News: 1667313005

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

Government by Gmail catches up with UK minister... who is reappointed anyway

(2022/11/01)


The UK's Home Secretary – the minister in charge of policing and internal security – has been forced to apologize for breaching IT security protocols in government.

Suella Braverman, who had already resigned for the breach, was reinstated in the UK's merry-go-round approach to government. She has written to the chair of Parliament's Home Affairs Select Committee to explain her actions and how she planned to avoid repeating them.

The missive details six occasions where she forwarded ministerial documents to her personal Gmail account. On some occasions, she said she needed to do so in order to view documents on her private phone while conducting a Microsoft Teams video call on her official phone.

[1]

On another occasion, she accidentally forwarded official documents to a Member of Parliament from her Gmail account because she did not have her phone with her.

[2]

[3]

In [4]the letter [PDF], Braverman explains that while travelling in a car on October 19, "I did not have my departmental phone (and therefore departmental email) on me at the time. I only had my personal phone and email to hand."

She asked her special advisor to forward documents to her private email account so she could view and edit a Written Ministerial Statement while in transit. She then forwarded the document to Sir John Hayes MP, former security minister, member of the Intelligence and Security Committee, and privy counsellor, part of a group of formal sovereign advisers.

[5]

"I addressed it to Sir John's parliamentary email and intended to copy his secretary's parliamentary email address. However, I entered the incorrect email address for his secretary unintentionally and unknowingly," the letter said.

[6]UK facing electricity supply woes after nuclear power stations shut, MPs told

[7]India's – and Infosys's – favorite son-in-law Rishi Sunak is next UK PM

[8]Liz Truss ousted as UK prime minister, outlived by online lettuce

[9]New measurement alert: Liz Truss inspires new Register standard

The error caught up with Braverman. The email ended up with a member of staff employed by fellow Conservative MP Andrew Percy. He emailed Braverman: "Can you tell me what the Ministerial Code says on this and what the processes are in the Home Office for the sharing of sensitive government documents via Gmail. Simply asking my team to delete this email and ignore it is not an acceptable response to what appears, on the face of it, to be a potentially serious breach of security… I hope an explanation will be forthcoming. You are nominally in charge of the security of this nation, we have received many warnings even as lowly backbenchers about cyber security."

After the chief whip – an MP who polices Parliamentary parties – and the Prime Minister got involved, Braverman resigned in spectacular fashion in the run-up to the departure of former prime minister Liz Truss, who lasted a little less than 45 days.

To the surprise of many, Braverman was reappointed as Home Secretary, but not before some serious IT training, according to the letter.

"I have requested briefing and guidance by security experts on what constitutes appropriate use of Government and personal IT. I have now received this briefing," she assured MPs.

[10]

Braverman's admission of an unusual approach to IT security while in government comes after an investigation was launched into the use of WhatsApp channels, with questions raised about decision-making without record-keeping or scrutiny. In July, the Information Commissioner's Office promised to look into the "systemic risks" inherent in private correspondence channels. ®

Get our [11]Tech Resources



[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y2FQr3AtmJakImTAokPobgAAAA0&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y2FQr3AtmJakImTAokPobgAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y2FQr3AtmJakImTAokPobgAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[4] https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1114666/311022_HASC_letter.pdf

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y2FQr3AtmJakImTAokPobgAAAA0&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://www.theregister.com/2022/11/01/electricity_shortages_uk/

[7] https://www.theregister.com/2022/10/25/uk_conservative_party_promotes_its/

[8] https://www.theregister.com/2022/10/20/prime_minister_liz_truss_resigns/

[9] https://www.theregister.com/2022/10/21/truss_reg_standards/

[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y2FQr3AtmJakImTAokPobgAAAA0&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[11] https://whitepapers.theregister.com/



Lord Elpuss

In the scheme of "UK Gov Shitshows so far in 2022", this is a non-issue.

Retrain and put her back to work. Which is exactly what's happened.

smudge

In the scheme of "UK Gov Shitshows so far in 2022", this is a non-issue.

