the two missing ones are.
[10]2 charged over alleged New IRA terrorism activity linked to cops' spilled data
[11]You're not seeing double – yet another UK copshop is confessing to a data leak
[12]Typo watch: 'Millions of emails' for US military sent to .ml addresses in error
[13]UK Ministry of Defence apologises after Afghan interpreters' personal data exposed in email blunder
It hopes to understand this better following the meeting with McFadden and Edwards.
Onwurah said: "I'm glad that this information security review has finally been made public, but it's concerning that it took an intervention from my committee and the information commissioner to make this happen.
[14]
"The government still has questions to answer about the review. Why have only 12 of the 14 recommendations been implemented? And why has it kept the very existence of this review a secret for so long, even after the 2022 Afghan Breach became public?
"Proper scrutiny on this is desperately needed, and it's crucial we have a better understanding of how the government plans to stop these dangerous data breaches.
"For the government to fulfill its ambitions of using tech to boost the economy and transform our public sector, it needs the public to trust that it can keep their data secure. If it can't, how can anyone be comfortable handing over their personal information?"
McFadden concurred with Onwurah on the necessity for the public to trust its data is safe in government hands, according to a letter he sent that was published by the committee.
Regarding the recommendations, McFadden, the chancellor of the Duchy of Lancaster, said: "Good progress has been made but we must guard against complacency."
Edwards also agreed, saying: "The government needs to go further and faster to ensure Whitehall, and the wider public sector, put their practices in order. As a matter of urgency, the government should fully implement the recommendations of the Information Security Review which the Cabinet Office undertook following the PSNI breach."
The Information Commissioner agreed to meet with the committee, and McFadden said he plans to meet with Edwards in September to discuss the review's findings. ®
Get our [15]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aLHOlzSDfC_4SyVw9YS9-AAAAFU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.gov.uk/government/publications/information-security-review-2023-final-report/information-security-review-2023-final-report-html
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aLHOlzSDfC_4SyVw9YS9-AAAAFU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aLHOlzSDfC_4SyVw9YS9-AAAAFU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2021/09/21/mod_email_fail_afghan_interpreters_data/
[6] https://www.theregister.com/2025/02/14/two_charged_psni_data/
[7] https://www.theregister.com/2023/08/15/norfolk_and_suffolk_police_data_breach/
[8] https://forums.theregister.com/forum/all/2023/07/18/us_military_mali_email_typos/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aLHOlzSDfC_4SyVw9YS9-AAAAFU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2025/02/14/two_charged_psni_data/
[11] https://www.theregister.com/2023/08/15/norfolk_and_suffolk_police_data_breach/
[12] https://www.theregister.com/2023/07/18/us_military_mali_email_typos/
[13] https://www.theregister.com/2021/09/21/mod_email_fail_afghan_interpreters_data/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aLHOlzSDfC_4SyVw9YS9-AAAAFU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://whitepapers.theregister.com/
"Seems the ICO is marking it's own homework if they have allowed the MoD to dictate the terms of their investigation"
It's the MoD that owns the guns and the MPs (no, not those MPs) so setting the terms would have been a bit one-sided.
Cast your minds back to the early 1900s.
Suddenly there were lots of motor vehicles on the public roads in the hands of completely untrained users.
Result: carnage.
There was no Highway Code. Here in the UK we had to wait until 1931 for that.
There were no driving licences. Where I live, it wasn't until 1933 that you had to pass an examination of competence to get one.
There were no Ministry of Transport vehicle tests. Believe it or not they didn't come in until 1960 - which was several years after my first three motorcycles were built - and even then it was voluntary until the Powers That Be realized with dismay how large a proportion of the vehicles were failing the tests.
Gradually we started to get to grips with putting potentially dangerous equipment in the hands of a public by and large incompetent to handle it. Although there's still carnage, there's a bit less of it.
It took half a century.
So here we go again, putting yet more potentially dangerous equipment into the hands of a population utterly incapable of operating it safely.
Governments, heaven help us, are even making it MANDATORY for things like taxation. They seem, in their cluelessness, to think that it might save them money.
This is collective insanity. OF COURSE it has caused the shedding of tears by countless people and organizations. How could anyone ever have expected otherwise?
When will we ever learn?
When will we ever learn?
A slap on the wrist
and collect a Goto Jail card [directorship or two] on the way out
According to the BBC, there were secret meetings between the ICO and MoD where written notes were forbidden - so no wonder that nobody knows what's going on as two different government departments have deliberately designed it that way between themselves.
Seems the ICO is marking it's own homework if they have allowed the MoD to dictate the terms of their investigation, and further allowed the MoD to ignore actually implementing the required changes necessary to protect personal data and enforcing the law - heads on both sides should roll for this one...