Five million Danish ID numbers sent to Chinese firm by mistake • Hacker News Board

Re: Five million Danish ID numbers sent to Chinese firm by mistake

#81

Post by roywiggins » Thu, Jul 21, 2016, 2:22 AM UTC

runesoerensen wrote: post #12

Symbiote wrote: post #7

Google Translate gives me, "Data Protection Agency takes no further action". Is that true? No-one is fined or prosecuted for this? Or even sacked?

Yes that's true - The Data Protection Agency see no reason to take any further action in this case. Their assessment is that there is a low likelihood of an actual leak (based on a written statement from the Chinese employee who opened the letter). And the SSI has promised to send such information encrypted going forward.

Sending this sort of data through the mail unencrypted shouldn't be legal to start with, imho. It's just a matter of time before it ends up in the wrong person's hands by accident.

Re: Five million Danish ID numbers sent to Chinese firm by mistake

#82

Post by SoreGums » Thu, Jul 21, 2016, 9:09 AM UTC

ams6110 wrote: post #79

mseebach wrote: post #8

Earlier quoted context omitted.

That's the problem with blame culture. It needs to be someones (emphasis ONE) fault, and then anyone else can breathe a sigh of relief and move on. It's blatantly irresponsible that SSI even has the infrastructure to burn CDs with this information on it (it needs to live in heavily secured, jealously guarded and scrupulously audited (ideally airgapped) computer system). If they absolutely need this capability, it's b…

I hate to tell you this but such information is widely emailed around as excel spreadsheet attachments by unthinking people. I would virtually guarantee it happens every day.

This is how the US debt collection system works according to an article I read a couple of years ago...

Re: Five million Danish ID numbers sent to Chinese firm by mistake

#83

Post by pbhjpbhj » Thu, Jul 21, 2016, 11:32 AM UTC

kayone wrote: post #55

pbhjpbhj wrote: post #38

The story from the Chinese Visa Application Office (CVAO) is that an employee opened the letter "by mistake": >"It said that it was contacted by an employee of the Chinese Visa Application Centre who said she opened the letter addressed to Statistics Denmark “by mistake” but then delivered the package to the statistics agency." (TheLocal, linked above, http://www.thelocal.dk/20160720/five-million-danish-id-numbe... )…

well, the Danish mail service who's one of its main purposes is to read and process the mailing address correctly failed. And they most likely have _many_ more processes and safeguards than any office mailroom.

The Danish mail service presumably handles several orders of magnitude more mail per member of staff than an office mail room too.

In a civil service establishment handling legal documents you have to have controls on the mail, no member of staff is just going to open a piece of misaddressed mail willy-nilly, it's going to follow procedure especially in an office handling identity papers.

Re: Five million Danish ID numbers sent to Chinese firm by mistake

#84

Post by pbhjpbhj » Thu, Jul 21, 2016, 11:35 AM UTC

tomjen3 wrote: post #61

kayone wrote: post #55

Earlier quoted context omitted.

well, the Danish mail service who's one of its main purposes is to read and process the mailing address correctly failed. And they most likely have _many_ more processes and safeguards than any office mailroom.

I am a Dane. I have twice received mail incorrectly sent to my current address. One was sent to somebody with a different name, to an address that was close to but not the same as my previous address, the other was to a person who may have lived here but was not the previous occupant. This does not include the letters that should have gone to my neighbors but was put in the wrong letter box. While I naturally assume…

You noticed that they were misaddressed though, right?

Now imagine you work in an office handling personal identity papers and travel documents mishandling of which is probably a sack-able offense and possibly a criminal one too. Every piece of mail entering your address has to be date registered and properly redirected. Do you think you'd just open letters without looking at the address?