Backup Tapes Go Missing From Government Agency

It has emerged that a Governmental agency has lost backup tapes containing the payment and banking details of 100,000 farmers in the United Kingdom.

The UK Rural Payments Agency (RPA) apparently lost the backup tapes back in May. The lost tapes contained confidential data belonging to every farmer in England who has ever claimed a single farm payment.

RPA immediately alerted DEFRA (the British Government’s Department for Environment, Food and Rural Affairs), but according to Farmers Weekly, it seems to have failed to inform anybody else of the matter, including the farmers that have been affected.

The farming publication claimed it was tipped off by frustrated civil servants working on the single payments system within the RPA and an external consultant who has been advising the agency. They were concerned that the RPA and DEFRA would remain tight-lipped over the incident and about the risks the breach posed to farmers.

The report suggests that a total of 39 backup tapes went missing after they were transferred from RPA offices in Reading to Newcastle. 37 of the tapes have since been recovered, but two remain unaccounted for.

DEFRA has admitted that tapes went missing, but told Farmers Weekly that the data was not lost in transit but was instead misplaced within the data centre. A DEFRA spokeswoman apparently told the publication that a thorough search had concluded that some tapes were misfiled and placed ‘on the wrong shelf’.

The spokeswoman identified RPA-contracted IT consultants from IBM as the likely culprits, as Big Blue runs the data centre where the loss occured. DEFRA said it assumed that the two tapes that were never found must have been destroyed.

DEFRA has also admitted that the data on the tapes was not encrypted, but it insisted information could not be accessed without specialised technical equipment and knowledge.

“Since these incidents, procedures have been further tightened to prevent a recurrance. IBM have instigated a thorough review of their procedures to manage removable storage media, such as these tapes, as well as tightening access control requirements,” DEFRA told Farmers Weekly.

“The tapes are held in a secure IBM data centre and only IBM and Accenture technicians have access to them. Both IBM and Accenture were asked to review their security arrangements as a result of this incident.”

DEFRA said the risk posed to farmers was very low.

Back in July, the UK Ministry of Defence admitted it lost an entire server from a secure building – as well as 1.7 million individuals’ personal data. Meanwhile a BSI survey in June revealed that almost one in five businesses have breached the Data Protection Act (DPA) at least once.