|
UNCORRECTED TRANSCRIPT OF ORAL EVIDENCE To be published as HC 200-i House of COMMONS MINUTES OF EVIDENCE TAKEN BEFORE THE COMMITTEE OF PUBLIC ACCOUNTS Monday 17 December 2007
LOSS OF DATA BY HM REVENUE & CUSTOMS
MR DAVE HARTNETT CB and MR NICK LODGE
Evidence heard in Public Questions 1 - 229
USE OF THE TRANSCRIPT
Oral evidence Taken before the Committee of Public Accounts on Monday 17 December 2007 Members present: Mr Edward Leigh, in the Chair Mr Richard Bacon Angela Browning Mr Philip Dunne Keith Hill Mr Austin Mitchell Geraldine Smith Mr Don Touhig Mr Alan Williams Phil Wilson
________________ Sir John Bourn KCB, Comptroller and Auditor General, Mr Tim Burr, Deputy Comptroller and Auditor General, and Miss Caroline Mawhood, Assistant Auditor General, National Audit Office, gave evidence. Ms Paula Diggle, Treasury Officer of Accounts, HM Treasury, gave evidence. REPORT BY THE COMPTROLLER AND AUDITOR GENERAL LOSS OF DATA BY HM REVENUE & CUSTOMS
Witnesses: Mr Dave Hartnett CB, Acting Chairman of HM Revenue & Customs, and Mr Nick Lodge, Director of Data Security, HM Revenue & Customs, gave evidence. Q1 Chairman: Good afternoon. Welcome to the Committee of Public Accounts where today we are considering the loss of child benefit data by HM Revenue & Customs. We welcome Dave Hartnett, who is Acting Chairman of HM Revenue & Customs. Could you introduce your colleague please, Mr Hartnett? Mr Hartnett: Yes, Chairman, and good afternoon. To my left is Nick Lodge, who is our Director of Data Security, recently appointed. Q2 Chairman: What day were you appointed, Mr Lodge? Mr Lodge: 21 November. Q3 Chairman: So this was after the statement to the House about the loss of this data? Mr Lodge: Yes. Q4 Chairman: Did you have a predecessor who was responsible at the time of this incident? Mr Lodge: I did not have a direct predecessor, no. Q5 Chairman: Why not? Mr Lodge: There was no direct predecessor in that post. It was a new post created. Q6 Chairman: Why not? Why was there no person in HMRC in overall charge of data security before this incident? Why did this incident have to take place with the loss of the details of 25 million people before you appointed a head of data security? Mr Hartnett: Chairman, I will take this if I may. There was no single person responsible and that is one of the issues that Mr Poynter brings out and that we have recognised. When I became Acting Chairman, I felt a need for a director in that position immediately, and it was one of a number of steps I took on assuming my role. Q7 Chairman: Is Mr Lodge at board level? Mr Hartnett: No. Q8 Chairman: Who is responsible at board level? Mr Hartnett: I think a number of people are responsible at board level and that has been one of the lessons we have learned. There are three or four different people - the Director General for Compliance, because it was his people who were involved in managing disks; our CIO; and the Director General responsible for benefits. Q9 Chairman: You do not think it is sufficiently important to have a single person at board level? Mr Hartnett: Chairman I do, and that is why I have appointed one. Q10 Chairman: But Mr Lodge is not on the board. Mr Hartnett: I am sorry, Mr Lodge reports to me. Q11 Chairman: Right, thank you. Who was the senior manager responsible then at the time who would have been responsible for ensuring that procedures were followed correctly? Who would that have been? Mr Hartnett: Had the process owner for child benefit been fully involved in this he would have been the senior manager responsible. Q12 Chairman: And the process owner for child benefit was not consulted? Mr Hartnett: The process owner for child benefit does not seem to have been fully consulted. He features in one email I have seen from March and features in a couple of emails in October. Q13 Chairman: Is this Mr Nigel Jordan? Mr Hartnett: That is Mr Jordan. Q14 Chairman: He figures in the email on 13 March; it was copied to him? Mr Hartnett: He does figure in that email. Q15 Chairman: This incident took place some time ago, presumably you have had a chance to talk to Mr Jordan about what happened, have you? Mr Hartnett: No. As soon as the police and other agencies became involved the HMRC enquiries stopped. I gather that one or two of my colleagues have spoken to Mr Jordan. Q16 Chairman: Presumably you have been briefed about that? Mr Hartnett: I have been briefed. Q17 Chairman: So when Mr Jordan was copied in on this email of 13 March, this was an email, was it not, where the National Audit Office requested this information but said they did not want to have all of the personal bank details. That is right, is it not? Mr Hartnett: He was copied into those emails but, Chairman, at that stage --- Q18 Chairman: Having been copied in, what did he do with that information? Mr Hartnett: Mr Jordan was not available, as I understand it, when the email was sent to him. What is important here is that at the time Mr Jordan was copied in there was no suggestion that I have seen or my colleagues have seen that this data was to be removed from Waterview Park where the NAO were working on it. Q19 Chairman: We have this email and we can consult it, can we not; it is in our bundle here. Mr Hartnett: Yes you do. Q20 Chairman: This is the email of 13 March. Would you confirm - and I do not need to have a name - that this email on 13 March, which is from "blanked out" Benefits and Credits, sent 13 March 2007 at 15.23 to "blanked out", was sent by a senior executive officer or somebody of an equivalent rank in HMRC? Mr Hartnett: I believe it was sent by a senior officer, which is what we call them now. Q21 Chairman: Would that be equivalent to senior executive officer in the rest of the Civil Service? Mr Hartnett: Yes. Q22 Chairman: And this was copied to Mr Jordan, was it? Mr Hartnett: I believe so. Q23 Chairman: And Mr Jordan has a rank, am I right in saying, of Assistant Secretary? Mr Hartnett: Mr Jordan is at the lowest level of the Senior Civil Service. It would have been called Assistant Secretary in the past. Q24 Chairman: It says here - and this was written by a senior executive officer or the equivalent: "I must stress that we must make use of data we hold and not overburden the business by asking them to run additional data scans that may incur a cost to the Department." So presumably that senior executive officer was saying to the National Audit Office at that stage that it was too expensive to strip away the personal details; is that right? Mr Hartnett: No, I do not think that is what is going on. Q25 Chairman: All right, so what is he saying? Mr Hartnett: I think what is happening here, if you look at the earlier slightly longer email, one of the issues for the National Audit Office was the size of the data and they wanted the data compressed. These emails are but three emails in a picture to be examined by Mr Poynter. I believe that the senior executive officer thought that in order to meet the NAO request they would have to go and get a new download of data from Benton Park View here the mainframe is, and I think one of the issues Mr Poynter has to address here is what was going on. Was this about paying money to get a different cut of the data when the whole data was available in the secure area in Waterview Park and could be accessed there by the NAO, because there is no suggestion in these emails that this data was to be taken away? Q26 Chairman: Do we yet have any understanding of what it would have cost to strip away this information to provide the NAO with what they wanted? Mr Hartnett: I do not have a precise understanding but I have been told that a download from the mainframe would have cost around £15,000, but, Chairman, the information was there on-site where the auditor was that day. Q27 Chairman: Do you think that this senior executive officer did not realise this at the time? Mr Hartnett: I think the senior executive officer knew the data was there and that is why there was a reluctance to spend money, but I must stress that this is a surmise based on three emails. There are many more emails to be looked at and Mr Poynter will, I am sure, be addressing this. Q28 Chairman: How could you have a situation where a junior manager decides not to extract sensitive data without being authorised? Surely a manager should seek authorisation before he or she comes to such a decision? Mr Hartnett: I think the junior manager here could well have thought that the information was fully available in Waterview Park on the secure system. The auditor was there as well. The auditor seemed to be concerned about the size of the data and getting compression of that data, and if that analysis is right - and only Mr Poynter can tell us - I think this junior officer was acting responsibly. Q29 Chairman: Does the National Audit Office want to comment on this? Sir John Bourn: As Mr Hartnett says, these are issues which are being followed up and we shall hear more from Mr Poynter about them. As Mr Hartnett says, he has a hypothesis here. He claims no more from it than that, and I think the best thing is to wait until we have more specific information provided by Mr Poynter. Q30 Chairman: You said that the process owner was not available at the time. Was he out of the building or something? Mr Hartnett: The process owner, I believe, was in a management meeting in London at the time. Q31 Chairman: So who actually authorised release of the disks then? Mr Hartnett: I do not think there was an authorisation and that is one of the breaches of our procedures that has taken place here. Q32 Chairman: So why did these junior officials who released the data not follow the departmental procedures? Mr Hartnett: Chairman, I do not know the answer to that but I know that the Information Commissioner, the IPPC, Mr Poynter and the police are either going to interview these officials or have already done so. I do not know the outcome of that but, as I said earlier, our own enquiries ceased. Q33 Chairman: To get this absolutely right just one last time, are you saying that the senior executive officer who sent this email on 13 March may have thought that the information was much more readily available on-site for the NAO and they should have consulted you on-site? Is that what you are saying to us? Mr Hartnett: I am in no doubt that that junior manager knew the data was available on-site. Were I able to ask a question, the question I would want to ask is why did you not provide a stripped down version of the data? Was it because you knew that the full data was available and the auditor was on-site? As Sir John says, that is a hypothesis and it has to be tested. Q34 Chairman: We did request that you bring along Mr Jordan and you refused, did you not, so I mean --- Mr Hartnett: No, that is not right, Chairman. There were discussions with your Clerk and we had heard that Mr Jordan might be asked to appear as a witness and then we were told that he was not to be summonsed as a witness. Q35 Chairman: Right. We were told he was on holiday and would not be able to come. Mr Hartnett: I am very