No. It is the tip of the iceberg. (Another lettuce to bring the government down!)

She admitted that she did it six times in the six weeks that she was Home Secretary for the first time. Presumably because she has been confronted with the logs showing these six events.

Follow-up questions which should be asked include:

- how many times did she do this during the 31 months that she was Attorney General? (for those overseas, that position is the most senior law officer in the government)

- how widespread is this practice throughout government?

Don't look behind the curtain

ChoHag

But it could be worse. Governments could be competent...

Anonymous Coward

"- how widespread is this practice throughout government?"

Ask Hillary Clinton :)

Anonymous Coward

> "She admitted that she did it six times in the six weeks"

She sent a document to her own gmail 6 times. She sent it from there to the wrong person once (that we know of)

But what kind of information governance allows sensitive material to be sent by email outside the organisation? That is the bigger question, not some numpty's misuse of it.

Rameses Niblick the Third Kerplunk Kerplunk Whoops Where's My Thribble?

In the scheme of "UK Gov Shitshows so far in 2022", this is a non-issue.

I'm pretty sick of this kind of attitude. "Everything else is so awful, this thing that's a bit shit doesn't matter". Of course it matters, if I'd done this with sensitive company documents I wouldn't be retrained, I'd be fired for gross misconduct. The fact it was done 6 times in such a brief tenure ask Home Sec means this is not a mistake, it is a habitual way of working for her, it's just this is the first time she's been caught it's been detected.

I'm beyond the point of accepting "I know our politicians are beyond useless, but we accept it because we tell ourselves the others are just as useless". Why do we think this is OK? Why as a population do we accept it? These people are meant to be the best of us, the wisest of us and yet I wouldn't leave them alone for 5 minutes unsupervised in a room with a pair of safety scissors. The excuse "We think others are as bad" is not a reason to accept it.

why do we accept it?

Anonymous Coward

"I'm beyond the point of accepting "I know our politicians are beyond useless, but we accept it because we tell ourselves the others are just as useless". Why do we think this is OK? Why as a population do we accept it? These people are meant to be the best of us, the wisest of us and yet I wouldn't leave them alone for 5 minutes unsupervised in a room with a pair of safety scissors. The excuse "We think others are as bad" is not a reason to accept it."

Everybody is free to stand for election against 'these people' and everybody else is free to vote for them. So if we want a change, all we have to do is change our voting habits. Stop electing 'these people'. And stand for parliament against them. Simples! :)

Re: why do we accept it?

Rameses Niblick the Third Kerplunk Kerplunk Whoops Where's My Thribble?

So if we want a change, all we have to do is change our voting habits. Stop electing 'these people'.

Which is exactly my point, and yet people insist on voting for these imbeciles and putting them in power, despite all previous experience. If people still want conservatives in charge in spite of the last few years, no amount of "someone I never heard of" putting their name on the ballot is going to change masochistic tendencies.

That being said I would gladly stand against them, care to lend give me the £500 it costs to do so? Unfortunately I can't afford to throw that kind of money away.

Re: why do we accept it?

Primus Secundus Tertius

Parliament and government are supposed to represent ordinary people. This incident proves that they do. Government by supposed experts would be like government by the civil service: awful.

Anonymous Coward

If I'd done this with sensitive company documents I wouldn't be retrained, I'd be fired for gross misconduct

It's even worse than that. These are government documents we're talking about, not corporate....send those where they aren't meant to go and you could be looking at imprisonment.

old news...

Anonymous Coward

The Register seems to be rather late...

The lettuce knew of this before you...

Phones?

Neil Barnes

On some occasions, she said she needed to do so in order to view documents on her private phone while conducting a Microsoft Teams video call on her official phone.

If only there were some sort of IT device with a screen big enough to do more than one thing at a time on...

Re: Phones?

Howard Sway

Or even better, imagine if the government could have been able to afford to buy her two phones. Or if they could afford a new toner cartridge and print out government documents for her, which could have been secured in some kind of box.

