Five million Danish ID numbers sent to Chinese firm by mistake • Hacker News Board

Re: Five million Danish ID numbers sent to Chinese firm by mistake

#41

Post by sctb » Wed, Jul 20, 2016, 2:47 PM UTC

runesoerensen wrote: post #2

This is ridiculous. It's not just Danish personal identification numbers, but ID numbers and health records for everyone who have lived in Denmark from 2010 through 2012. Quick recap since it's in Danish: A danish health authority, SSI, accidentally mailed two CDs containing unencrypted CPR-numbers and health records for 5.28m residents to the Chinese Visa Application Office. The Chinese delivered the letter to the i…

Thanks, we updated the link from https://www.datatilsynet.dk/afgoerelser/afgoerelsen/artikel/....

Re: Five million Danish ID numbers sent to Chinese firm by mistake

#42

Post by mads » Wed, Jul 20, 2016, 2:52 PM UTC

As a Danish person living in China, I don't know how to feel about this.

In some weird way, I think it was a good thing this got delivered to the China visa office and not next door to them, in which case we would probably never have heard about this mistake and for sure it wouldn't be top post here. There is a good headline to be found in this story, as I have just discovered when browsing the Danish news.

If this information is handled so recklessly and so nonchalant, it makes me wonder what other people within Denmark also have access to this information. Students, secretaries, interns? Can I register as a scientist and get access? Who exactly has access to my information? I would like to know the answer to this question.

I know that visa office and have been there many times. It is not a Chinese government run operation but a private company handling the incoming paper work for visa applications, which get submitted for review at the Chinese run Chinese embassy :P

Re: Five million Danish ID numbers sent to Chinese firm by mistake

#43

Post by flexie » Wed, Jul 20, 2016, 3:04 PM UTC

runesoerensen wrote: post #2

This is ridiculous. It's not just Danish personal identification numbers, but ID numbers and health records for everyone who have lived in Denmark from 2010 through 2012. Quick recap since it's in Danish: A danish health authority, SSI, accidentally mailed two CDs containing unencrypted CPR-numbers and health records for 5.28m residents to the Chinese Visa Application Office. The Chinese delivered the letter to the i…

Just to give some perspective: These are the confidential ID numbers and health records, including for example psychiatric information, of more than 90 percent of the Danish population.

It's not legal, but many organisations still trust you are, who you say you are, if you provide name and the ID number. You can still call some banks in Denmark and get information on the account balance if you state name, account number and the ID number. Same with the tax authorities and some public authorities.

The health records are likely to include information that can be used to blackmail our politicians, business people etc. since just about everybody in Denmark uses the public health care system.

Re: Five million Danish ID numbers sent to Chinese firm by mistake

#44

Post by atemerev » Wed, Jul 20, 2016, 3:14 PM UTC

danielweber wrote: post #13

To save other people the google search, population of Denmark is 5.6 million.

Good thing I only got mine in 2013! My data should be safe then.

Or so they say.

Re: Five million Danish ID numbers sent to Chinese firm by mistake

#45

Post by rasz_pl » Wed, Jul 20, 2016, 3:20 PM UTC

Svip wrote: post #4

runesoerensen wrote: post #2

This is ridiculous. It's not just Danish personal identification numbers, but ID numbers and health records for everyone who have lived in Denmark from 2010 through 2012. Quick recap since it's in Danish: A danish health authority, SSI, accidentally mailed two CDs containing unencrypted CPR-numbers and health records for 5.28m residents to the Chinese Visa Application Office. The Chinese delivered the letter to the i…

Correction: SSI sent a letter containing two unencrypted CDs containing CPR-numbers and health records for 5.28 residents in Danish municipals between 2010 and 2012 to the Danish statistics agency (Statistics Denmark). Post Danmark (postal service) accidentally delivered the letter to Chinese Visa Application Centre instead. When the employee responsible for receiving the letter noticed the mistake upon opening, the…

Was postman of Chinese descent?

Re: Five million Danish ID numbers sent to Chinese firm by mistake

#46

Post by zht » Wed, Jul 20, 2016, 3:22 PM UTC

rasz_pl wrote: post #45

Svip wrote: post #4

Earlier quoted context omitted.

Correction: SSI sent a letter containing two unencrypted CDs containing CPR-numbers and health records for 5.28 residents in Danish municipals between 2010 and 2012 to the Danish statistics agency (Statistics Denmark). Post Danmark (postal service) accidentally delivered the letter to Chinese Visa Application Centre instead. When the employee responsible for receiving the letter noticed the mistake upon opening, the…

Was postman of Chinese descent?

why does it matter?

Re: Five million Danish ID numbers sent to Chinese firm by mistake

#47

Post by neximo64 » Wed, Jul 20, 2016, 3:28 PM UTC

Absolute incompetence.

Re: Five million Danish ID numbers sent to Chinese firm by mistake

#48

Post by mads » Wed, Jul 20, 2016, 3:28 PM UTC

adrianratnapala wrote: post #30

runesoerensen wrote: post #12

Earlier quoted context omitted.

Yes that's true - The Data Protection Agency see no reason to take any further action in this case. Their assessment is that there is a low likelihood of an actual leak (based on a written statement from the Chinese employee who opened the letter). And the SSI has promised to send such information encrypted going forward.

If I were a senior official at the Chinese foreign service, and I heard that one of my employees got such a CD and just gave it back to the Danes without notifying higher-ups, then I would want that employee's head. On the other hand, if I were a senior official in the Danish foreign service, then I would find my life a lot easier if no one was kicking up a fuss about the Chinese.

I know that visa office. I am not so concerned about them. That package could have been delivered anywhere.

What I mean is that it is private company handling incoming paper work just like any other company in that building. It happens to be doing paper work for the Chinese embassy.

I am more concerned about who put that information on those CD's and why did those people have access to that information. That information should be treated like a radioactive piece of material.

Re: Five million Danish ID numbers sent to Chinese firm by mistake

#49

Post by pbhjpbhj » Wed, Jul 20, 2016, 3:30 PM UTC

Angostura wrote: post #28

So, to summarise - burning it to CD is actually fine, but they should have used an in-house courier.

How much effort is it to encrypt the contents first, virtually none. Items get dropped, go missing, etc. - given the importance of the data then they should have both encrypted (one-time pad, used a secure side-channel to pass the key at the point when it was required) and used a trusted delivery system.

Re: Five million Danish ID numbers sent to Chinese firm by mistake

#50

Post by Zekio » Wed, Jul 20, 2016, 3:31 PM UTC

The Danish personal identification numbers are useless for identifying someone since we pretty much give them out to anyone who asks for it, and they can be calculated using some methods, which have been done to some politicians just to show the flaws in the system behind them.