sorry, Chairman, if I persist unreasonably. We were told to ask him to cancel his holiday originally, which we were prepared to do, and then we got a message that he was not needed. I am really sorry if there is any confusion here. Q36 Chairman: Because it might have been helpful to have the person who was actually doing all this. Mr Hartnett: I think there would have been a difficulty, if I may say so though, because Mr Jordan is clearly central to a number of inquiries and our general rule is that where someone is central to inquiries he would not be offered as a witness. Q37 Chairman: Let me ask you a general question. You are in a very privileged position - which I think is what people would want us to ask as well - in terms of dealing with people's personal details. Do you think that there was a sufficient culture of protecting personal information at the heart of your organisation or do you think that there was perhaps a culture where cost considerations might have been more important? Mr Hartnett: Chairman, I have thought about this a lot. I joined the old Inland Revenue more than 30 years ago. I have a recollection of taking a note orally about protecting the confidentiality of people's data. I did ask just recently about what the modern version of this is, and when people join us, on their very first day, they are told about protecting the confidentiality of people's data and the need to take care. When you switch on a computer in Revenue & Customs, you are warned about the care you need to take with data. I think there was a dreadful mistake here and it has had a potentially huge impact, but the people in Revenue & Customs recognise the importance of the privileged position which, as you say, they are in having access to people's data. Q38 Chairman: Lastly do you think your matrix structure led to any weak accountability? Mr Hartnett: I think our matrix structure was very important when Revenue & Customs was formed. It enabled the organisation to bind together, bringing two very different organisations together, with different cultures, different histories and different backgrounds, but it has caused difficulties with accountability, which is why I have announced that we are changing that approach at board level. Chairman: Thank you Mr Hartnett. Keith Hill? Q39 Keith Hill: Mr Hartnett, could you describe the procedure HMRC has set up with the NAO for passing data to them? Mr Hartnett: Yes, the general procedure is that we have protocols with the NAO for the passage of data, like other public sector and indeed private sector organisations. We respect the right of our auditor - indeed he has a statutory right - to access any data they reasonably need for their audit, so we have these protocols and we expect to use them, and I know the NAO expect to use them too. Q40 Keith Hill: What are these procedures? What are these protocols? Mr Hartnett: There will usually be a gateway, if I can describe it like that, through which the data passes and both sides will know who the key players are in the process of passing data. Q41 Keith Hill: In your evidence to the Treasury Select Committee you said that the NAO did not use the procedure. What did you mean by that? Mr Hartnett: I hope I also said HMRC did not use it properly. Q42 Keith Hill: No, you said specifically that the NAO did not use the procedure. Mr Hartnett: I think the approach that should have been taken was that the National Audit Office should have come through the protocol we had set up with them and not ask junior officials for very sensitive information, but this is going to be something which Mr Poynter will look at, and Sir John has said he is carrying out his own review and he will look at that as well. The last thing, if I may, that I wanted to add is that I believe that there is a recognition of that in the letter of 9 November which the Second Director of the NAO sent to HMRC. Q43 Keith Hill: I want to ask you about that in due course, Mr Hartnett, but let me try and be clear about this. Are you saying that if the procedure had been followed, it would have involved the so-called child benefit processing, that is to say the more senior civil servant but, as you said again to the Treasury Select Committee, the process owner knew nothing about the release of the data because the procedure had not been followed? Is that right? Mr Hartnett: I think that is right but it has to be tested by Mr Poynter and indeed by Sir John. Q44 Keith Hill: Had a senior official been involved in the earlier data transfer in March? Mr Hartnett: There is no evidence that I have seen of a senior official being involved, but can I try and bring some definition to 'senior official' because I do feel there is a risk that we will get confused. Can I break my Department into three lumps very quickly. Q45 Keith Hill: Very quickly because this is coming out of my ten minutes! Mr Hartnett: I will do it as fast as I can. I will speak even faster than normal! Senior officials for me is the Senior Civil Service, which is about 420 people in my organisation. The next tier, grades six and seven - I am going quickly - is probably 5,000 or 6,000 people, and below that the grades I see as clerical grades. The one senior civil servant copied into this, a senior manager, the SEO that the Chairman has referred to, is in the big block at the bottom, so of the bottom tier. Q46 Keith Hill: Okay, but the SEO, who was the process owner --- Mr Hartnett: No, the senior civil servant was the process owner. Q47 Keith Hill: Right, the Senior Civil Service was not involved at any stage as far as you are aware? Mr Hartnett: I have seen no evidence that a senior civil servant was involved in the decision to release the disks and indeed in the exchange of letters I had with the National Audit Office on, I think, 22 November - but I stand to be corrected - recognises that as well. Q48 Keith Hill: So it would be correct to say that a fundamental error, the original error, was made in March when the whole dataset, the 100% scan, was transferred to the NAO and that that error was simply repeated in October? Mr Hartnett: The NAO auditor should not have been given a full set of the data in March 2007 and allowed to leave Waterview Park with it. One of the issues that comes up there is - and this is for Mr Poynter as well - was there one someone in a position to put up their hand and say, "Why are we doing this silly thing, let's stop it immediately", and then in October there was a request for the data from the NAO and it was posted to them by the junior member of staff that has now been much referred to elsewhere. Q49 Keith Hill: In the light of this agreed procedure between the NAO and HMRC, in March when the data was first sent to the NAO, do you think that the NAO should have accepted the data in the form it was sent, that is to say in its unsegregated form? Mr Hartnett: Can I just correct something which I think is implicit in the question you are asking me. Nothing was sent to the NAO in March. It was handed to the auditor on our premises at Waterview Park; the NAO auditor took it away and it was returned I think precisely one month later, by hand, so nothing was sent in March. I am sorry to be pernickety. Q50 Keith Hill: No, I think it is the point you were making to the Chairman at an earlier stage but it is very, very helpful to have it further clarified. So this was an entirely manual transaction on the first occasion? Mr Hartnett: Yes. Q51 Keith Hill: Both ways? Mr Hartnett: On the first occasion. Q52 Keith Hill: Nevertheless, the data was on full scan, and in the light of the protocol that you had with the NAO, do you think the NAO should have accepted a full scan? Mr Hartnett: I think that has got to come out in Sir John's review and it has got to come out in Mr Poynter's review. I regret that we made a full scan available to someone leaving our premises. One of the other issues I do not have the answer to yet - and I do not think my colleagues around me know the answer to and I would quite like to know the answer to - is what computer or computers was the NAO auditor using in Waterview Park? Was he using his own or was he using ours? Because we had to stop our own inquiry, I simply do not know the answer to that. It seems to me to be a question of some relevance. Sir John Bourn: Perhaps I could say, Chairman, that, as Mr Hartnett has just said, this will be an issue that Mr Poynter will examine, and I have said that we shall be happy to work with him. We had the perfect right to ask for the data that we did ask for and the way in which it was supplied to us is a matter for HMRC and, as Mr Hartnett has said, further work will amplify our mutual understanding of the whole area. Q53 Keith Hill: Right well, I hear what Sir John says. Can I just ask Mr Hartnett what he makes of the letter of 9 November from the Second Director, Tax Credits and Benefits at the NAO where he apologises to HMRC (i) for not fully apprising HMRC of the NAO's new approach, and (ii) for not ensuring the implications of the new audit approach were understood? Mr Hartnett: I want to say three things, if I may. The first is - and maybe this is not terribly helpful - I think the quality of this letter is a mark of the quality of relations between HMRC and the NAO. The NAO is a demanding auditor but we have great respect for the NAO. The second thing I want to say is I do not know the individual who wrote the letter, I have never met him personally, but I am pleased to see the apology. It seems to me that it is important. The third thing is I believe that it is an apology for some things that went wrong, but I say that - I am sorry to be repetitious - knowing that Sir John will be carrying out his own inquiry and knowing that Mr Poynter is carrying out an inquiry. Q54 Keith Hill: And may I say that I think it is the view of this Committee that the letter demonstrates great integrity on the part of its writer. Can I just ask you one final question then, which is on the issue of cost. Can you confirm that the question of costs was never explored with the clearing system because again, as you said to the Treasury Select Committee, the NAO had stepped outside the process we had established. Mr Hartnett: I have seen nothing that suggests that cost was discussed anywhere and that it was anything other than the SEO saying that the material was there and it would be costly to get something else, so I have seen no evidence of a discussion. Q55 Keith Hill: The absolutely final thing, although the question of cost was in the mind of the junior official in the March email exchange, it is right to say that this did not reflect a formal HMRC position? Mr Hartnett: No, I have seen no evidence of that, but I would say this: I want all our people, and Paul Gray, my predecessor, would have wanted all our people, to be conscious of cost but not at the expense of security. Keith Hill: Thank you. Q56 Chairman: Just to be fair, do you want to comment on this 9 November letter, Sir John? Sir John Bourn: I think only to say that - and I am grateful for the