5 ms·

'Significant amount' of private data stolen in UK Legal Aid hack

51 points by neversaydie 1y ago

egorfine 1y ago
> she understood the news "will be shocking and upsetting for people". And that's about it. No repercussions will take place.
- tgv 1y ago
  Your comment is against the site rules on first sight, but it’s at the core of the problem: strong regulation, surveillance and punishment are sorely lacking.
  - celticninja 1y ago
    Who do you want to punish exactly?
    - aaronmdjones 1y ago
      Cases like this usually boil down to one of three things: 1) Someone left an unpatched server exposed to the Internet for months with a known critical vulnerability. 2) Someone uploaded the data to a world-readable S3 bucket or similar, or left it in an Internet-accessible database server with no authentication. 3) Someone with administrative credentials was using the password "password1!" or similar with no two-factor authentication. In an ideal world (not the world we live in), in these cases, that someone would be prosecuted for gross negligence.
      - pjc50 1y ago
        Perhaps. So you prosecute your £30k low rank administrative assistant in charge of the thing. All the other unionized low-paid civil servants immediately go "we didn't sign up for this liability" and refuse to touch anything that could be deemed computer administration. Government grinds to a halt. Something similar happened to the British Museum a couple of years ago. Almost certainly an even worse pay/qualifications employer.
        egorfine 1y ago
        Sounds about right. So, shall we not protect people's data?
        jaoane 1y ago
        You prosecute whoever set the system up. The same way you’d prosecute a surgeon for malpractice. These are professionals. It’s their responsibility to build a solid, secure system. If they can’t or don’t want to then they should find another job.
        oaththrowaway 1y ago
        Then you're going to have to start paying entry level IT like surgeons. Nobody is going to take that kind of risk for $30K.
        ben_w 1y ago
        Or this becomes another profession where everyone gets (and needs) liability insurance. That might not be a bad thing, if the insurance comes with some kind of way to get lower premiums for being less risky.
        AlotOfReading 1y ago
        More likely, they'd just start carrying errors and omissions insurance for a bit extra.
        lurking_swe 1y ago
        since when does entry level IT “call the shots” on reviewing code that gets deployed to prod? Sure a junior programmer or devops may do something dumb. That’s not the problem - at all. The problem is pretending they are a professional. They are not. They are juniors that need mentorship and should be _expected_ to mess up frequently. To use a different analogy. If I bring my car to the mechanic, i’m OK with the new guy working on my car, assuming that the senior mechanic, you know, double checks their work. Is that not a reasonable assumption? None of this makes ANY sense to me. To be blunt.
        1y ago
      - egorfine 1y ago
        It seems to me that 1) is the norm, not an exception in large enough corporations and especially government orgs. Personally, I do not see any other way out of this other than somehow criminalizing running outdated software.
      - drexlspivey 1y ago
        Prosecuting someone for not having a strong enough password is beyond ridiculous. Your ideal world sounds like a black mirror episode.
        caulkboots 1y ago
        How would you feel if a bank used a screen door to access their vault? Protecting other people's info comes with responsibility.
        drexlspivey 1y ago
        How about enforcing strong passwords or non-password authentication at the org level instead of puting rank and file employees to jail?
    - egorfine 1y ago
      Me personally I would like to set on fire the very people who begin to consider an upgrade to a major Windows version not earlier than it goes out of extended support.
      - anonymars 1y ago
        Could you rephrase this with fewer negations? I cannot parse what you are trying to hate and therefore what point you are trying to make -- "those who begin to consider not earlier than it is not fully supported"
