PA Consulting Contract Terminated After Loss of Sensitive Client Information; Firm Accepts Responsibility
LONDON - The U.K. Home Office said it will terminate a three year PA Consulting contract worth £1.5 million, and is also reviewing its other contracts with the firm worth approximately £8 million a year following an August incident where confidential details on the entire prisoner population of England and Wales were lost.
The termination is believed to be the first time that a private company has lost a U.K. government contract after losing the confidential information of citizens. The U.K. Cabinet Office is now conducting a broader inquiry into the way that private firms handle the public's personal information.
According to Home Office Secretary, Jacqui Smith, "Our contract had stipulated the sort of security provisions that needed to be in place and that had not happened. We are canceling this contract and we are urgently reviewing the way in which PA Consulting are meeting the requirements of other contracts we have with them."
Reports from leaked Association of Chief Police Officers' internal documents say the data stick was lost when it was put in an insecure office drawer that may not have been locked over a weekend by a female PA analyst. When she returned on Monday, the device was missing.
The firm was engaged in June 2007 to provide application support and user training services on the "JTrack Programme," which is a research project for the U.K. Home Office that follows offenders through the criminal justice system.
The unencrypted memory stick contained the home addresses of 33,000 criminals that had six or more convictions over the last 12 months, from the national law enforcement database. The device also contained details for 10,000 other prolific and priority offenders, and the names, dates of birth, and some release dates for the 84,000 prisoners currently incarcerated in England and Wales.
It appears that PA is being allowed to continue work on the £224 million "ContactPoint" project to create a digital repository containing the names, addresses, dates of birth, parents, schools, and physicians of England's 11 million children. ContactPoint was delayed in 2007 following a separate incident, where discs containing information on 25 million families were lost. It was recently disclosed that the database, due to go live in October, will be delayed until January 2009.
PA Consulting's 10 September statement:
As is appropriate in these circumstances, PA Consulting has avoided making any comment on this incident until publication of the report of the Home Office to the Information Commissioner. This report has been published today.
We have not yet had the opportunity to review the report in detail. However, we accept PA's responsibilities in this incident. As indicated in the notification, PA has a comprehensive system of security procedures and practices in place in order to protect, in addition to government information, sensitive information from commercial clients. The loss of data on this project was caused by human failure, a single employee was in breach of PA's well established information security processes. We deeply regret this human failure and apologize unreservedly to the Home Office.
We have cooperated and continue to cooperate fully and willingly in the immediate reporting, ongoing investigation, and resolution of this incident.
We reported the potential loss of data to the Home Office at 16:30 on 18 August 2008, the day that the loss was discovered and less than two hours after it was reported to PA's management. We then confirmed the loss to the Home Office at midday on 19 August.
PA has conducted an examination of every one of our government and private sector projects that handle personal, sensitive or protectively marked material against recognized best practice and government-approved processes. Our review has confirmed that, apart from in this isolated incident, we are fully compliant with robust policies and procedures and are achieving high levels of information assurance across all of our work. In addition, several government departments have carried out their own extensive audits of PA projects and in all cases have found them to be fully compliant.
PA has safely handled sensitive government information for over 60 years and this is the first incident of such a nature that PA has been involved in. It is clear from the events of recent weeks that the challenge of managing necessary confidential information held by government, and in particular of eliminating human error, is industry-wide. We are engaged in dialogue with our clients and competitors to address, and find solutions to, this challenge.
U.K. Home Office incident investigation report
PA statement
Related Yahoo! News