point that Mr Hill made about it - it was a letter which dealt with the audit strategy and expresses the regret on the part of a member of my staff that he had not discussed this strategy with HMRC. It was not about the particular data which forms the subject of this investigation but, as Mr Hartnett has said and Mr Hill has acknowledged, it was about the relationship between the external auditor and the client, and I think it does show that the relationship between the two organisations was fundamentally right. Chairman: Richard Bacon? Q57 Mr Bacon: Mr Hartnett, you said to the Treasury Select Committee - and I refer to the point that Mr Hill was making - and I quote: "Here we had set up a procedure with the National Audit Office for passing data to them. The National Audit Office did not use the procedure and we did not release the data through the procedure ..." That begs a couple of questions. First of all, were the National Audit Office aware that this procedure had been set up and, if so, how? Mr Hartnett: I think the letter to which we have just referred, Mr Bacon, is evidence of that procedure and I am told, although I have not personally seen them, that there are emails which point to knowledge on both sides of the process and the procedure. Q58 Mr Bacon: But, nonetheless, your own officer also did not use the procedure? Mr Hartnett: That seems to be the case. Q59 Mr Bacon: This then leads us to the email of 13 March, the one sent at 23 minutes past three, and indeed in answer to my colleague Mr Dunne, who is also a member of the Treasury Select Committee, one of the things that you said on 5 December was: "... what we know from the email is that it was sent. We do not know that the process owner read it or when he read it." Mr Hartnett: Yes. Q60 Mr Bacon: Has it now been established - because you can look into emails and see when they were opened, it leaves a trace with a time on it - when the email was opened? Mr Hartnett: Not to my knowledge, Mr Bacon, because, as I explained earlier on, HMRC started an investigation; it has stopped it; the emails have been provided to Mr Poynter and maybe to others (I know they were provided to Mr Poynter); and I do not know the answer to that question. Q61 Mr Bacon: The emails have been provided to us, I have got a copy of them here, but what I am really asking is has the investigation established, by looking at the computer itself, by going into the interstices of the computer, when the email was opened? Mr Hartnett: That is work that Mr Poynter is doing. I am not privy to the detail of his work. Q62 Mr Bacon: I would just like to explore the question of cost a little further. You said in answer again to the Treasury Select Committee that in relation to the previous episode with APACS, the clearing system, that in order to protect members' account numbers, you had been able to take a copy of the segregated data very quickly without involving your IT supplier. It sounds on the face of it highly likely that if you knew what you were doing and if you worked in the area, making a copy of a set of data while leaving one or two fields blank would be a relatively simple matter that would not involve a lot of cost. Does that sound fair to you? Mr Hartnett: To the best of my knowledge, Mr Bacon, there are five junior people who have had a part in handling the disks or the loading up of the data that was brought to Waterview Park and the like. I know that Mr Poynter wants to understand which of them knew how to use the stand-alone secured computer to produce a different cut of the data, if I could put it that way. What is clear to me at the minute is that it was possible to cut that data in Waterview Park in a different way in order to provide material to APACS. Q63 Mr Bacon: Without any significant cost? Mr Hartnett: To the best of my knowledge, without any significant cost. Q64 Mr Bacon: So although the senior executive officer mentioned the issue of cost, that was probably a red herring and was unlikely to have been an issue in actual fact? Mr Hartnett: That could be right. I do not know the answer. Mr Poynter is going to get us there - I hope. Q65 Mr Bacon: I would like to ask about the issue of testing because child benefit used to come under the Department for Work and Pensions and was transferred over to your Department. We were told by the National Audit Office in a previous hearing that for audit purposes the National Audit Office was satisfied with the testing which was undertaken by the DWP itself and that therefore they could rely on that from an audit standpoint because of its extent and its quality. That ceased to be case when the function of paying child benefit transferred over to HMRC because the quantity, the quality and the extent of the testing undertaken internally by HMRC was not as great as had been the case under the DWP. Is that also your understanding? Mr Hartnett: I have absolutely no knowledge about that at all and I am going to go away now and find out what the quality of our testing was because we are rigorous about our testing. Q66 Mr Bacon: Could I ask Caroline Mawhood to just comment on that. I think I am right in saying, if I reprise what you said last time accurately, that while it was at DWP there was in the NAO's view from an audit standpoint accurate internal testing for your good purposes? Sir John Bourn: Perhaps I could just preface what Miss Mawhood is going to say. We are not critical of the arrangements in HMRC. They take their sample for internal management purposes. They are perfectly reasonable in what they do. Our concern of course was the whole issue of whether the accounts give a true and fair view, and for that we have needed a wider range of instances from which to draw our sample. In the past, DWP, for their purposes, had done that so we were able to use it. HMRC had a different approach, which is absolutely their business, but because it did not coincide with our needs, we had to obtain the information separately. There is no criticism on our part of the arrangements in HMRC in this regard. Is there anything you would like to add to that? Miss Mawhood: I think that probably explains it all. Under DWP they were taking a large sample and getting independent evidence that the claimant, for example, was still alive whereas later when HMRC was looking at what testing they would do, given the cost of testing so many individual cases, they decided to take a risk approach, which is perfectly legitimate as Sir John says, for their purposes, but for our purposes in carrying out the audit we felt that we needed to do our own sample in the light of that. Q67 Mr Bacon: You say for their purposes. The ultimate purpose was paying child benefit to child benefit recipients and that continued to be the case whether it was done by DWP or later by HMRC, surely? Miss Mawhood: I think they had their purposes for doing the sample. It does depend on different approaches in different departments to this sort of thing. From our point of view of getting the audit evidence we looked at what testing was done and we judged that we needed to do more testing to give ourselves assurance about, in this case, child benefit payments. Mr Hartnett: Mr Bacon, can I come back in because I now understand the question in a way I did not before, and I apologise for that. The NAO wanted to look at the basis on which we were running a random enquiry programme. It was a different risk-based approach to checking compliance with child benefit and, as Sir John and Miss Mawhood say, they wanted a bigger sample in order to test what we were doing. I have to say I welcome them wanting to test what we were doing because it provided assurance for us or would have told us that we could have done it better. Q68 Mr Bacon: I would like to ask you about the physical copying itself. How is it physically possible to draw down a full copy of the data on to a removable CD? How is it possible that a junior official could do that? Mr Hartnett: Twice a year, for compliance purposes, the officials in Waterview Park in our claimant compliance area ask EDS, who run the system in Benton Park View (also in the North East) to produce a subset of 38/40 fields - I will correct that if I need to - of the main child benefit database. It is a snapshot in time. That is taken to Waterview Park by people from our IT Directorate, handed over to the claimant compliance people who have access to a secure environment, where there is a secure desktop, and they load it up onto two disks, so it is part of a normal process. Q69 Mr Bacon: That sounds rather different from what you said to the Treasury Select Committee where you said that it was a puzzle to you as well how it should have been built into your system that it could have been possible to make a full copy. In fact, my question was phrased using your own words, this is in answer to question 356: "... how on earth was it possible ever to draw down a full copy? At this moment I know it clearly was possible, but ---" and then the interlocutor says: "That is an issue of system design?" and you say "Exactly; absolutely." Mr Hartnett: I am sorry, Mr Bacon, I was looking to find the question which I do not have here. Q70 Mr Bacon: It is question 356 by Mr Todd Mr Hartnett: Question 356, thank you. What I was referring to was to the copy made in Waterview Park. I have described for you the process by which the disks get to Waterview Park from the mainframe at Benton Park View and on to the secure system. One of the issues that I am hoping Mr Poynter will address is how it was possible to take copies of this material. Q71 Mr Bacon: That was my question. How on earth was it possible for a junior member of staff to take a full copy of the data and then dispatch it? How was the overall system designed in such a way that that conceivably could happen? Mr Hartnett: Three junior officials managed that secure environment and that computer. I want to understand, and I do not fully at the minute, why they were able to do so. Clearly they were able to download a copy of the whole system. That seems to me to be something we have to address. Q72 Mr Bacon: And the fact that the copying elements within laptops and PCs inside HMRC have now been disabled - and the Chancellor made reference to this in his statement this afternoon - suggests that that hole has now been plugged; is that correct? Mr Hartnett: We have disabled all UBS ports and other download facilities. They are only put back in place where there is a crucial business need and only on the authority of a senior director. Can I add one thing about our laptops, Mr Bacon, material on our laptops is automatically encrypted and accessible only by the owner of the laptop. Chairman: Thank you. Austin Mitchell? Q73 Mr Mitchell: There is a report by Kieran Poynter, who is the Chair of PricewaterhouseCoopers. Why were PricewaterhouseCoopers chosen to do this? Mr Hartnett: I am not sure I know the answer to that precisely, Mr Mitchell. I know that they would have been regarded as a firm well able to do this and skilled in the sort