Thread: FSA - data and human error. it's a recipe for disaster

Given the data breach of the FSA in recent days, will our data ever really be safe?
For the record, I don't have an issue with the register per se, as a lawful and law abiding license holder, I have nothing to hide from the authorities, quite the contrary BUT I DO have A LOT to hide from any nefarious types who might use a data breach to compile a shopping list, especially given that such types will probably come calling with scant regard for mine or my families personal well being and will have a high probability of being armed and being a lawful license holders, my arms will all be safely locked up and of little use to me in such a situation, anyway, I digress.

I am still waiting for my new license and seeing as the 4 weeks had elapsed and noticing that my letter confirming my license had my PHYSICAL address on it, rather than my postal address, I wondered if my FAL had gone astray.
One phone call to the FSA and it became clear that their "systems" are far from robust. Calling them and explaining the situation "it's been 4 weeks, where's my license, have you got the right postal address for me?" (that's massively condensed, I was much more polite!) it was revealed that NO, they did not have my correct postal address, neither did they know where my license was other than it had been printed over a week ago.....

TWO things are clear, given that EVERY single form I filled out during my FAL application I very clearly added my postal address AND my physical address in the relevant fields, somewhere the "robust system" is not pulling that data across directly...and from a coding point of view that's akin to formatting an excel cell with SUM= (very far from rocket science for those not familiar with excel) now this could very possibly lead to a FAL being sent to the wrong place....I have no idea what other info accompanies the actual card when it's sent out but the card itself is doubtless full of "privileged" information.

Whilst on the phone, the nice chap was unsure if correcting my postal address would trigger the "change of address" procedure.......so I waited whilst he trotted off to find out.
Now, I don't have an issue with this chap, he was doing his best but clearly the training for these new staff has been less than perfect and a flowchart cheat sheet isn't hard to produce and make available....is it?
The other point is they didn't know where my license was, whether it had been posted or not and all they could offer was "if it hasn't shown up in another week, send an email to these chaps and they'll look into it"

This new system cost us NZ$10M........and it's already creaking, the institutionalised civil service has given us a half pie solution as usual, if they were spending their own money you can bet your left bollock they'd make sure they got "value"

I think a properly administered register, administered with well trained and thorough staff (who have been exhaustively vetted) is not a bad idea, sadly, it's not all that and it's likely that this will be the first of many data breaches because consider this, all someone who really wants that data has to do is find an officer (or more likely non-sworn staff with access) and make them an offer they can't refuse for the data (there have been a number of cases of "police staff" dishing out info to gangs etc in recent year) so we can't say "oh, that'll never happen here" because it already has