NCC Suspended from Using DVLA Website?

Various reports about the place claiming that several local authorities, including NCC, have been suspended from accessing the DVLA database for 'irregularities' of one kind or another, depending on who you believe.

The original article was in the Sunday Express and claimed that the suspensions were for 'illegally spying' on people. Unsurprisingly this upset a few councils' press officers, including NCC's who described the report as 'inaccurate'. A slightly less agenda driven and probably better researched article on 'The Register' website makes things a bit clearer.

As 'The Register' points out much of the so-called spying that authorities are accused of is actually entirely legal and therefore would not result in council's being suspended from using the database. However, the DVLA has certain security and administrative requirements that authorities must comply with and it seems that it's their failure to do that which has resulted in a temporary suspension.

Interestingly the requirements mentioned in the 'Register' article mostly concern security issues and NCC's IT security has been a bit of a live issue for some time, see my earlier post and this recent report to the Audit Committee. Not quite the same issues I know but it does make you wonder if they haven't quite got a 'security culture' in place.

I've written to the DVLA press office but whether they'll be prepared to lower themselves to reply to a mere blogger remains to be seen, if they do I'll update.

IT Trubs

A while ago I noticed that there were hints of IT security trouble up at t'mill but I couldn't find anything concrete about it. There were a couple of references to confidential reports in meeting minutes but no detail because the public were excluded.

A little bit has come out now via a report to the Audit Committee although some of it has been kept confidential.

Apparently 14 areas of high level of risk were identified of which 4 remain. The report reveals that NCC were caught by the Conficker virus (although not as badly as Manchester City Council as the report falls over itself to point out). Perhaps most seriously, a new security manager identified a serious flaw in the credit card payments system that could have resulted in a fine and/or the loss of the ability to take credit card payments if it hadn't been addressed. The report doesn't describe the nature of the lapse but any combination of the words 'security lapse' and 'my credit card details' would be enough to give me the heebie-jeebies.

Apparently they've sent the IT team on some training as well. Which is nice.

Update; Found an earlier report describing some of the fallout of the Conficker infection here. Some of the cost was due to a need to replace 350 computers at a cost of £185k because they were too old to apply the MS Malicious Software tool and other anti-virus gubbins. This probably gives you a clue as to how old these machines were.