of work that was needed, but this was an arrangement entered into under the OGC Catalyst contract arrangement pre-generated by the Treasury not by HMRC. Q74 Mr Mitchell: Part of their report in spring 2008 is on internal processes and culture and how they could be strengthened to achieve appropriate security in the future, et cetera, et cetera. Why can the NAO not do this? Mr Hartnett: I think there is a very important issue here which has appeared in some media comment about this, and that is it needed someone independent because the NAO might - and I stress might - have an explanation for things and HMRC might have an explanation for things. Sir John has already mentioned that I offered a hypothesis earlier on and they need someone independent to discern what the right answer is. Q75 Mr Mitchell: PwC is a romantic name and you say that PwC are regarded as independent. They get so much business from the Government that I cannot see them coming out with a slashing indictment of ministers, the Department or anybody they have got dealings with. They are regarded as more independent than the National Audit Office? Mr Hartnett: I have given you my explanation as to why it needed someone else, but I do not think Mr Poynter will hesitate for a moment to criticise HMRC, or even the NAO, if he has the evidence to do that. Q76 Mr Mitchell: Was there any competitive bidding to do this? Mr Hartnett: I am unaware of how the contract was let, Mr Mitchell. Q77 Mr Mitchell: Do we know how much they are going to be paid? Mr Hartnett: No, the fee will be charged to the Treasury and then recharged to HMRC. I think it is too early to say what that fee will be. Q78 Mr Mitchell: Of course given the pattern of these consultants, it is permissible to think that they might well come up with a recommendation that the whole system be reviewed by a team of consultants from PwC at the end of the day! Mr Hartnett: I think it very unlikely that HMRC would be naive enough to acquiesce in that. I should just add, Mr Mitchell, one thing I have missed. My understanding is that these Catalyst agreements, pre-tendering arrangements, put in place by OGC do have pricing arrangements in them, but we can let you know more if that is important. Q79 Mr Mitchell: There has been a shower of mea culpas which is even greater than those I offer my wife from time to time! Everybody has said it is a terrible thing, an awful situation. Labour Party members are saying, "Dare we go canvassing now when about half the population have received a letter saying 'we are a load of grovelling incompetents; we keep losing all of your personal information'." It does not create a good atmosphere. Is the fuss exaggerated? What exactly is in these records that is going to allow people's identities to be used? You can get much of it from the electoral roll and when it comes to bank accounts the information is there for paying in not for taking out. Mr Hartnett: Let me say two things. First, I have not apologised once for my Department being a shower of grovelling incompetents. I am very proud of my Department. It is regarded by the OECD as one of the best tax administrations in the world and often we are the tax administration that other countries turn to for help and guidance. I have apologised unreservedly for the dreadful mistake that has happened here. Q80 Mr Mitchell: What I am asking really is - I mean everybody apologises for their own incompetence, even I do it (although not very often!) is there any great threat? Mr Hartnett: There is a risk here. Q81 Mr Mitchell: What is the risk? Mr Hartnett: The risk here is if these disks were to fall into the wrong hands - and there is no evidence that they have - perhaps taken with other information, that the information could be misused. Q82 Mr Mitchell: Taken with other information which they do not have? Mr Hartnett: Well, I do not know the answer to that, Mr Mitchell and, with enormous respect, you do not either at the moment, I think the crucial thing is, you are right, if I may say so with great respect, in that the data that has been lost, on its own, if it fell into the wrong hands would not give access to bank accounts - the banks and others have told us that - but we have put in place with various agencies contingency plans both to monitor this constantly and to act very quickly if we need to. Q83 Mr Mitchell: So we have created an atmosphere of panic and fear and alarm unnecessarily? Mr Hartnett: I do not think that is right. I think it was important for people to know about this loss. The Information Commissioner has complimented HMRC - and I do not solicit compliments in this context at all - for reporting the issue. The Government set up the role of Information Commissioner in this respect because so much of people's data is now held by government departments and in the private sector and needs to be protected. Q84 Mr Mitchell: I can see that. Let me just turn to TNT. Why was TNT employed in the first place when there is an organisation called the Post Office which most of us use? Mr Hartnett: TNT won, as I understand it, a competitive tender to carry our internal post in 2002, and that is who we use for our internal post. We use the Post Office for a lot, not necessarily all, of our external post. Q85 Mr Mitchell: I was just Googling, as one does, before coming here and I found another example of TNT delivering confidential information. I think it was coming from your Department and it was clearly addressed to an office in Dundee and it finished up in a training organisation in Cumbernauld, or vice versa, I am not sure, I did not read the Google very well. Do you have confidence in TNT on the basis of this performance? Mr Hartnett: We are talking to TNT about performance. They have served us well in the past. When Mr Poynter, the police and others have reported on this incident, we will clearly want to talk to TNT again. Q86 Mr Mitchell: I find extraordinary that they do not have a tracking system for their own deliveries. Mr Hartnett: My understanding - and others behind me will soon leap in and give me a note if I have got this wrong - is that TNT do have a tracking system but it was not used on this occasion. Q87 Mr Mitchell: Why? Mr Hartnett: That is a question that I suspect all the agencies investigating this will want to know the answer to, and I do too. Q88 Mr Mitchell: One point that occurred to me was the emotional effects and that because of job shedding and the merger of functions and new functions taken on there is very low morale operating in the Department. Would that be a factor? How good is morale? Mr Hartnett: It depends on the relevant areas, Mr Mitchell. I think morale in our Department is low. We are going through an enormous amount of change. I read a lot about - and I am sure you do - the so-called J-Curve of Change. I hope and plan for us to be coming up from quite a low position here. It is really important for me to say as well that I have seen no evidence whatever so far that cost efficiencies or job cuts or our change programme have anything to do with this dreadful mistake. Q89 Mr Mitchell: If you have all these threats hanging over your head you do not tend to put in maximum performance, do you? You tend to get a bit slap happy and think, "Oh bugger it." Mr Hartnett: That is not how it is in HMRC, Mr Mitchell. If you look at our processing areas, for example, our people are doing fantastically well. They have achieved 40% or 50% efficiency gains. A survey which was carried out of the quality of our performance through aspects of our contact centre show a very high level of satisfaction. Our people take pride in doing a great job. The people in Waterview Park in particular are incredibly proud of the quality of job they do. Q90 Mr Mitchell: I just want to ask about this excess of information which you sent. You said that it would cost £15,000 to download it from the computer excluding this information, but I got the impression from what you were saying to Richard Bacon that it could be done comparatively cheaply. Which is the truth? Mr Hartnett: My understanding, based on the information available now, is that a different set of data could have been provided to the NAO in Waterview Park using the secure system there because that is where we got our data to give to APACS. I do not know at the present moment in time why it was not possible to do that then but, as Sir John has recognised, my hypothesis is that costs came into it here because one or more individuals believed they had to go back to the mainframe in Benton Park View in order to get the compressed data that the NAO auditor appeared to be asking for. Q91 Mr Mitchell: But no costs were asked for. The person in receipt of this email --- Mr Hartnett: I do not know, Mr Mitchell, that £15,000 is the precise figure. That is a figure I have seen. Q92 Mr Mitchell: But it does read like a routine dismissal, "Oh, it will cost too much; let's not bother." Mr Hartnett: Can I just add one other thing that I need to bring out as well. You asked me about tracking and all of that (and it was Mr Hill who asked me about processes) one of the things that our guidance says specifically is that sensitive data should be sent via an auditable process, and that is one of the other things that has gone wrong here. I regret it but that is one of the other things that has gone wrong. Chairman: Philip Dunne. Q93 Mr Dunne: Mr Hartnett, in answer to a parliamentary question in October, the Minister confirmed that there had been over 2,000 separate security breaches within HMRC offices in the preceding 12 months. Was it that which led you to agree with the Treasury Select Sub-Committee that there is potentially systemic failure within HMRC or was it the data loss to which this hearing relates? Mr Hartnett: I did not agree, Mr Dunne, that there had been systemic failure. The record shows quite clearly that those were the first four or five words of a rather long sentence - I wish I had used much shorter sentences now - in which I made it really clear that the issue of systemic failure or no systemic failure would depend on Mr Poynter's review and the other reviews. As I sit here now, I do not know whether there was systemic failure. Q94 Mr Dunne: Do subsequent security breaches help you to form a view of systemic failure, for example the breach which we heard about in the Chancellor's statement just now in Coventry? Mr Hartnett: I am very concerned about what has happened in Coventry. All I know as I sit here is that an amount of cocaine - 1.5 kilograms - is missing from the place it should be in in a secure lock-up. Perhaps Mr Dunne, I can just take a moment to say that some of the more lurid stories about this, about ammunition, passports and firearms being missing, are just plain wrong. Q95 Mr Dunne: You can confirm to us now that the only thing that is missing is the 1.5 kilos of cocaine? Mr Hartnett: That is what I am confirming. Q96 Mr Dunne: How many people had access to the passwords for the Coventry storage facility? Mr Hartnett: To the best of my knowledge at this moment in time - and there is a police investigation started - less than ten people. Q97 Mr Dunne: How many other sites are there within HMRC's management where confiscated goods are held? Mr Hartnett: I do not know the precise answer to that. There are Queen's warehouses and there are lock-ups at other places where material can be confiscated. I should perhaps add that this process was thoroughly reviewed in 2006 and given a clean bill of health. What I do not know at the minute is whether this cocaine has been sent for destruction or to a court or to a forensic science laboratory and the paperwork has not been done properly or whether it has been stolen. I am very worried about it if it is the latter. Q98 Mr Dunne: What steps have you taken in the light of this latest incident and the whole question of security of data, and now goods, held by HMRC to refresh and review? Mr Hartnett: That review will be refreshed shortly. At the moment, I have focused the Department on making sure that, wherever possible, goods are taken to Queen's warehouses, which are ultra secure, if I can put it that way. Our faith in what has been a very secure system is presently knocked by what has happened in Coventry although I do not know precisely what that is. Q99 Mr Dunne: You would not characterise that as an example of systemic failure at this time? Mr Hartnett: No, I characterise that, Mr Dunne, as a complete one-off. To the best of my knowledge, talking to colleagues who were involved in the old Customs, there has not been an incident like that for many years. I think that is absolutely not systemic. Q100 Mr Dunne: Mr Lodge, are you familiar with the Winzip 8 software package? Mr Lodge: I have heard of it, yes. Q101 Mr Dunne: Are you aware that that was the software package used for compressing the data supplied to the NAO? Mr Lodge: I understand that it might have been. Q102 Mr Dunne: You have not checked that in your new role? Mr Lodge: As Mr Hartnett has said, details surrounding the circumstances are being gone over very thoroughly by Mr Poynter and his team, and I am sure that will be one of the issues that they will pick up. Mr Hartnett: Mr Dunne, might I come in just for a second as I may be able to help. My understanding is that Winzip 8 was used in relation to the data taken to Waterview Park. I am told - and I have not been able to investigate it personally yet - that is the terms of our agreement with EDS in respect of that data taken to Waterview Park because it is taken physically by our IT people. I want to give you an assurance that if that is what the terms of the contract say we will be looking at that very carefully indeed. Q103 Mr Dunne: Mr Hartnett, you confirmed to me at the Treasury Select Committee that it was Winzip 8 and we discussed the password protection which you have upgraded since the loss of the data. Mr Hartnett: Yes. Q104 Mr Dunne: The reason I am addressing this question to Mr Lodge is that he now has responsibility for data security. Have you now sought to upgrade the Winzip 8 release to Winzip 9 across your Department? Mr Lodge: We have upgraded the encryption to 256 bit encryption, which I understand to be industry standard. I also understand that it would be better not to specify the particular product that we use in this case. Q105 Mr Dunne: I have some sympathy with that. The Chancellor was very categoric in telling Parliament that the material provided to the NAO had not been encrypted. In fact, there is encryption within the password for Winzip 8. Who gave him the advice that it was not encrypted? Mr Hartnett, perhaps you can help us. Mr Hartnett: I am not sure I can, Mr Dunne. I know that Winzip 8 provides a password. I at least was advised that it did not provide encryption that is significant and I seem to recall - but I cannot find it quickly - that we discussed the value of the encryption of Winzip 8 at the TSSC hearing. Q106 Mr Dunne: We did and subsequent to that I have had information from a computer software expert who has confirmed to me that the password is indeed encrypted within Winzip 8, which is why I am concerned that somebody within HMRC may have been giving misleading information to the Chancellor. It may not be the most robust form of encryption and so it may well have been appropriate for the Chancellor to suggest that the encryption was not as good as it could have been, but the purpose of my questioning at the Treasury Select Committee was to ask why it was that HMRC decided to send letters to all 7.2 million people on the basis that they had had information which was more readily available than it has turned out to be to somebody if it falls into the wrong hands because it is encrypted? Mr Hartnett: My advice Mr Dunne, is this: if there is encryption of Winzip 8 - and I am not a techie in this sense - it is simply utterly insufficient to meet the needs for moving this quality of data in the secure way that Mr Lodge is describing. Q107 Mr Dunne: Could we move on to the use of TNT for a moment. You mentioned TNT and the Post Office. How many separate contracts does HMRC have for its data transfer? Mr Hartnett: I do not know the precise number. There certainly have been several and I know that not very long ago we ended one because we were concerned about it. Q108 Mr Dunne: Does the TNT contract specifically cover the transfer of data between government departments? Mr Hartnett: I do not know the answer to that. Can I let you have a letter? Q109 Mr Dunne: I would appreciate that. Could you tell us specifically whether or not the TNT contract covers data transfer to non-government departments such as the NAO? Mr Hartnett: What I do know about the TNT contract is that there is a list of approved addresses. The information I have so far - and this is all work for Mr Poynter and I am sorry I need to keep saying that - is that the NAO address may not have been on the approved list for TNT. Mr Poynter is looking at that. I also want to know the answer to that. Q110 Mr Dunne: Indeed, and so will this Committee because again the Chancellor was briefed I think by HMRC and by the NAO saying that the package had been provided to TNT. How can you be certain that the package was provided to TNT? Mr Hartnett: My information again is that those who were responsible for sending the package believed that they put it into the system containers from which TNT would have collected it. Q111 Mr Dunne: Could they have been mistaken in that belief? Mr Hartnett: Anyone could be mistaken, Mr Dunne. Mr Poynter is looking at that, the police are looking at that, and the others are looking at that. Q112 Mr Dunne: What I fail to understand is if there is uncertainty about whether TNT were used, why TNT were identified right at the outset of this inquiry as being the people who were potentially responsible for the loss? Mr Hartnett: There was no uncertainty and I do not believe there is any uncertainty at the minute. I have simply conceded, as I would concede on anything, that people could make a mistake. Our belief remains that TNT were used. This will be checked by Mr Poynter and the other agencies. Q113 Mr Dunne: You have just told us that the TNT tracking system was not used. That seems most unusual if TNT have a contract where they do engage their own tracking system, which would suggest that it might possibly not have been a TNT packet because otherwise it would have been picked up by their tracking. Mr Hartnett: No, I do not think it is quite like that. I think there are two sorts of ways in which we use TNT. Some material is tracked; some material is not tracked, and I do not think any failure to put in tracking can be seen as evidence that it did not go through TNT. Q114 Mr Dunne: Are you aware whether there was any external identification either on the disks or on the packet of what was contained within them? Mr Hartnett: I do not know of any. Mr Lodge: I think there may have been something written on the disks but I do not think it would to any lay person have identified them for what they were. Q115 Mr Dunne: Would it identify that they belonged to HMRC? Mr Lodge: I cannot answer that, I am sorry. Q116 Mr Dunne: Will Mr Poynter's inquiry be looking into that? Mr Hartnett: Very much so. Q117 Mr Dunne: Why do you think Mr Poynter is going to take until June to deliver his full report? Mr Hartnett: My understanding is that Mr Poynter is going to take until spring. I think Mr Poynter has a huge amount of work to do with us and with the NAO. He may need to look elsewhere. I think he has been moving quickly but there is a great deal to do and it is important he gets it right. Q118 Chairman: Just on identification, the National Audit Office told me - is this right - that this was supposed to be sent to you in a tax wallet, which is quite large? Mr Tim Burr said to me it was the size of a shopping bag, that it had "To: NAO, From: HMRC". Can you describe exactly what it looks like, what is it? Mr Burr: What I was referring to was a container in which material commonly reaches us from the HMRC, but of course I do not know whether this particular information was in such a package. Q119 Chairman: If I suddenly saw this would I immediately think that it might look like the goods because it was addressed to the NAO from HMRC and was rather large in a yellow packet? Would I immediately recognise it as something significant? Mr Hartnett: When we send material in our internal post, Chairman, whatever packaging it is in, it then normally goes in a yellow plastic wallet or bag or whatever and is sealed. If you saw one of those bags you would say this might be HMRC, it might be DWP, it might be another department, because a number of departments use that approach of what is called - and this may be a new word to the Committee - a Polylope bag. Q120 Chairman: A what? Mr Hartnett: A Polylope bag. That is the technical term for the bag. I have only learned this recently. Chairman: Thank you very much. Don Touhig? Q121 Mr Touhig: Before I come to HMRC can I ask Sir John, what has the National Audit Office done now to ensure its procedures are robust enough to avoid this sort of thing happening again? Sir John Bourn: Well of course since this difficulty has arisen by the failure to get to us the material which we had asked for, it does not lie within our power to find the solution to this problem. We had asked for the material, it was sent to us, but it did not arrive, so we cannot guarantee for the future that that will never happen again. What we can do - and what I would be glad to do is when Mr Poynter asks me to collaborate in his work I said I would do my very best to assist and help him. We have also commissioned ourselves an inquiry about procedures for handling secure data to make sure that our handling of material protected by the Data Protection Act is good procedure and in line with best practice. So our response to this has been full-scale collaboration with Mr Poynter, a review of our own data security handling procedures, but since it was not an act of the NAO that caused the material to go missing, that is not something that lies within our power to deal with. Q122 Mr Touhig: So really in one word nothing has changed in terms of your approach - because if I understand what Mr Hartnett said earlier there was a failure to follow the protocols in requesting this information? Sir John Bourn: As Mr Hartnett has said, this is one of the issues that Mr Poynter is discussing. From our point of view we asked for the data, the request was accepted, and an attempt was made to send it to us. Q123 Mr Touhig: So can we be clear then, was there a failure of the protocol, Mr Hartnett, because I thought that was what you implied in answer to Mr Hill earlier. Mr Hartnett: My understanding, Mr Touhig, is that the protocol did not work as it should have worked. Q124 Mr Touhig: It was not followed or did not work? It was not wound up like a clockwork toy or something? Mr Hartnett: Certainly it was not followed by the officer involved but it may not have been wound up properly. As Sir John has said, he is looking at this and Mr Poynter is looking at this too. Q125 Mr Touhig: And it was not followed by the NAO is what you are saying? Mr Hartnett: That is my understanding on the basis of the partial evidence we have so far, but I accuse the NAO of nothing. We need to understand what is happening here. I would just draw your attention though back to the letter of 9 November. That is the letter from the Second Director where his opening words go to the very point you raise. Q126 Mr Touhig: So clearly, Sir John, HMRC think there was a failure on the part of NAO to follow a protocol. Whether that is accepted by the NAO or not, does that not mean alarm bells should be ringing to ensure in future rather than the one word "nothing" that I summarised your response as, that the NAO should ensure that the proper protocols are being followed? Sir John Bourn: As Mr Hartnett was careful to say, he does not actually say that there was a failure on the part of the NAO to follow protocols. Q127 Mr Touhig: Sorry, Sir John, I thought that was what he did say. Am I missing something here? Mr Hartnett, you said there was a failure of the part of the NAO to follow the protocols. Mr Hartnett: On the basis of the evidence I have seen, which is partial, it seems like that to me but I do not accuse the NAO of anything because I have not got the evidence. Q128 Mr Touhig: You are clear as far as you are concerned that the NAO failed to follow the protocol? Mr Hartnett: As did the HMRC not do things properly. Q129 Mr Touhig: So we are clear precisely what Mr Hartnett is saying, Sir John. Sir John Bourn: Yes, I heard what he said. But, as I say, as far as we are concerned although, just like Mr Hartnett, I am anxious to get to the bottom of this matter and we will work with Mr Poynter to do so, the essence of the matter is that we requested this information, the request was accepted, it was not questioned. Q130 Mr Touhig: I fully accept that, Sir John, you did make that very clear at the beginning, but what I am trying to establish is at the moment there has been no change to the NAO's approach to these matters although the HMRC think there was a failure to follow protocols in the first place. Sir John Bourn: There has been no change in the approach since what we are engaged in is seeing whether the approach does need to be changed. Q131 Mr Touhig: Can I come to you then, Mr Hartnett, in the letter that you referred to of 9 November, the writer of this letter says: "We do take seriously our data protection responsibilities and I recognise that the security incident that has arisen here has occurred solely as a result of the data request that we initiated and I accept responsibility for that." Do you think that means the NAO is taking responsibility for the start of this debacle? Mr Hartnett: I think the NAO is saying there - and I surmise Mr Touhig --- Q132 Mr Touhig: Tell me what you think it means. Mr Hartnett: I think it means that the Second Director of the NAO is saying we asked for the data and that was the start of the process. I would like to know, but others are talking I imagine to the Second Director of the NAO whether it means - and I use the terms I used earlier on of our own people - we did this thing of actually asking for a full data set, we emailed you, we told you to send it to us carefully, but we asked. I do not know the answer to that question until I and others have the opportunity of asking the Second Director what he meant. Q133 Mr Touhig: I will have to read the transcript to decipher exactly what your answer was, I am afraid. Mr Hartnett: I am really sorry. Q134 Mr Touhig: The letter goes on to say: "In this case, having redefined the direction of our audit approach for child benefits, I should have personally ensured that as data owner you were apprised of what we planned to do." Does that imply, does that state that the NAO did not tell you precisely what they planned to do with the data? Mr Hartnett: I think that is the Second Director saying to our child benefit process owner, "I should have talked to you about the approach we were taking in this audit. You are the process owner and I am sorry I did not do it." I do not think I read into that anything in particular about disks and the provision of data. Q135 Mr Touhig: No, I will come on to disks. So if we accept your definition, this is one official to another saying "I should have briefed you on this", but does this letter state - and is it a fact - that your Department had no idea about the new audit approach or is this just a rather courteous response and taking responsibility for something? Mr Hartnett: I have not read it like that. I have read this as meaning that this relatively senior - Sir John, I am sure, will correct me if I have got this wrong - Second Director in the National Audit Office had not discussed this with the child benefit process owner but his people may have discussed it lower down in the organisation. Q136 Mr Touhig: Do you know? Mr Hartnett: I do not know. Q137 Mr Touhig: The NAO were telling us there was a new approach to this audit. Did your people actually know that? Mr Hartnett: I do not know the answer to that. Q138 Mr Touhig: Why do you not know the answer. Mr Hartnett: I know that the child benefit process owner did not know the answer to that. In order to know there was a new approach my people would have had to have talked to people. Our investigation has halted while the other investigations take place, so I have not been able to and my colleagues have not been able to ask our people. Q139 Mr Touhig: So you do not know that there was a new approach because presumably there was nothing in writing or there was no discussion? Mr Hartnett: There are emails which tell part of the story, which Miss Mawhood has explained earlier on, that HMRC had taken a different approach to monitoring claimants' compliance with the rules for child benefit and that the NAO were testing that in a different way, so we knew there was a different approach to audit happening but it had not been explained, as I read this. Q140 Mr Touhig: You knew there was a new approach but you did not know exactly what it was? Mr Hartnett: I have known subsequently but ----- Q141 Mr Touhig: You did not at that time have any idea? Mr Hartnett: No. The child benefit process owner who leads on this did not know. Q142 Mr Touhig: You said earlier that the NAO was demanding as auditor and that you had great respect for it; yet you did not treat it with much respect, did you, when it asked for this information in a particular way and you really said, "Well, sorry, you are going to get it as we will deliver it". This is not what the customer wants, it is what the provider of the service wants to give. Mr Hartnett: I am not about to criticise the NAO in that way. Q143 Mr Touhig: I am not criticising them. I am asking you. Mr Hartnett: What I am going to say is that my experience of dealing with auditors in different contexts is that they can be demanding. Q144 Mr Touhig: Yes, you said that but we have got emails here in which the NAO make clear the information they do not want. You have ignored that and you have told them they are going to have what you are going to provide. Is that the way you should be treating the body that is set up to scrutinise government expenditure on behalf of Parliament? It is a bit contemptible, is it not? Mr Hartnett: No, I do not think so at all, and I think I have explained that already in that I believe, and this can be tested, that what was happening here was that the individual who received the email and responded did not know that in Waterview Park it was possible to cut down data and that she was concerned that we would have to go to EDS to get a cut-down version at cost. I do not think that is contemptible at all. Q145 Mr Touhig: So you would say that this is really a one-off approach, that really your department has a much more responsive approach when they get requests from the NAO than, "We will give you what we will give you and tough if it does not do you any good"? Mr Hartnett: We have a proud history of being responsive to the NAO. I hope Sir John will confirm that. Q146 Mr Touhig: Yes, but it has not worked in this case, has it? Mr Hartnett: It has not worked in this case and it is ----- Q147 Mr Touhig: That is the point I am making, but you say that is not a cultural thing in the department. This is a one-off, that as a supplier of information to the body that is set up by Parliament and responsible to Parliament to scrutinise public expenditure you have a much more realistic and supportive approach and that you would condemn this sort of approach, but you basically said to the NAO, "We know what you have asked for but we are not giving it to you"? Mr Hartnett: I expect people in my organisation to be ready to challenge NAO requests for data when the data is available in another form there and to make sure it is what we should be doing, but our people recognise that the NAO have a statutory right, that they respond to Parliament and that we have to provide data. Q148 Mr Touhig: My time is up. I am sure as acting chairman you will probably make sure that message goes back. Mr Hartnett: Of course. Q149 Chairman: Just to clear something up, you said a moment ago about your SCO that she was concerned that she would have to go to EDS, you said something like that, and that this would be costly, but even if she had to go to EDS why should it have been so costly? It is in various reports that EDS should have only charged relatively small sums for stripping out this information. Mr Hartnett: As I explained early on in this hearing, on the limited evidence I have seen I think our SCO felt that the data was available on site in Waterview Park to the auditor who was there and that to get a stripped-down version of it without the accounts information she would have had to go back and pay money, and because the information was there in Waterview Park she was questioning whether that was the right thing to do. Q150 Angela Browning: Mr Hartnett, we have heard