News yesterday that several London hospitals had been shutdown because of the outbreak of a virus would perhaps make you pause briefly and think of MRSA or some new anti-biotic resistant strain of Staph. So far, so not news – although, thankfully, far less common recently because of, I imagine, Herculean efforts by hospital staff. To hear that it was actually a computer virus makes you pause longer.

The mytob virus, apparently responsible for the shutdown, is more than 3 years old. It’s easy to protect against and well understood. Symantec describe it’s threat level as:

When was the last time you heard of a computer network being shut down by a virus? Well, not that long ago. Along with the hospitals, we have this news today

It seems we’re approaching the annual peak for computer virus infection

Computer users have been warned to take extra special care next Monday as it has been predicted to be the worst day of the year for computer viruses. Security experts PC Tools has forecast the bleak outlook for computer fans on November 24th, as figures from 2007 show that it was the peak for malicious software last year.

But seriously … an entire network shutdown now? In late 2008?

Shortly after I started work in UK government, a series of departments were shutdown for 2 or 3 days, some longer, because the Melissa virus infected their email system. Chaos reined as all email servers were shutdown and nothing could be sent or received. How quickly we had come to be reliant on email. In a hospital where it wasn’t just email but seemingly everything, it must be much worse.

Not long after that, the OGC piloted an anti-virus solution that was hosted “in the cloud” – i.e. was not on local PCs but that filtered every incoming (and later outgoing) email from any government email address that was set up. We took that pilot on, probably mid-2002, and extended it to every single government email address that wanted to use. It wasn’t cheap – but measure that cheapness against the cost of an infection, whether in clean-up time, risk to the operation or any other metric you care to use. Since then, as far as I know, there hasn’t been a single virus infection in a government department using the service. The company, MessageLabs, at the time a tiny company, has since gone on to be a world-leader in anti-virus (and was then bought by Symantec for some $700 million)

What’s my point? I guess it’s the frustration that these lessons have been learned already – and the solution is available at a relatively nominal fee. It’s been well tested and well used for 5 or even 6 years. And hundreds of thousands of email accounts across government are already protected.

For a hospital to be exposed to this kind of risk, with everything else that they have to deal with on a day to day basis, is just shocking.

And, as for the Pentagon, they should already know better – but they should also be reading my blog. Ban USB sticks now.

It’s been a long time since the Government Gateway was in the news. Today there are 259 related items in Google News. And, of course, it has gone international with mutliple languages evident in even the first page of news. And most of them aren’t good news stories, rather retelling of what must be a form news story now

“Memory stick containing details of millions of customers/patients/armed forces members/taxpayers/benefit recipients/credit card holders lost. Fears over identity theft/terrorist action/confidentiality breaches reach fever pitch”

Of course it hurts all the more so when it’s something that I was intimately involved in, albeit I haven’t been near it organisationally for 4 years, but the relentless and unending series of data loss fiascos is taking a huge toll on public confidence. It isn’t just government organisations that lose data (see my post, 25 million green bottles, from almost exactly a year ago and the follow up about 3 months ago) but when governments do it (and, again, it isn’t just the UK government) the potential impact and the surrounding noise are orders of magnitude larger.

What someone was doing with a memory stick containing customer login details I have no idea. Why would anyone need such a thing? And why would he or she be in a pub carpark? On second thoughts, don’t answer that last question.

I suspect that there are elements of truth and untruth in the Mail on Sunday’s front page story – oh the times we used to hope for headline news for e-government, but not this kind of headlines – and that the real story is perhaps quite different. But it doesn’t matter; the damage is done. It’ s another incompetence of IT story to add to the seemingly infinite list.

It seems, to me at least, that the actions I put forward a year ago are just as valid:

1. Lock down data exchange now. People come to the data, not the data to the people. Until better processes are in place, this should stop the problem from getting worse.

2. All staff should be taught the “green cross code” of using computers. The very basics need to be re-taught. For that matter, the code should be taught at schools, colleges and libraries.

3. The spooks should lead a review of deploying encryption technology to departments holding individual data so that all correspondence is encrypted automatically in transit using appropriate levels of protection for the job. This will be expensive. The alternative though is to make encryption optional – but because you can choose, sometimes people will choose not to (because it’s too slow or something) and the problem will recur.

4. Systems being architected now and those to be architected in the future will look at what data they really need to hold and for how long and will, wherever possible, make transient use of data held elsewhere. The mother of all ID databases would be a good place to start.

Where I work, memory sticks don’t work. Plug one in and it just doesn’t work (and we’re using Windows XP rather than anything fancier). So perhaps the next actions are:

5. Any contractor or third party working with or alongside government agencies must deploy a standard desktop and server build that disables memory sticks when they are inserted into a USB slot. For good measure, they should perhaps ensure that if a memory stick is even inserted, it is securely and irrevocably wiped. Such third parties would have 90 days to implement this capability across their entire organisation or would be banned from working on government contracts – existing and new – until they had completed the task

6. Any member of such an organisation found to be carrying a memory stick during the period from now until the redeployment of USB countermeasures was complete would be prevented from entering any government building or using any government IT. This would be enforced through random searches, x-raying of bags on entry into buildings and so on.

Extreme? Possibly. But it seems that all measures apart from this are not working and that short of opening up all of the firewalls and setting server passwords to default, any public or private sector organisation – and I mean that in the widest sense as whilst we in the UK see our own examples more frequently, everyone else has the same problem too – couldn’t do a worse job of securing data.