6 ms·

> The member of the public decided to tell The Sunday Mirror newspaper about the find, which days later published a story claiming the loss could potentially ha

> The member of the public decided to tell The Sunday Mirror newspaper about the find, which days later published a story claiming the loss could potentially have compromised airport security, including putting Queen Elizabeth II, politicians and VIPs at risk. > Yesterday, the company with the job of looking after the data, Heathrow Airport Ltd (HAL), was fined £120,000 ($160,000) by Britain’s Information Commissioner (ICO) for allowing this to happen. That's a surprisingly tame fine. I would've expected a couple more zeroes.

M2Ys4U 8y ago
The maximum fine (under legislation in force at the time of the breach) was £500,000. But I agree, £120k seems low.
- EnderMB 8y ago
  I'd say that £500k would be fair, but still fairly tame for how dangerous this breach could've been. £500k is essentially how much it would cost each year to hire a team to fix these issues and maintain their systems. If £120k is the punishment, what's the point in fixing the issue? It's more cost effective to accept the risk of a major security breach and the resignations of a handful of top brass.
  - M2Ys4U 8y ago
    Well the Information Commissioner has much greater scope for issuing fines now - remember that this is an old breach and any incident that happene[sd] after May 2018 is subject to the GDPR rather than the Data Protection Act 1998.
    - EnderMB 8y ago
      That's good, although I'm a bit wary of what will happen to GDPR after Brexit, and whether it gives the government a mandate to reduce penalties for businesses not meeting security standards.
detaro 8y ago
Why? Note that the security stuff makes nice headlines and is concerning, but isn't responsibility of ICO, so likely played no role in their fine.
- dmurray 8y ago
  Agreed, the personal data leaked was limited to a screenshot from a video in which 10 or 50 people's dates of birth and passport numbers were visible. As data breaches go, that really wasn't one.
pdpi 8y ago
Put into perspective — £120k isn't enough to hire two full-time people to work on this sort of problem, so why would they?
- rangibaby 8y ago
  See: the infamous Pinto memo
- SenHeng 8y ago
  That’s precisely why the fine is too cheap.
dpwm 8y ago
This isn't necessarily the first time they've done this, it's the first time they've been caught. Think of the money saved by not training 6370 staff in data protection and not having any kind of enforcement of policies. The minimum wage in the UK is now £7.83 per hour. Assuming it was £7.50 at the time, and that data protection training takes a couple of hours with no other costs, then that's about £95,000. Add in admin, national insurance, mandatory pensions and such and it's got to be about break even in a year. That's before we factor in staff turnover. Under the Data Protection Act 1998, there were cases where it clearly paid to deliberately not comply. Will a data breach make people choose to shop elsewhere? People already go out of their way to avoid Heathrow if they can, so any reputation loss is negligible.
shakna 8y ago
They reported it, and didn't try to hide it, for one. It occurred as a breach of internal policies for another.
99052882514569 8y ago
This isn't a fine, it's just the cost of not changing a security culture. Just some statistical noise on the balance sheet of a billion-pound corporation, nothing to concern oneself with if you're upper management.
ljm 8y ago
It seems to me that using money to enforce accountability is only something that works for people for whom money is quite a bit more scarce. You know, poor people, the middle class. You can really threaten someone's livelihood that way without resorting to prison. When you're looking at big business? Nah. They're not threatened by it: if the fine is too high the law doesn't get passed or it loses its teeth, because it's still cheaper to lobby for leniency. So you get a maximum threshold for a fine that is still pathetic and even further is likely never to be used. If that doesn't work, the business is big enough to threaten the government in power with an even greater loss by opting to dodge tax or shift operations elsewhere. Most of this legislation can be hacked through maths and clever accounting, or ultimately you just pay the workers less and increase the prices. Most businesses exist to make as much money as they can and you'd think that it would make it their most vulnerable spot, so you can hit them where it hurts. But it doesn't play out that way. It's essentially a monumental legal cop-out because there's no use holding the corporate entity itself accountable, because the corporate entity is pumping out money to the board no matter what. And we even recognise it as such by referring to such companies as having limited liability. Somehow the owner of a small business can lose their house and car if they fuck it all up, yet those in charge of a much larger company have an incredibly cushy layer of protection when they can deal infinitely greater damage when they put money above all else, sometimes malevolently so. Surely those liabilities should be reversed and the small shop should benefit from the protection from fucking up?
nirelBRACIT0S 8y ago
That’s quite a lot in UK, not everything is like SF.

