Introduction About Site Map

XML
RSS 2 Feed RSS 2 Feed
Navigation

Main Page | Blog Index

Monday, July 17th, 2023, 12:06 am

The Long History of Greater London Authority Data Protection Blunders

Summary: Data security and system security at Greater London Authority’s Web site haven’t been good; today we share just a couple of examples which help refute statements issued by Greater London Authority after a scandal that had made it to the mainstream media

MY! It really takes a liar to progress to management. The better the liar, the higher up the role.

As I mentioned the other day, there’s somewhat of a blunder since Friday when the news broke:

London Mayor's Office data breach: Sexual abuse survivor 'appalled' as her personal details may have been accessible online

The following conspicuous statement is worth assessing, as I was working on the sites (various aspects, some microsites too) for 9 years.

GLA security assurance

You would expect them to say that, wouldn’t you?

As I said on Saturday morning, this has deja vu written all over it.

to give one example (there are more):

GLA: Google security alert

GLA security issue

It wasn’t Sirius stuff (and certainly wasn’t me) who configured those terribly buggy forms.

GLA: Drupal access

GLA: Drupal permissions

As lying bosses at Sirius might say, “it doesn’t look good…”

It’s not the fault of Sirius either, at least not in this case.

The worst part of it is, as far as I’m aware GLA never publicly reported or disclosed this incident (sometimes this is legally required upon discovery or within a number of days, including informing those potentially affected, like people with their identity cards uploaded and widely available to the general public).

This isn’t the only such example.

2 years later even malicious scripts/programs could be uploaded. It was only detected after it had happened. Here are some fragments of old messages:

GLA: can uploaded malware

GLA: any file uploaded

This is a penalty for not scanning/sanitising uploads/input.

Why am I publishing these (redacted sensibly)? Because lying is wrong and privacy problems are the problem, speaking about them is not the problem. It is the moral thing to do — to point out it is a repeat offender so to speak. There is an obligation here to debunk false assurances, as this has gone on for years already.

One Response to “The Long History of Greater London Authority Data Protection Blunders”

  1. Alu Beenie Says:

    You’re right, the GLA are a terrible organisation and you should fully expose all the security issues they have with the site that you used to maintain.

    I cannot for the life of me imagine why they might be slow or intransigent dealing with your pension concern.

Technical Notes About Comments

Comments may include corrections, additions, citations, expressions of consent or even disagreements. They should preferably remain on topic.

Moderation: All genuine comments will be added. If your comment does not appear immediately (a rarity), it awaits moderation as it contained a sensitive word or a URI.

Trackbacks: The URI to TrackBack this entry is:

https://schestowitz.com/Weblog/archives/2023/07/17/greater-london-authority-data-protection/trackback/

Syndication: RSS feed for comments on this post RSS 2

    See also: What are feeds?, Local Feeds

Comments format: Line and paragraph breaks are automatic, E-mail address never displayed, HTML allowed: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Back to top

Retrieval statistics: 21 queries taking a total of 0.136 seconds • Please report low bandwidth using the feedback form
Original styles created by Ian Main (all acknowledgements) • PHP scripts and styles later modified by Roy Schestowitz • Help yourself to a GPL'd copy
|— Proudly powered by W o r d P r e s s — based on a heavily-hacked version 1.2.1 (Mingus) installation —|