a lot of questions today that you have not been able to give a full answer to purely because of the Poynter inquiry but nonetheless you are in charge now and the fact that you have appointed Mr Lodge does seem to indicate that you realise that, whether you can or cannot come to conclusions about this individual incident, changes have to be made to your systems and I assume you assume that those systems have to be changed pretty quickly. Mr Hartnett: Absolutely, and they are not the only changes we need to make. Q151 Angela Browning: Can I just say to you that you have denied to colleagues here this afternoon that there is systemic failure within HMRC. This is not the first time, is it, that unencrypted CDs have found their way the wrong way? If you look back to September 2005, an unencrypted CD with the names and addresses, dates of birth and bank details of UBS customers was lost in the post, and at that time HMRC said it was "a one-off incident" and that you were urgently reviewing procedures. Did you not learn lessons from that? Did it not prompt you to look more closely at your security and the safeness of your systems at the time? Mr Hartnett: It did prompt us to look at those procedures and for some time now we have been discussing with representative bodies of financial institutions how best we can pass data to each other where that needs to happen in the most secure and encrypted way, and I am very pleased to say that those discussions are at an advanced stage, but different financial institutions have different approaches to security and we are just working through that with them now. Q152 Angela Browning: That was two years ago. Let us just take a look at what has been happening this year before we get to the matter that is under consideration by the Committee today. I am going to go through this rather quickly, but in April 2007 hundreds of HMRC documents were found strewn down a street in Nottingham. The documents were the details of the trading of a customs officer, including details of interviews with passengers suspected of smuggling cigarettes via an airport, and details of people's VAT returns. In the following month, May, 42,000 families' tax credits and bank details were posted to the wrong people after a printer error, and we all had the benefit of a statement on the floor of the House by the Chief Secretary to the Treasury saying how HMRC took confidentiality very seriously, had robust procedures, et cetera. In August 400 people's details were on a laptop that was left in a stolen car. A staff member had been using the PC for a routine audit of tax information. He had been keeping the laptop in the boot of a car in contravention of your own rules. In September records of 5,000 people's details were sent from HMRC to Standard Life's pension department in Edinburgh, and then we have September where we heard on a BBC Watchdog programme that HMRC caused personal details to be sent to the wrong people and an information expert said that the details could easily be used to apply for credit cards or loans and even to access bank accounts. Then we had a statement by the Financial Secretary to the Treasury in October who in a parliamentary answer said that between October 2006 and September 2007 2,111 reported breaches of security were recorded by HMRC in its 700 offices employing 90,000 staff. I can fully understand your defence of your staff, and very laudable that is, but you are the guy in charge. You have a serious problem and I really do think, from the answers we have had this afternoon, that you should be accepting and making appropriate changes now, regardless of when the Poynter inquiry reports, to resolve these security problems. I do not think we have heard anything this afternoon, apart from Mr Lodge's appointment, that has convinced me that somehow you are accepting the scale of the problem you have got at HMRC. What are you doing about it? Mr Hartnett: A lot of things. We have already talked about shutting down the ability of our people to use our IT system to copy things unless they need to. We have identified new rules for bulk data movements. We have made our directors accountable for data in their area. Many of the issues you have just gone through involve in one way or another our relationship with contractors. We are looking at that very carefully indeed. I would just say that Mr Poynter's interim report starts by saying - and I am not complacent about this in any way - that the things he would have wanted us to do we have already done. We have been very active. We have got a lot more to do. Q153 Angela Browning: We heard that when people join as new members of staff it is flagged up to them, I think you said, on day one the importance of security. Mr Hartnett: Yes. Q154 Angela Browning: Can I just say, as somebody who in a former existence was involved in the corporate sector with training, that it is no good just having rules? Part of the training process should be to ensure that staff fully understand the procedures and systems, and if the systems are not working you need to change the systems. What do you actually do to make sure that people who leave confidential information on laptops in their car boot or send CDs through the wrong system understand their role in your organisation? Mr Hartnett: We have stressed again and again to our people the importance of maintaining the security and confidentiality of data relating to our customers. Q155 Angela Browning: Can I just interrupt you. Is that through a formalised and systematic training programme? Mr Hartnett: We do have a training programme. We have regular reminders to our people. Our guidance is on the intranet and we have a very detailed training programme on day one for people who join us and we have refreshers as well. Q156 Angela Browning: It is a management failure, is it not? What about the line managers? It is nice to have access to have it on the intranet or what we in the old days used to call the manual of procedures, and in organisations there would be a hard copy of that but I appreciate it is all on the intranet net now, but what about your line managers? What responsibility do they take for making sure that staff actually put these things into practice? Mr Hartnett: Our line managers have been told on many occasions to ensure that our people follow this approach. Mr Poynter is looking at this. We are talking to Mr Poynter now. He has assured me that as he comes across issues that we need to act on he will tell me about them, we will not be waiting for his spring report, and we will be acting. Mrs Browning, as concerned as you are that we get this right, and as Mr Poynter records somewhere in his interim report, we want to become a world class data handling organisation and we have got some work to do to achieve that. Q157 Angela Browning: Do you have any Investors in People certification? Mr Hartnett: We have had Investors in People certification. Q158 Angela Browning: Have you got it now? Mr Hartnett: I would need to go and look. The areas of business that I was responsible for had it, and had it renewed. Q159 Angela Browning: With the downsizing of the personnel you employ, are you genuinely investing in proper training in making sure that people are properly inducted? Does everybody get a proper induction course? Mr Hartnett: I believe that everyone does get proper induction. Q160 Angela Browning: Do they? Mr Hartnett: I believe so. We are looking at this because we have got to make sure this is right and one of the key issues for our Department going forward is are we investing enough in the development of people. Our Pacesetter programme, which is driving improvement in skills for our junior and middle managers, is evidence of that investment and it is through that programme that the sort of efficiency gains I referred to earlier on are being delivered. Q161 Angela Browning: There is nothing about the culture at HMRC that says, "Welcome to your new job, you will soon get the hang of it"? Mr Hartnett: No, I do not think there is. I have seen no evidence of that. That seems to me to be a very slipshod approach and it is not an approach I recognise. Angela Browning: Thank you. Chairman: That is what they said to me when I became an MP! Keith Hill: And did you? Chairman: I am still learning after 25 years. Q162 Phil Wilson: The email of 13 March at 23 minutes past three, it says in there the original request was for 100% data scan. Mr Hartnett: Yes. Q163 Phil Wilson: Then it says you wanted additional data scans/filters, et cetera. Was that because of the NAO's change in the way they were going to audit Child Benefit, do you know? Mr Hartnett: I just do not know. I could surmise that is right but, as I said earlier on and I am sorry to repeat it, these are three emails which tell part of the story. I want to see other emails around that, I want to see what discussions were taking place. I am told that on the Wednesday of that week there was a meeting between NAO, some of our claimant compliance people and some of our data analysts, probably our statisticians, but I do not know what happened at that meeting at the minute. I am told that these issues were not discussed. Mr Poynter needs to test that. Q164 Phil Wilson: In this letter of 9 November, "Our Audit of Child Benefit" from the NAO, the last paragraph on the first page says: "We signalled the change in our audit approach...though without being explicit about the additional substantive testing that we proposed, nor addressing how we might extract this data." If that was made explicit to the person who wrote this email at 23 minutes past three he might have thought again about doing these filters, et cetera, might he not, but if he was not aware he was going to think, "I'm going to leave things the way they are"? Mr Hartnett: I understand the direction of that, Mr Wilson. I think the best I can say and the fairest thing I can say is if the person who wrote the email was better informed than they were at 15:23 they might have written a different email, but I cannot say any more than that. Q165 Phil Wilson: Speculation. Mr Hartnett: It is surmise. Q166 Phil Wilson: It is a particular consideration since we have now got this letter of 9 November. If on 13 March this person said, "Okay, we will do these new filters and additional data scans, et cetera", how long would it take to do that? Mr Hartnett: I do not know the answer to that. Q167 Phil Wilson: Would it be a week, a day? Mr Hartnett: I do not think it would have been anything like that long but can we find out the answer and write to the clerk. Q168 Phil Wilson: Okay. Mr Hartnett: I really do not want to speculate. Q169 Phil Wilson: This exchange of emails took place on the 13th and the disks were exchanged three days later. Mr Hartnett: Yes. Q170 Phil Wilson: From what you were saying to Mr Hill there seemed to be no protocol at all, he just handed the disks over. Is that right? Mr Hartnett: One of the most important questions yet to be answered is what was happening at the time that the disks were handed