This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at http://www.theguardian.com/technology/2015/jul/17/users-data-compromised-after-technical-glitch-at-home-office-contractor

The article has changed 2 times. There is an RSS feed of changes available.

Version 0 Version 1
Users' data compromised after technical glitch at Home Office contractor Users' data compromised after technical glitch at Home Office contractor
(about 1 hour later)
A contractor that provides visa services on behalf of governments around the world, including the UK, has suffered a serious technical glitch that allowed personal data to be compromised. VFS Global, which acts for around 45 governments, released online application forms this week that used sequential reference numbers, allowing users to access other people’s private information by mistake.A contractor that provides visa services on behalf of governments around the world, including the UK, has suffered a serious technical glitch that allowed personal data to be compromised. VFS Global, which acts for around 45 governments, released online application forms this week that used sequential reference numbers, allowing users to access other people’s private information by mistake.
Users could see the personal information of other applicants, including their date of birth, passport details and addresses, if they mistakenly input the ID number of another person when logging into the system. The issue was resolved when customers complained about the flaw. The issue was limited to visa application forms for Italy, VFS said, but as many as 50 people were in danger of having their personal information compromised before the issue was fully addressed.Users could see the personal information of other applicants, including their date of birth, passport details and addresses, if they mistakenly input the ID number of another person when logging into the system. The issue was resolved when customers complained about the flaw. The issue was limited to visa application forms for Italy, VFS said, but as many as 50 people were in danger of having their personal information compromised before the issue was fully addressed.
The UK Home Office is among many European government departments that have outsourced technology services to VFS for their diplomatic missions abroad. Foreign nationals applying for a UK entry visa from many countries have to use VFS services in order to travel to Britain. Other clients include Italy, Norway, Germany, Switzerland and the Netherlands.The UK Home Office is among many European government departments that have outsourced technology services to VFS for their diplomatic missions abroad. Foreign nationals applying for a UK entry visa from many countries have to use VFS services in order to travel to Britain. Other clients include Italy, Norway, Germany, Switzerland and the Netherlands.
Two Russian nationals living in the UK who were using VFS application forms to apply for an Italian visa for a holiday were shocked to experience the breach earlier this week. The pair, who are technology consultants, immediately realised the seriousness of the issue.Two Russian nationals living in the UK who were using VFS application forms to apply for an Italian visa for a holiday were shocked to experience the breach earlier this week. The pair, who are technology consultants, immediately realised the seriousness of the issue.
“I could hardly believe it,” Dmitry Bagrov, managing director of DataArt UK, told the Guardian. “As anyone who has to apply for a visa to go almost anywhere will tell you, this process is not the most straightforward one, with ambiguous rules and customer service from the likes of VFS Global is very Kafkaesque.”“I could hardly believe it,” Dmitry Bagrov, managing director of DataArt UK, told the Guardian. “As anyone who has to apply for a visa to go almost anywhere will tell you, this process is not the most straightforward one, with ambiguous rules and customer service from the likes of VFS Global is very Kafkaesque.”
Bagrov said he didn’t believe the issue was due to a bug but rather “because whoever designed this system has not even thought about protecting my data”. He said he has never had any problems with UK authorities. Bagrov said he didn’t believe the issue was due to a bug, but rather “because whoever designed this system has not even thought about protecting my data”. He said he has never had any problems with UK authorities. He added: “This is beyond stupid. This is just taking your customers as an annoyance, comfortable in the knowledge that you have a long-term contract regardless of how you work.”
He added: “This is beyond stupid. This is just taking your customers as an annoyance, comfortable in the knowledge that you have a long-term contract regardless of how you work.” Alexey Utkin, head of financial practice at DataArt UK, said: “The global visa processing company VFS Global has always been a huge pain from the customer experience perspective on a website, utter confusion.” He added that it was “totally insane” that he could access anyone’s forms by just inputting an application number. Numbers were sequential, and while he was trying to find the application for his son, he was able to access the applications of many others.
Alexey Utkin, head of financial practice at DataArt UK, said: “The global visa processing company VFS Global has always been a huge pain from the customer experience perspective on a website, utter confusion.” “They simply didn’t put in any protection. I left feedback to them, but they’re huge and in my view totally incompetent. Fifteen hours later, it was still not secure, last time I checked. You would assume they should know about data protection – they’re trusted by governments worldwide,” he said.
Utkin said it was “totally insane” that he could access anyone’s forms by just inputting an application number. Numbers were sequential and while he was trying to find application for his son, he was able to access the applications of many others. A VFS Global spokesperson said: “We launched a beta release of the Italy visa online application form in UK [for third country nationals] yesterday – 15 July 9.30am GMT. Since it was a beta release, the new release was scheduled for 16 July 2015, midnight India time. Once the issue was highlighted, the new release was [rescheduled] and rolled out at 1pm GMT on 16 July 2015.
“They simply didn’t put in any protection. I left feedback to them, but they’re huge and in my view totally incompetent. Fifteen hours later and it was still not secure last time I checked. You would assume they should know about data protection – they’re trusted by governments worldwide,” he said. “Furthermore, to VFS Global, data/information security is an extremely critical element of our service solution. Our systems undergo stringent external independent audits on a periodic basis. Testing and auditing are ongoing processes at VFS Global for which we have dedicated teams, robust practices are in place to encourage feedback on any aspect of our service, and enhancements are implemented based on such feedback.”
A VFS Global spokesperson said: “We launched a beta release of the Italy visa online application form in UK (for third country nationals) yesterday – 15 July, 9.30am GMT.” The spokesperson added: “Since it was a beta release, the new release was scheduled for 16 July2015, midnight India time. Once the issue was highlighted, the new release was [rescheduled] and rolled out at 1pm GMT on 16 July 2015.” A Home Office spokesperson said: “The UK contract with VFS uses different systems to the system in question … We expect all contractors to comply fully with the UK’s stringent data protection requirements.”
“Furthermore, to VFS Global, data/information security is an extremely critical element of our service solution. Our systems undergo stringent external independent audits on a periodic basis. Testing and auditing are ongoing processes at VFS Global for which we have dedicated teams, robust practices are in place to encourage feedback on any aspect of our service and enhancements are implemented based on such feedback.”
A Home Office spokesperson said: “The UK contract with VFS uses different systems to the system in question”, stressing that “we expect all contractors to comply fully with the UK’s stringent data protection requirements”.