We might have been one spyware loaded "sink the migrants" game in the app store away from our entire national security being blown wide open.

RMS

thondwe

You'd sort of hope that HMG's I.T. people would enforce RMS/conditional access etc for important docs - rather than relying on policies which are routinely ignored!!

Re: RMS

Giles C

Yes it should be easy, studying for the ccnp security exam to renew it and in the section on email security one of the chapters is data loss prevention or how to stop confidential docs going to unsafe email addresses.

It isn’t that hard to configure either

FTFY

Oh Matron!

"To the disgust of most, Braverman was reappointed as Home Secretary"

Jury nullification (google it)

Anonymous Coward

If these fuckers think they can get away with it, then it's a lucky day for any sod accused of it with me on their jury. I know judges are up to their necks in it, but for now you can't stop a juror saying "fuck you Cruella".

Good old days

Anonymous Coward

When I worked for the Attorney General life was so simple. Classified documents came and went by hand. The AG had two phones, one was scrambled, and for anything urgent, there was always the telex.

John Riddoch

Pretty sure if I sent a document marked "confidential" to my home gmail account from work it would count as misconduct with an attendant likelihood of being sacked. 6 times? I'd definitely be out with a black mark on my name for a job. Why is this deemed tolerable for someone who is allegedly in charge of national security and policing? To wave it away with "I've had IT training so everything is fine" is crap, this should be basic confidentiality training for any incoming politician so I'd be surprised if she hadn't had the exact same training at various points in the past, she just chose to ignore it. If there isn't training given to politicians on IT security and document handling, someone needs a massive boot up the arse to get it sorted.

Inventor of the Marmite Laser

Take her personal phone and stick it in a blender

DJV

I suspect that has already been done to her brain, especially given the crackpot ideas she and her predecessor came up with.

Plus ca change

steelpillow

So we threw out Boris and his gang for holding parties because they were above their own law, not to mention being a menacing bunch of loose cannon.

Then we threw out I've-forgotten-her-name-already for being above the natural laws of the financial markets, not to mention being a fracking menace.

Now we have a Home Secretary who is breaking cybersecurity law because she is above the laws she is responsible for. I mean, what kind of excuse is it that she forwarded Govt stuff from Gmail because it was the only phone she had - it shouldn't have been in her Gmail box in the first place! Not to mention being a menace to all "invading" desperate foreigners. Then there was the story about her which appeared here about a week ago and shortly afterwards mysteriously disappeared.

So that's all right, then.

Sacking is not enough

Yet Another Hierachial Anonynmous Coward

Another clueless dipshit idiot in charge of the country. As if hashtags Rudd was not bad enough. What was she thinking? All that training, signing the OSA (I presume she must have done that to become home secretary), constant briefings on cyber terrorism, knowledge of auditing and traceability, and she still does something like this 6 times? And on a gmail account of all things. Now big brother google knows more about our government policies than the government.

Surely when you become a senior government minster, someone from somewhere tells you to close all your personal "publicly hosted" free email accounts, and only use a personal email account that is hosted in a suitably secure environment.? Aside from anything else, the ability to get malware through a public account like that is just not worth any risk. No doubt Liz trusses hacked phone suffered similar.

In any commercial organisation distributing internal classified information would be a sackable offence. It needs to be in this case too. And properly sacked. Not just removed from the cabinet, but sacked as an MP for misconduct in public office and a by-election called. Then people (and her cronies) would actually start to question and understand what she has done.

They told me you had proven it When they discovered our results
About a month before. Their hair began to curl
The proof was valid, more or less Instead of understanding it
But rather less than more. We'd run the thing through PRL.

He sent them word that we would try Don't tell a soul about all this
To pass where they had failed For it must ever be
And after we were done, to them A secret, kept from all the rest
The new proof would be mailed. Between yourself and me.

My notion was to start again
Ignoring all they'd done
We quickly turned it into code
To see if it would run.