DaniWeb story leads to UK Foreign Office being in breach of Data Protection Act

happygeek 1 479 Views

Back in May, I broke the story on DaniWeb in this very blog of how the online application facility for UK visas was not only insecure, but that it had potentially been so for years. The company concerned, VFS Global, which operated the visa online application form filing service on behalf of the UK government in India and other countries, had such Mickey Mouse security in place that anyone could easily get hold of the full application form information of anyone who had made such an application. That's anyone as is terrorist, identity thief, innocent applicant stumbling across the information or even an investigative journalist. The story quickly gathered momentum, and featured as the lead on Channel 4 News in the UK after I brought it to their attention and aided with the investigation.

Today, the UK (ICO) has found the Foreign and Commonwealth Office (FCO) in breach of the Data Protection Act following an investigation into that application facility security fiasco.

This follows on from an independent report, instigated by the UK Foreign Secretary at the time, and conducted by Linda Costelloe Baker in June which concluded that the VFS operated online application system should not be re-opened. Indeed, it has remained closed ever since I first brought the security problem to light back in May.

I alerted the ICO the very first day that the security breach became clear, following my own 'testing' of the database and discovery that it could indeed be easily hacked to reveal the personal data as described. The ICO immediately launched an investigation into the joint Home Office and Foreign and Commonwealth Office Directorate responsible for visa processing. The FCO cooperated fully with the ICO during the course of the investigation and provided the ICO with an independent report into the breach.

The ICO has now required the FCO to sign a formal undertaking to comply with the principles of the Data Protection Act. Failure to meet the terms of the undertaking is likely to lead to further enforcement action by the ICO.

Mick Gorrill, Assistant Commissioner at the ICO, said: "Organisations have a duty under the Data Protection Act to keep our personal information secure. If organisations fail to take this responsibility seriously, they not only leave individuals vulnerable to identity theft but risk losing individuals' confidence and trust. We investigate any organisation in breach of the Act and will not hesitate to take appropriate action."

It's not every day that a blog such as this can claim credit for giving the government a swift and very much deserved kick in the nether regions.

Dani AI

Generated

This thread documents a clear real-world lesson in how simple design choices and weak third‑party oversight can turn routine web features into mass-exposure events. The DaniWeb investigation that highlighted helped trigger national coverage, an independent inquiry and regulatory action after a public disclosure in 2007; the official review found widespread procurement and security failings and a large number of at‑risk applications. (theguardian.com)

Key governance failings (what the independent review and Parliament flagged) included insufficient security requirements in contracts, poor central oversight of outsourced systems, and a failure to act promptly on earlier warnings. Organizations that rely on external suppliers should treat security as a contract deliverable, not an optional extra. See the parliamentary report and subsequent analysis for detail. (publications.parliament.uk)

Practical technical checklist (apply these now if you run, build or procure web application services):

  • Do object‑level authorization on the server for every request; never rely on obscurity or client controls.
  • Replace predictable, sequential IDs with opaque tokens or per‑session indirect references.
  • Force fine‑grained logging, rate limits and anomaly detection so enumeration attempts are visible.
  • Mandate independent penetration testing and secure‑by‑design reviews before production handover.
  • Require contractual rights to audit, timely patching and a clear incident response playbook from vendors.

These items map to industry best practice for preventing insecure direct object reference / broken access control issues. (cheatsheetseries.owasp.org)

Notes on responsible handling and legal context: researchers who find a live PII exposure should avoid exfiltrating data, produce non‑destructive proof‑of‑concepts, and follow the target organisation’s vulnerability disclosure route (or use national reporting pathways if the owner is unresponsive). Modern UK data law has evolved since 2007 (controllers now operate under the Data Protection Act 2018 and UK GDPR, with strict breach‑notification requirements), so procurement, DPIAs and documented breach procedures are essential. (ncsc.gov.uk)

Acknowledgement: ’s reporting plus the community reaction (noted by ) demonstrate how coordinated disclosure and public scrutiny can force remediation where internal processes fail.

Member Avatar for Dani
Dani 5,664 The Queen of DaniWeb

Awesome work, Davey!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview