National Cyber-database Proposal

Edie G. Lush

31 May 2008

When Labour ministers say ‘we’re listening’, this is what they really mean — and it’s frightening

The main problem will be creating the database in an easy-to-access form: a technical challenge for the industry, and a frightening concept for its customers. The problem, says Ken Munro, director of penetration and security testing at NCC Group, is that ISPs, phone companies and VoIP (Voice Over Internet Protocol) companies, who may be included as well, all keep their data in different formats. ‘This project is all about linking lots of different databases together and making them easier to query. You have to ask how much this will cost — the NHS database linking hospitals with GP surgeries is costing around £4 billion — why should this be any different?’

Hall thinks that if the proposal becomes law it will push many businesses to take their internet business elsewhere, using ISPs based outside the UK to avoid having their records captured in a potentially unsafe database. ‘We’ve seen significant breaches of security lately: think of the child benefit data being lost. What’s to make this more successful or secure than any other government database?’

Munro says the other option is for businesses to encrypt their emails beyond recognition by the authorities. The question remains whether the threat of a terrorist attack justifies the significant costs that creating such a database would impose. On this, Hall has an even more depressing thought to offer. ‘Given the glacial speed of government computer projects, if the security safeguards are cutting-edge at the time they’re designed, they’ll be Neolithic by the time the system goes live.’

Edie G. Lush