Examination of Witnesses (Questions 80-99)
MR DAVE
HARTNETT CB AND
MR NICK
LODGE
17 DECEMBER 2007
Q80 Mr Mitchell: What I am asking
really is—I mean everybody apologises for their own incompetence,
even I do it (although not very often!) is there any great threat?
Mr Hartnett: There is a risk here.
Q81 Mr Mitchell: What is the risk?
Mr Hartnett: The risk here is
if these disks were to fall into the wrong hands—and there
is no evidence that they have—perhaps taken with other information,
that the information could be misused.
Q82 Mr Mitchell: Taken with other
information which they do not have?
Mr Hartnett: Well, I do not know
the answer to that, Mr Mitchell and, with enormous respect, you
do not either at the moment, I think the crucial thing is, you
are right, if I may say so with great respect, in that the data
that has been lost, on its own, if it fell into the wrong hands
would not give access to bank accounts—the banks and others
have told us that—but we have put in place with various
agencies contingency plans both to monitor this constantly and
to act very quickly if we need to.
Q83 Mr Mitchell: So we have created
an atmosphere of panic and fear and alarm unnecessarily?
Mr Hartnett: I do not think that
is right. I think it was important for people to know about this
loss. The Information Commissioner has complimented HMRC—and
I do not solicit compliments in this context at all—for
reporting the issue. The Government set up the role of Information
Commissioner in this respect because so much of people's data
is now held by government departments and in the private sector
and needs to be protected.
Q84 Mr Mitchell: I can see that.
Let me just turn to TNT. Why was TNT employed in the first place
when there is an organisation called the Post Office which most
of us use?
Mr Hartnett: TNT won, as I understand
it, a competitive tender to carry our internal post in 2002, and
that is who we use for our internal post. We use the Post Office
for a lot, not necessarily all, of our external post.
Q85 Mr Mitchell: I was just Googling,
as one does, before coming here and I found another example of
TNT delivering confidential information. I think it was coming
from your Department and it was clearly addressed to an office
in Dundee and it finished up in a training organisation in Cumbernauld,
or vice versa, I am not sure, I did not read the Google
very well. Do you have confidence in TNT on the basis of this
performance?
Mr Hartnett: We are talking to
TNT about performance. They have served us well in the past. When
Mr Poynter, the police and others have reported on this incident,
we will clearly want to talk to TNT again.
Q86 Mr Mitchell: I find extraordinary
that they do not have a tracking system for their own deliveries.
Mr Hartnett: My understanding—and
others behind me will soon leap in and give me a note if I have
got this wrong—is that TNT do have a tracking system but
it was not used on this occasion.
Q87 Mr Mitchell: Why?
Mr Hartnett: That is a question
that I suspect all the agencies investigating this will want to
know the answer to, and I do too.
Q88 Mr Mitchell: One point that occurred
to me was the emotional effects and that because of job shedding
and the merger of functions and new functions taken on there is
very low morale operating in the Department. Would that be a factor?
How good is morale?
Mr Hartnett: It depends on the
relevant areas, Mr Mitchell. I think morale in our Department
is low. We are going through an enormous amount of change. I read
a lot about—and I am sure you do—the so-called J-Curve
of Change. I hope and plan for us to be coming up from quite a
low position here. It is really important for me to say as well
that I have seen no evidence whatever so far that cost efficiencies
or job cuts or our change programme have anything to do with this
dreadful mistake.
Q89 Mr Mitchell: If you have all
these threats hanging over your head you do not tend to put in
maximum performance, do you? You tend to get a bit slap happy
and think, "Oh bugger it."
Mr Hartnett: That is not how it
is in HMRC, Mr Mitchell. If you look at our processing areas,
for example, our people are doing fantastically well. They have
achieved 40% or 50% efficiency gains. A survey which was carried
out of the quality of our performance through aspects of our contact
centre show a very high level of satisfaction. Our people take
pride in doing a great job. The people in Waterview Park in particular
are incredibly proud of the quality of job they do.
Q90 Mr Mitchell: I just want to ask
about this excess of information which you sent. You said that
it would cost £15,000 to download it from the computer excluding
this information, but I got the impression from what you were
saying to Richard Bacon that it could be done comparatively cheaply.
