Security threats Toolkit

Home Office axes data-loss firm's contract

Tags:
Handling,
Speech,
Loss,
Contracts

Tom Espiner ZDNet.co.uk

Published: 10 Sep 2008 16:48 BST

The Home Office has terminated one of its contracts with PA Consulting, following the loss of 84,000 prisoners' data.

The termination of the contract to administer the prisoner-tracking JTrack system, worth £1.5m, was announced by the Home Office on Wednesday.

"The Home Office has terminated the contract with PA Consulting that covered the handling of this data," Jacqui Smith, the home secretary, said in a speech to parliament on Wednesday.

PA Consulting notified the Home Office on 19 August that it had lost data on the entire prison population of England and Wales. Smith said in her speech that an inquiry into the incident had found that the data had not been handled securely by PA Consulting.

The data had been downloaded onto a memory stick at the company offices. The stick was intended to be used to transfer the information between two PCs. The memory stick was "not encrypted or managed effectively", said Smith, and was subsequently lost.

"This was a clear breach of the robust terms of the contract covering security and data handling," Smith added.

A PA Consulting staff member was suspended in August following the loss of the USB stick. The administration of JTrack is currently being handed over to the Home Office by PA Consulting.

Data transfers to PA Consulting for JTrack were suspended following the incident. System maintenance and user training will be transferred to the Home Office by December, said Smith.

Read this

Protect your mobile devices in any location

Forget the recent hype about about Chinese hackers — users and organisations should be securing mobile systems as a matter of course, so follow these tips to find out how

Further contracts that PA Consulting has with the Home Office, worth £8.5m, are currently being reviewed, "specifically from a data-handling and security perspective", said Smith. The company has been involved in the government's ID cards scheme, having been awarded an £18.75m, two-year contract in 2004.

The Ministry of Defence has also admitted that one of its employees has lost an unencrypted data stick, containing staff and training details, on the floor of a Cornish nightclub. News-agglomeration site ThisIsCornwall.co.uk reported on Tuesday that the stick was lost in The Beach nightclub in Newquay in May.

Paul Davie, founder of security company Secerno, said: "The question needs to be asked: why is such sensitive data ever kept on USB memory sticks, which are so easy to lose? It's ridiculous."