Examination of Witnesses (Questions 100-119)
MR DAVE
HARTNETT CB AND
MR NICK
LODGE
17 DECEMBER 2007
Q100 Mr Dunne: Mr Lodge, are you
familiar with the Winzip 8 software package?
Mr Lodge: I have heard of it,
yes.
Q101 Mr Dunne: Are you aware that
that was the software package used for compressing the data supplied
to the NAO?
Mr Lodge: I understand that it
might have been.
Q102 Mr Dunne: You have not checked
that in your new role?
Mr Lodge: As Mr Hartnett has said,
details surrounding the circumstances are being gone over very
thoroughly by Mr Poynter and his team, and I am sure that will
be one of the issues that they will pick up.
Mr Hartnett: Mr Dunne, might I
come in just for a second as I may be able to help. My understanding
is that Winzip 8 was used in relation to the data taken to Waterview
Park. I am told—and I have not been able to investigate
it personally yet—that is the terms of our agreement with
EDS in respect of that data taken to Waterview Park because it
is taken physically by our IT people. I want to give you an assurance
that if that is what the terms of the contract say we will be
looking at that very carefully indeed.
Q103 Mr Dunne: Mr Hartnett, you confirmed
to me at the Treasury Select Committee that it was Winzip 8 and
we discussed the password protection which you have upgraded since
the loss of the data.
Mr Hartnett: Yes.
Q104 Mr Dunne: The reason I am addressing
this question to Mr Lodge is that he now has responsibility for
data security. Have you now sought to upgrade the Winzip 8 release
to Winzip 9 across your Department?
Mr Lodge: We have upgraded the
encryption to 256 bit encryption, which I understand to be industry
standard. I also understand that it would be better not to specify
the particular product that we use in this case.
Q105 Mr Dunne: I have some sympathy
with that. The Chancellor was very categoric in telling Parliament
that the material provided to the NAO had not been encrypted.
In fact, there is encryption within the password for Winzip 8.
Who gave him the advice that it was not encrypted? Mr Hartnett,
perhaps you can help us.
Mr Hartnett: I am not sure I can,
Mr Dunne. I know that Winzip 8 provides a password. I at least
was advised that it did not provide encryption that is significant
and I seem to recall—but I cannot find it quickly—that
we discussed the value of the encryption of Winzip 8 at the TSC
(Treasury Select Committee) hearing.
Q106 Mr Dunne: We did and subsequent
to that I have had information from a computer software expert
who has confirmed to me that the password is indeed encrypted
within Winzip 8, which is why I am concerned that somebody within
HMRC may have been giving misleading information to the Chancellor.
It may not be the most robust form of encryption and so it may
well have been appropriate for the Chancellor to suggest that
the encryption was not as good as it could have been, but the
purpose of my questioning at the Treasury Select Committee was
to ask why it was that HMRC decided to send letters to all 7.2
million people on the basis that they had had information which
was more readily available than it has turned out to be to somebody
if it falls into the wrong hands because it is encrypted?
Mr Hartnett: My advice Mr Dunne,
is this: if there is encryption of Winzip 8—and I am not
a techie in this sense—it is simply utterly insufficient
to meet the needs for moving this quality of data in the secure
way that Mr Lodge is describing.
Q107 Mr Dunne: Could we move on to
the use of TNT for a moment. You mentioned TNT and the Post Office.
How many separate contracts does HMRC have for its data transfer?
Mr Hartnett: I do not know the
precise number. There certainly have been several and I know that
not very long ago we ended one because we were concerned about
it.
Q108 Mr Dunne: Does the TNT contract
specifically cover the transfer of data between government departments?
Mr Hartnett: I do not know the
answer to that. Can I let you have a letter?
Q109 Mr Dunne: I would appreciate
that. Could you tell us specifically whether or not the TNT contract
covers data transfer to non-government departments such as the
NAO?
Mr Hartnett: What I do know about
the TNT contract is that there is a list of approved addresses.
The information I have so far—and this is all work for Mr
Poynter and I am sorry I need to keep saying that—is that
the NAO address may not have been on the approved list for TNT.
Mr Poynter is looking at that. I also want to know the answer
to that. [1]
Q110 Mr Dunne: Indeed, and so will this
Committee because again the Chancellor was briefed I think by
HMRC and by the NAO saying that the package had been provided
to TNT. How can you be certain that the package was provided to
TNT?
Mr Hartnett: My information again
is that those who were responsible for sending the package believed
that they put it into the system containers from which TNT would
have collected it.
Q111 Mr Dunne: Could they have been
mistaken in that belief?
Mr Hartnett: Anyone could be mistaken,
Mr Dunne. Mr Poynter is looking at that, the police are looking
at that, and the others are looking at that.
Q112 Mr Dunne: What I fail to understand
is if there is uncertainty about whether TNT were used, why TNT
were identified right at the outset of this inquiry as being the
people who were potentially responsible for the loss?
Mr Hartnett: There was no uncertainty
and I do not believe there is any uncertainty at the minute. I
have simply conceded, as I would concede on anything, that people
could make a mistake. Our belief remains that TNT were used. This
will be checked by Mr Poynter and the other agencies.
Q113 Mr Dunne: You have just told
us that the TNT tracking system was not used. That seems most
unusual if TNT have a contract where they do engage their own
tracking system, which would suggest that it might possibly not
have been a TNT packet because otherwise it would have been picked
up by their tracking.
Mr Hartnett: No, I do not think
it is quite like that. I think there are two sorts of ways in
which we use TNT. Some material is tracked; some material is not
tracked, and I do not think any failure to put in tracking can
be seen as evidence that it did not go through TNT.
Q114 Mr Dunne: Are you aware whether
there was any external identification either on the disks or on
the packet of what was contained within them?
Mr Hartnett: I do not know of
any.
Mr Lodge: I think there may have
been something written on the disks but I do not think it would
to any lay person have identified them for what they were.
Q115 Mr Dunne: Would it identify
that they belonged to HMRC?
Mr Lodge: I cannot answer that,
I am sorry.
Q116 Mr Dunne: Will Mr Poynter's
inquiry be looking into that?
Mr Hartnett: Very much so.
Q117 Mr Dunne: Why do you think Mr
Poynter is going to take until June to deliver his full report?
Mr Hartnett: My understanding
is that Mr Poynter is going to take until spring. I think Mr Poynter
has a huge amount of work to do with us and with the NAO. He may
need to look elsewhere. I think he has been moving quickly but
there is a great deal to do and it is important he gets it right.
Q118 Chairman: Just on identification,
the National Audit Office told me—is this right—that
this was supposed to be sent to you in a tax wallet, which is
quite large? Mr Tim Burr said to me it was the size of a shopping
bag, that it had "To: NAO, From: HMRC". Can you describe
exactly what it looks like, what is it?
Mr Burr: What I was referring
to was a container in which material commonly reaches us from
the HMRC, but of course I do not know whether this particular
information was in such a package.
Q119 Chairman: If I suddenly saw
this would I immediately think that it might look like the goods
because it was addressed to the NAO from HMRC and was rather large
in a yellow packet? Would I immediately recognise it as something
significant?
Mr Hartnett: When we send material
in our internal post, Chairman, whatever packaging it is in, it
then normally goes in a yellow plastic wallet or bag or whatever
and is sealed. If you saw one of those bags you would say this
might be HMRC, it might be DWP, it might be another department,
because a number of departments use that approach of what is called—and
this may be a new word to the Committee—a Polylope bag.
1 Note by witness: The contract with TNT for
internal post does not include the transfer of post to other government
departments or non-government organisations such as the NAO. Back
| 
