[egorfine]

> she understood the news "will be shocking and upsetting for people".

And that's about it. No repercussions will take place.

[buserror]

It is entirely possible the IT was outsourced to the highest bidder, probably with limited liability clauses etc etc. See Post Office for reference, they are still reaping contract money out of the government, years after having been proven as responsible for ruining people's lives for decades, and coverups.

[taffynay]

Governments outsource to the lowest bidder. Whoever can do the job for the cheapest.

[rjmunro]

Here in the UK it's not as simple as that. In order for your bid to be accepted there are a lot of hoops you go through to try to prove yourself.

Unfortunately these make it very hard for people to get contracts with the government, so most government contracts get awarded to a small number of contractors who can maintain the expertise needed to comply with the rules. Often they end up charging more than other companies and doing a worse job.

[tgv]

Your comment is against the site rules on first sight, but it’s at the core of the problem: strong regulation, surveillance and punishment are sorely lacking.

[celticninja]

Who do you want to punish exactly?

[aaronmdjones]

Cases like this usually boil down to one of three things:

1) Someone left an unpatched server exposed to the Internet for months with a known critical vulnerability.

2) Someone uploaded the data to a world-readable S3 bucket or similar, or left it in an Internet-accessible database server with no authentication.

3) Someone with administrative credentials was using the password "password1!" or similar with no two-factor authentication.

In an ideal world (not the world we live in), in these cases, that someone would be prosecuted for gross negligence.

[egorfine]

It seems to me that 1) is the norm, not an exception in large enough corporations and especially government orgs.

Personally, I do not see any other way out of this other than somehow criminalizing running outdated software.

[pjc50]

Perhaps. So you prosecute your £30k low rank administrative assistant in charge of the thing. All the other unionized low-paid civil servants immediately go "we didn't sign up for this liability" and refuse to touch anything that could be deemed computer administration. Government grinds to a halt.

Something similar happened to the British Museum a couple of years ago. Almost certainly an even worse pay/qualifications employer.

[jaoane]

You prosecute whoever set the system up. The same way you’d prosecute a surgeon for malpractice.

These are professionals. It’s their responsibility to build a solid, secure system. If they can’t or don’t want to then they should find another job.

[egorfine]

They are professionals. They cannot upgrade this particular windows server, because the software they're running on it requires visual basic 6.0 support. The vendor cannot provide any upgrade for their system, because certifying anything newer than Windows 2003 for this software is prohibitively expensive for the vendor. You cannot switch vendor due to obscure clauses in contract.

Real situation btw.

[oaththrowaway]

Then you're going to have to start paying entry level IT like surgeons. Nobody is going to take that kind of risk for $30K.

[netdevphoenix]

If the pay difference doesn't reflect that additional responsibility, it probably is not expected

[egorfine]

Sounds about right.

So, shall we not protect people's data?

[harvey9]

If someone puts a low rank admin assistant in charge then the boss needs prosecuting. It would be the public sector version of getting the boss's nephew to do it.

[celticninja]

But that's not what happened. It wasn't left unpatched because of incompetence of the developers. It's because it cannot be upgraded to a secure version of the software and to replace the entire system would cost a lot of money. Money that the Tory govt didnt want to spend. There are ongoing efforts to reduce reliance on this legacy tech but it's not an overnight solution.

[drexlspivey]

Prosecuting someone for not having a strong enough password is beyond ridiculous. Your ideal world sounds like a black mirror episode.

[caulkboots]

How would you feel if a bank used a screen door to access their vault? Protecting other people's info comes with responsibility.

[drexlspivey]

How about enforcing strong passwords or non-password authentication at the org level instead of puting rank and file employees to jail?

[egorfine]

Me personally I would like to set on fire the very people who begin to consider an upgrade to a major Windows version not earlier than it goes out of extended support.

[anonymars]

Could you rephrase this with fewer negations? I cannot parse what you are trying to hate and therefore what point you are trying to make -- "those who begin to consider not earlier than it is not fully supported"

[egorfine]

Can't edit anymore, so I have to bear the responsibility of that comment for life.

What I was trying to say is that some orgs upgrade their Windows OS installations after a ridiculous amount of time. Like I have legit seen a company thinking to upgrade to Windows Server 2008. And knowing them I'm sure it will take years to implement.

[anonymars]

Gotcha. I couldn't tell because the other extreme drives me crazy too. Hey let's roll out 24H2 to everyone on Windows 11 in December, just in time for the holidays. Why, just why?