M2Ys4U 8y ago

The maximum fine (under legislation in force at the time of the breach) was £500,000. But I agree, £120k seems low.

EnderMB 8y ago
I'd say that £500k would be fair, but still fairly tame for how dangerous this breach could've been. £500k is essentially how much it would cost each year to hire a team to fix these issues and maintain their systems. If £120k is the punishment, what's the point in fixing the issue? It's more cost effective to accept the risk of a major security breach and the resignations of a handful of top brass.
- M2Ys4U 8y ago
  Well the Information Commissioner has much greater scope for issuing fines now - remember that this is an old breach and any incident that happene[sd] after May 2018 is subject to the GDPR rather than the Data Protection Act 1998.
  - EnderMB 8y ago
    That's good, although I'm a bit wary of what will happen to GDPR after Brexit, and whether it gives the government a mandate to reduce penalties for businesses not meeting security standards.

detaro 8y ago

Why? Note that the security stuff makes nice headlines and is concerning, but isn't responsibility of ICO, so likely played no role in their fine.

dmurray 8y ago
Agreed, the personal data leaked was limited to a screenshot from a video in which 10 or 50 people's dates of birth and passport numbers were visible. As data breaches go, that really wasn't one.

pdpi 8y ago

Put into perspective — £120k isn't enough to hire two full-time people to work on this sort of problem, so why would they?

rangibaby 8y ago
See: the infamous Pinto memo
SenHeng 8y ago
That’s precisely why the fine is too cheap.

dpwm 8y ago

This isn't necessarily the first time they've done this, it's the first time they've been caught. Think of the money saved by not training 6370 staff in data protection and not having any kind of enforcement of policies. The minimum wage in the UK is now £7.83 per hour. Assuming it was £7.50 at the time, and that data protection training takes a couple of hours with no other costs, then that's about £95,000. Add in admin, national insurance, mandatory pensions and such and it's got to be about break even in a year. That's before we factor in staff turnover. Under the Data Protection Act 1998, there were cases where it clearly paid to deliberately not comply. Will a data breach make people choose to shop elsewhere? People already go out of their way to avoid Heathrow if they can, so any reputation loss is negligible.

shakna 8y ago

They reported it, and didn't try to hide it, for one. It occurred as a breach of internal policies for another.

99052882514569 8y ago

This isn't a fine, it's just the cost of not changing a security culture. Just some statistical noise on the balance sheet of a billion-pound corporation, nothing to concern oneself with if you're upper management.

ljm 8y ago

It seems to me that using money to enforce accountability is only something that works for people for whom money is quite a bit more scarce. You know, poor people, the middle class. You can really threaten someone's livelihood that way without resorting to prison. When you're looking at big business? Nah. They're not threatened by it: if the fine is too high the law doesn't get passed or it loses its teeth, because it's still cheaper to lobby for leniency. So you get a maximum threshold for a fine that is still pathetic and even further is likely never to be used. If that doesn't work, the business is big enough to threaten the government in power with an even greater loss by opting to dodge tax or shift operations elsewhere. Most of this legislation can be hacked through maths and clever accounting, or ultimately you just pay the workers less and increase the prices. Most businesses exist to make as much money as they can and you'd think that it would make it their most vulnerable spot, so you can hit them where it hurts. But it doesn't play out that way. It's essentially a monumental legal cop-out because there's no use holding the corporate entity itself accountable, because the corporate entity is pumping out money to the board no matter what. And we even recognise it as such by referring to such companies as having limited liability. Somehow the owner of a small business can lose their house and car if they fuck it all up, yet those in charge of a much larger company have an incredibly cushy layer of protection when they can deal infinitely greater damage when they put money above all else, sometimes malevolently so. Surely those liabilities should be reversed and the small shop should benefit from the protection from fucking up?

nirelBRACIT0S 8y ago

That’s quite a lot in UK, not everything is like SF.