Which is the truth?
Mr Hartnett: My understanding,
based on the information available now, is that a different set
of data could have been provided to the NAO in Waterview Park
using the secure system there because that is where we got our
data to give to APACS. I do not know at the present moment in
time why it was not possible to do that then but, as Sir John
has recognised, my hypothesis is that costs came into it here
because one or more individuals believed they had to go back to
the mainframe in Benton Park View in order to get the compressed
data that the NAO auditor appeared to be asking for.
Q91 Mr Mitchell: But no costs were
asked for. The person in receipt of this email—
Mr Hartnett: I do not know, Mr
Mitchell, that £15,000 is the precise figure. That is a figure
I have seen.
Q92 Mr Mitchell: But it does read
like a routine dismissal, "Oh, it will cost too much; let's
not bother."
Mr Hartnett: Can I just add one
other thing that I need to bring out as well. You asked me about
tracking and all of that (and it was Mr Hill who asked me about
processes) one of the things that our guidance says specifically
is that sensitive data should be sent via an auditable process,
and that is one of the other things that has gone wrong here.
I regret it but that is one of the other things that has gone
wrong.
Chairman: Philip Dunne.
Q93 Mr Dunne: Mr Hartnett, in answer
to a Parliamentary Question in October, the Minister confirmed
that there had been over 2,000 separate security breaches within
HMRC offices in the preceding 12 months. Was it that which led
you to agree with the Treasury Select Sub-Committee that there
is potentially systemic failure within HMRC or was it the data
loss to which this hearing relates?
Mr Hartnett: I did not agree,
Mr Dunne, that there had been systemic failure. The record shows
quite clearly that those were the first four or five words of
a rather long sentence—I wish I had used much shorter sentences
now—in which I made it really clear that the issue of systemic
failure or no systemic failure would depend on Mr Poynter's review
and the other reviews. As I sit here now, I do not know whether
there was systemic failure.
Q94 Mr Dunne: Do subsequent security
breaches help you to form a view of systemic failure, for example
the breach which we heard about in the Chancellor's statement
just now in Coventry?
Mr Hartnett: I am very concerned
about what has happened in Coventry. All I know as I sit here
is that an amount of cocaine—1.5 kilograms—is missing
from the place it should be in in a secure lock-up. Perhaps Mr
Dunne, I can just take a moment to say that some of the more lurid
stories about this, about ammunition, passports and firearms being
missing, are just plain wrong.
Q95 Mr Dunne: You can confirm to
us now that the only thing that is missing is the 1.5 kilos of
cocaine?
Mr Hartnett: That is what I am
confirming.
Q96 Mr Dunne: How many people had
access to the passwords for the Coventry storage facility?
Mr Hartnett: To the best of my
knowledge at this moment in time—and there is a police investigation
started—less than ten people.
Q97 Mr Dunne: How many other sites
are there within HMRC's management where confiscated goods are
held?
Mr Hartnett: I do not know the
precise answer to that. There are Queen's Warehouses and there
are lock-ups at other places where material can be confiscated.
I should perhaps add that this process was thoroughly reviewed
in 2006 and given a clean bill of health. What I do not know at
the minute is whether this cocaine has been sent for destruction
or to a court or to a forensic science laboratory and the paperwork
has not been done properly or whether it has been stolen. I am
very worried about it if it is the latter.
Q98 Mr Dunne: What steps have you
taken in the light of this latest incident and the whole question
of security of data, and now goods, held by HMRC to refresh and
review?
Mr Hartnett: That review will
be refreshed shortly. At the moment, I have focused the Department
on making sure that, wherever possible, goods are taken to Queen's
Warehouses, which are ultra secure, if I can put it that way.
Our faith in what has been a very secure system is presently knocked
by what has happened in Coventry although I do not know precisely
what that is.
Q99 Mr Dunne: You would not characterise
that as an example of systemic failure at this time?
Mr Hartnett: No, I characterise
that, Mr Dunne, as a complete one-off. To the best of my knowledge,
talking to colleagues who were involved in the old Customs, there
has not been an incident like that for many years. I think that
is absolutely not systemic.
| 
