{"id":946,"date":"2008-04-04T16:26:04","date_gmt":"2008-04-05T00:26:04","guid":{"rendered":"\/?p=946"},"modified":"2008-04-04T16:26:04","modified_gmt":"2008-04-05T00:26:04","slug":"how-to-safely-deliver-information-to-auditors","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=946","title":{"rendered":"How to safely deliver information to auditors"},"content":{"rendered":"<p>I just came across <a href=\"http:\/\/dooooooom.blogspot.com\/2007\/11\/request-and-response-for-child-benefit.html\" class=\"broken_link\">Ian Brown&#39;s<\/a> proposal for\u00a0doing random audits while avoiding data breaches like Britain&#39;s terrible HMRC Identity Chernobyl:\u00a0<\/p>\n<blockquote><p>It is clear from <a href=\"http:\/\/www.computerweekly.com\/blogs\/tony_collins\/2007\/11\/missing-cds-why-the-nao-wanted.html\" class=\"broken_link\"><strong><font color=\"#999988\">correspondence<\/font><\/strong><\/a> between the National Audit Office and Her Majesty&#39;s Revenue &amp; Customs over the <a href=\"http:\/\/dooooooom.blogspot.com\/2007\/11\/discs-with-15m-bank-details-lost-by.html\" class=\"broken_link\"><strong><font color=\"#999988\">lost files fiasco<\/font><\/strong><\/a> that this data should never have been requested, nor supplied.<\/p>\n<p>NAO wanted to choose a random sample of child benefit recipients to audit. Understandably, it did not want HMRC to select that sample &#8220;randomly&#8221;. However, HMRC could have used an extremely simple <a href=\"http:\/\/en.wikipedia.org\/wiki\/Commitment_scheme\"><strong><font color=\"#999988\">bit-commitment<\/font><\/strong><\/a> protocol to give NAO a way to choose recipients themselves without revealing any of the data related to those not chosen:<\/p>\n<ol>\n<li>For each recipient, HMRC should have calculated a <a href=\"http:\/\/en.wikipedia.org\/wiki\/Cryptographic_hash_function\"><strong><font color=\"#999988\">cryptographic hash<\/font><\/strong><\/a> of all of the recipient&#39;s data and then given NAO a set of index numbers and this hash data.<\/li>\n<li>NAO could then select a sample of these records to audit. They would inform HMRC of the index values of the records in that sample.<\/li>\n<li>HMRC would finally supply only those records. NAO could verify the records had not been changed by comparing their hashes to those in the original data received from HMRC.<\/li>\n<\/ol>\n<p>This is not cryptographic rocket science. Any competent computer science graduate could have designed this scheme and implemented it in about an hour using an open source cryptographic library like <a href=\"http:\/\/www.openssl.org\/\"><strong><font color=\"#999988\">OpenSSL<\/font><\/strong><\/a>.<\/p>\n<p>Ben Laurie notes that the redacted correspondence itself <a href=\"http:\/\/www.links.org\/?p=280\"><strong><font color=\"#999988\">demonstrates<\/font><\/strong><\/a> a lack of basic security awareness. I hope those carrying out the <a href=\"http:\/\/www.guardian.co.uk\/society\/2007\/nov\/23\/childprotection.privacy\"><strong><font color=\"#999988\">security review<\/font><\/strong><\/a> of the ContactPoint database are better informed.<\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"<p>This is not cryptographic rocket science. <\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[37,6,17,11],"tags":[],"_links":{"self":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/946"}],"collection":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=946"}],"version-history":[{"count":0,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/946\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=946"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=946"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=946"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}