        egorfine 1y ago
        Can't edit anymore, so I have to bear the responsibility of that comment for life. What I was trying to say is that some orgs upgrade their Windows OS installations after a ridiculous amount of time. Like I have legit seen a company thinking to upgrade to Windows Server 2008. And knowing them I'm sure it will take years to implement.
        anonymars 1y ago
        Gotcha. I couldn't tell because the other extreme drives me crazy too. Hey let's roll out 24H2 to everyone on Windows 11 in December, just in time for the holidays. Why, just why?
- buserror 1y ago
  It is entirely possible the IT was outsourced to the highest bidder, probably with limited liability clauses etc etc. See Post Office for reference, they are still reaping contract money out of the government, years after having been proven as responsible for ruining people's lives for decades, and coverups.
  - taffynay 1y ago
    Governments outsource to the lowest bidder. Whoever can do the job for the cheapest.
    - rjmunro 1y ago
      Here in the UK it's not as simple as that. In order for your bid to be accepted there are a lot of hoops you go through to try to prove yourself. Unfortunately these make it very hard for people to get contracts with the government, so most government contracts get awarded to a small number of contractors who can maintain the expertise needed to comply with the rules. Often they end up charging more than other companies and doing a worse job.
moreati 1y ago
> The Legal Aid breach is, I’m told, a ransomware/extortion group (not mentioned in the notice). If it looks like the UK gov are going to pay, or pay via third party, this one will become a megathread. https://www.gov.uk/government/news/legal-aid-agency-data-breach https://www.gov.uk/government/news/legal-aid-agency-data-bre... -- https://cyberplace.social/@GossiTheDog/114533584686916433 https://cyberplace.social/@GossiTheDog/114533584686916433 Note Gossi's "If". There's no indication so far wrt possible payment.
- celticninja 1y ago
  They are not going to pay anything I guarantee it. There is no randomware. They shut their services down before the attacker could deploy ransomware although the attacker likely accessed data.
  - alias_neo 1y ago
    > likely accessed data There's nothing "likely" about it. > On Friday 16 May we discovered the attack was more extensive than originally understood and that the group behind it had accessed a large amount of information relating to legal aid applicants. > We believe the group has accessed and downloaded a significant amount of personal data from those who applied for legal aid through our digital service since 2010. > This data may have included contact details and addresses of applicants, their dates of birth, national ID numbers, criminal history, employment status and financial data such as contribution amounts, debts and payments. source: https://www.gov.uk/government/news/legal-aid-agency-data-breach https://www.gov.uk/government/news/legal-aid-agency-data-bre...
- Urahandystar 1y ago
  The UK government does not pay ransomware and advises private businesses not to also. https://www.ncsc.gov.uk/section/respond-recover/ml-ransomware-attack https://www.ncsc.gov.uk/section/respond-recover/ml-ransomwar...
  - moreati 1y ago
    I wasn't trying to suggest they wil. I emphasised Gossi's If because I missed it on my first read. I didn't want others making the same mistake.
kmlx 1y ago
just in case people are not aware what "legal aid" or what "Legal Aid Agency" are: > Legal aid is the provision of assistance to people who are unable to afford legal representation and access to the court system. Legal aid is regarded as central in providing access to justice by ensuring equality before the law, the right to counsel and the right to a fair trial. > The Legal Aid Agency is an executive agency of the Ministry of Justice (MoJ) in the United Kingdom. It provides both civil and criminal legal aid and advice in England and Wales. from https://en.wikipedia.org/wiki/Legal_Aid_Agency https://en.wikipedia.org/wiki/Legal_Aid_Agency

51 points by neversaydie 1y ago

> she understood the news "will be shocking and upsetting for people". And that's about it. No repercussions will take place.

tgv 1y ago
Your comment is against the site rules on first sight, but it’s at the core of the problem: strong regulation, surveillance and punishment are sorely lacking.
- celticninja 1y ago
  Who do you want to punish exactly?
  - aaronmdjones 1y ago
    Cases like this usually boil down to one of three things: 1) Someone left an unpatched server exposed to the Internet for months with a known critical vulnerability. 2) Someone uploaded the data to a world-readable S3 bucket or similar, or left it in an Internet-accessible database server with no authentication. 3) Someone with administrative credentials was using the password "password1!" or similar with no two-factor authentication. In an ideal world (not the world we live in), in these cases, that someone would be prosecuted for gross negligence.
    - pjc50 1y ago
      Perhaps. So you prosecute your £30k low rank administrative assistant in charge of the thing. All the other unionized low-paid civil servants immediately go "we didn't sign up for this liability" and refuse to touch anything that could be deemed computer administration. Government grinds to a halt. Something similar happened to the British Museum a couple of years ago. Almost certainly an even worse pay/qualifications employer.
      - egorfine 1y ago
        Sounds about right. So, shall we not protect people's data?
      - jaoane 1y ago
        You prosecute whoever set the system up. The same way you’d prosecute a surgeon for malpractice. These are professionals. It’s their responsibility to build a solid, secure system. If they can’t or don’t want to then they should find another job.
        oaththrowaway 1y ago
        Then you're going to have to start paying entry level IT like surgeons. Nobody is going to take that kind of risk for $30K.
        ben_w 1y ago
        Or this becomes another profession where everyone gets (and needs) liability insurance. That might not be a bad thing, if the insurance comes with some kind of way to get lower premiums for being less risky.
        AlotOfReading 1y ago
        More likely, they'd just start carrying errors and omissions insurance for a bit extra.
        lurking_swe 1y ago
        since when does entry level IT “call the shots” on reviewing code that gets deployed to prod? Sure a junior programmer or devops may do something dumb. That’s not the problem - at all. The problem is pretending they are a professional. They are not. They are juniors that need mentorship and should be _expected_ to mess up frequently. To use a different analogy. If I bring my car to the mechanic, i’m OK with the new guy working on my car, assuming that the senior mechanic, you know, double checks their work. Is that not a reasonable assumption? None of this makes ANY sense to me. To be blunt.
        1y ago
    - egorfine 1y ago
      It seems to me that 1) is the norm, not an exception in large enough corporations and especially government orgs. Personally, I do not see any other way out of this other than somehow criminalizing running outdated software.
    - drexlspivey 1y ago
      Prosecuting someone for not having a strong enough password is beyond ridiculous. Your ideal world sounds like a black mirror episode.
      - caulkboots 1y ago
        How would you feel if a bank used a screen door to access their vault? Protecting other people's info comes with responsibility.
        drexlspivey 1y ago
        How about enforcing strong passwords or non-password authentication at the org level instead of puting rank and file employees to jail?
  - egorfine 1y ago
    Me personally I would like to set on fire the very people who begin to consider an upgrade to a major Windows version not earlier than it goes out of extended support.
    - anonymars 1y ago
      Could you rephrase this with fewer negations? I cannot parse what you are trying to hate and therefore what point you are trying to make -- "those who begin to consider not earlier than it is not fully supported"
      - egorfine 1y ago
        Can't edit anymore, so I have to bear the responsibility of that comment for life. What I was trying to say is that some orgs upgrade their Windows OS installations after a ridiculous amount of time. Like I have legit seen a company thinking to upgrade to Windows Server 2008. And knowing them I'm sure it will take years to implement.
        anonymars 1y ago
        Gotcha. I couldn't tell because the other extreme drives me crazy too. Hey let's roll out 24H2 to everyone on Windows 11 in December, just in time for the holidays. Why, just why?
buserror 1y ago
It is entirely possible the IT was outsourced to the highest bidder, probably with limited liability clauses etc etc. See Post Office for reference, they are still reaping contract money out of the government, years after having been proven as responsible for ruining people's lives for decades, and coverups.
- taffynay 1y ago
  Governments outsource to the lowest bidder. Whoever can do the job for the cheapest.
  - rjmunro 1y ago
    Here in the UK it's not as simple as that. In order for your bid to be accepted there are a lot of hoops you go through to try to prove yourself. Unfortunately these make it very hard for people to get contracts with the government, so most government contracts get awarded to a small number of contractors who can maintain the expertise needed to comply with the rules. Often they end up charging more than other companies and doing a worse job.

moreati 1y ago

> The Legal Aid breach is, I’m told, a ransomware/extortion group (not mentioned in the notice). If it looks like the UK gov are going to pay, or pay via third party, this one will become a megathread. https://www.gov.uk/government/news/legal-aid-agency-data-breach https://www.gov.uk/government/news/legal-aid-agency-data-bre... -- https://cyberplace.social/@GossiTheDog/114533584686916433 https://cyberplace.social/@GossiTheDog/114533584686916433 Note Gossi's "If". There's no indication so far wrt possible payment.

celticninja 1y ago
They are not going to pay anything I guarantee it. There is no randomware. They shut their services down before the attacker could deploy ransomware although the attacker likely accessed data.
- alias_neo 1y ago
  > likely accessed data There's nothing "likely" about it. > On Friday 16 May we discovered the attack was more extensive than originally understood and that the group behind it had accessed a large amount of information relating to legal aid applicants. > We believe the group has accessed and downloaded a significant amount of personal data from those who applied for legal aid through our digital service since 2010. > This data may have included contact details and addresses of applicants, their dates of birth, national ID numbers, criminal history, employment status and financial data such as contribution amounts, debts and payments. source: https://www.gov.uk/government/news/legal-aid-agency-data-breach https://www.gov.uk/government/news/legal-aid-agency-data-bre...
Urahandystar 1y ago
The UK government does not pay ransomware and advises private businesses not to also. https://www.ncsc.gov.uk/section/respond-recover/ml-ransomware-attack https://www.ncsc.gov.uk/section/respond-recover/ml-ransomwar...
- moreati 1y ago
  I wasn't trying to suggest they wil. I emphasised Gossi's If because I missed it on my first read. I didn't want others making the same mistake.

kmlx 1y ago

just in case people are not aware what "legal aid" or what "Legal Aid Agency" are: > Legal aid is the provision of assistance to people who are unable to afford legal representation and access to the court system. Legal aid is regarded as central in providing access to justice by ensuring equality before the law, the right to counsel and the right to a fair trial. > The Legal Aid Agency is an executive agency of the Ministry of Justice (MoJ) in the United Kingdom. It provides both civil and criminal legal aid and advice in England and Wales. from https://en.wikipedia.org/wiki/Legal_Aid_Agency https://en.wikipedia.org/wiki/Legal_Aid_Agency