over, what led up to that, are there more emails, are there personal recollections of conversations. I have had no access to any of that at the minute and I am desperate to understand that. Q171 Phil Wilson: The other point to Sir John is a question about this letter of 9 November. Is what is in here basically about the change in the way that you audit the Child Benefit awards, et cetera, but you did not explain to HMRC that was what you wanted so, therefore, you ended up with a civil servant saying, "I am going to give you a 100% scan anyway"? Was the reason why the person was asking at 14:41 in an email for all these changes to the data because of the new auditing requirements? Sir John Bourn: What we asked for was the full range of data from which we could take the sample that we needed. We had asked for it before and it had been supplied, we were asking for it again. Q172 Phil Wilson: Was it because of the new auditing procedures as laid out in this letter of 9 November? Sir John Bourn: The new auditing procedures had been made available to HMRC before. Q173 Phil Wilson: It does not say that, it says it was "signalled" and goes on to say, "though without being explicit about the additional substantive testing that we proposed..." Sir John Bourn: The audit strategy had been supplied to HMRC. The apology was made because the official in the NAO had not explained that strategy to the HMRC people. So the strategy was clear and, as I say, under the strategy the requests were made, they had been accepted before and it was a similar request made again. We had not spent as much time as we could helpfully have done in explaining personally face-to-face the new strategy. Q174 Phil Wilson: So you can accept in that case there could have been a bit of confusion where this civil servant, whoever it was, could just have said, "I am going to give you the 100% scan because I didn't know about this." It had been signalled to the Department or HMRC but it had not been told in explicit terms what was required. It says that in the letter from your own Department. Sir John Bourn: In formulating the explicit request we had explained that we did not need all the data, we did not need the details of bank material, for example, so irrespective of the failure to explain the strategy we had made clear exactly what it was that we wanted and it was in response to that that HMRC said, "For our reasons we are going to supply you with more data than you asked for" and that was their response to it. We were concerned to get the data we wanted and, as I say, they had supplied it before and said they would supply it to us again. It was the failure of it to reach us that caused all of this trouble. Q175 Phil Wilson: Another question to Sir John before I wind up. In this "Briefing for Chancellor of the Exchange on the NAO's request for discs of information", in paragraph four, about the tax post wallet, it says: "This wallet does not require a signature from the recipient when it is delivered." How do you know whether you received it or not? Sir John Bourn: If we had received it we would know we had received it. Q176 Phil Wilson: How, because you have not got a signature, it has just been received? I do not know what happens but you receive it. It is lost somewhere, it could be anywhere. You have not got a signature for it, so how do you know whether you received it or not? Sir John Bourn: We know that we did not receive it because if we had received it we would have been able to work on it. Q177 Phil Wilson: My point is you do not know whether you received it or not because you do not get a signature for it, so how do you know it is there? It is lost. That is the definition of being lost, you do not know where it is at. Sir John Bourn: We know we did not receive it because if we had received it we would have worked on it. Q178 Phil Wilson: How do you know you did not receive it? Sir John Bourn: If we had received it we would have worked on it. Q179 Phil Wilson: But it is lost. Sir John Bourn: Yes, we did not receive it. Chairman: I think he is asking are you sure it is not in your office? Q180 Phil Wilson: Precisely. Sir John Bourn: I can respond to that because we had a full search by the Metropolitan Police and they looked in every desk and every cupboard and they did not find it, so I can provide that reassurance. Q181 Phil Wilson: So has every other department. We do not know where it is at because it is lost. Expected routes in paragraph seven: "On the same day we conducted a further search following the expected route of delivery..." Because it is lost did you also look at the unexpected routes of delivery? Sir John Bourn: We did our best to search everywhere it might be and the Metropolitan Police came and repeated that in even more professional detail than we could. Q182 Geraldine Smith: Can I ask about the Process Owner of the Child Benefit. What was her job? What were her responsibilities? Mr Hartnett: When we set up HMRC we created a role of Process Owner for all our main lines of tax and benefit credit business. We wanted them to own the end-to-end process, to be influential in the Department around that process and to identify opportunities to improve the process but they owned the process by which we paid Child Benefit. Q183 Geraldine Smith: The National Audit Office, when you were asking for the information you asked a junior official, a junior civil servant, is that right? Sir John Bourn: We asked for the information from HMRC, as I said. Q184 Geraldine Smith: Were you aware that you were dealing with a very junior person within HMRC? Miss Mawhood: We went through what we understood to be the designated contacts for this information. Q185 Geraldine Smith: So you thought that the person you should have been going through was a very junior official there? Miss Mawhood: We were given an individual to contact for the data scan. I do not know if that individual was junior or not, that was the individual we understood and were told we should be in contact with for that information. Q186 Geraldine Smith: Who told you that? Miss Mawhood: It was the arrangements with the individuals in the Child Benefit office who we dealt with. Q187 Geraldine Smith: Right. So they will have been fairly senior people you would deal with who would tell you who to contact? Miss Mawhood: I do not know the precise detail along those lines but Mr Hartnett is saying the detail of this will come out in Mr Poynter's review. My understanding at this point in time is that we were given the designated contact in the Child Benefit office in Washington and that was who we approached about this information. Q188 Geraldine Smith: It just seems very peculiar to me that the National Audit Office is dealing with junior officials for what is very important information. It also appears very strange to me that junior officials have access by themselves to just put this information in the post without any sort of check. I guess my question to you would be, why could one person do this? Why was there not even the check of a second person having to make sure the item was sent correctly? Mr Hartnett: I think, Miss Smith, there are two things to say. Maybe I can help Miss Mawhood here. We did provide a point of contact for the NAO which involved people who had access to the data in the secure room on the secure computer, but at no stage that I have seen, or my colleagues behind me have seen, in that process certainly in March was it envisaged that the data would be handed to someone to take out of the organisation and then sent out in October. Our rules say very clearly that with sensitive material and sensitive data there needs to be authorisation, and none was sought. These go back to the issues Mrs Browning was raising, are there cultural or managerial issues that we need to look at and we are going to be looking at. Q189 Geraldine Smith: Would the National Audit Office usually obtain this information on site? Would they usually come to you to get that information? Mr Hartnett: My expectation, but it is only my expectation, all the evidence is not there yet, is the audit should have been carried out on site and sensitive information like that should not have been taken away. I have been reminded from behind of something that is actually quite important, and that is we had agreed liaison arrangements and the individual who was asked to send the disks was not on the list of people provided for those liaison arrangements and the liaison point was not copied into the emails. I am going too far into Mr Poynter's work here. Those are issues Mr Poynter and, indeed, Sir John are going to examine. Q190 Chairman: You were speaking very softly, can you just repeat that? Mr Hartnett: I am sorry, Chairman, I am not usually accused of that. Q191 Chairman: Can you just repeat that? Mr Hartnett: There were agreed liaison arrangements in documents that set up the audit. The person asked to send the disks in October was not on the list of people in the liaison arrangements and it is my understanding that the liaison point was not copied into the emails. As I said, I am trespassing on Sir John's work and I am trespassing on the work of Mr Poynter. Chairman: That is an important point. Q192 Geraldine Smith: It is fair to say that the National Audit Office should not have been dealing with that person then? Mr Hartnett: I cannot say, Miss Smith. Q193 Geraldine Smith: You may not be able to but I can. Mr Hartnett: I need to say in response I want all the evidence. I am desperate to see the evidence in this because I want to know what HMRC has got to do going forward. There are a lot of things we have already done but there may be more we have to do and because we have not been able to conclude our inquiry we do not yet know. Q194 Geraldine Smith: Why did you not come to the site? Why was that information requested to be sent? The only thing on this email says: "Please could you ensure that the CDs are delivered to the National Audit Office as safely as possible due to their content". You were aware that there was a real issue about security and how important that information was. Why did you not just come and get it and do it on site as you would normally do? Sir John Bourn: Information needs to be available in various ways, electronically and by direct inspection. All circumstances of this, as we have said, we will be glad to examine with Mr Poynter. As Miss Mawhood has said, we went to the person who had been drawn to our attention as someone who could respond to this. We went to that person, we made the request and a response was received. We did not get the response, "You must come and see it on site". If we had that response we would certainly have taken it very seriously. We followed the procedures - procedures may be too strong a word - the understandings that were present and we followed them on this occasion as we had followed them in the past. As I say, we were happy to look at whether there should be other ways of carrying out this work but what we did was to ask for what we had a right to ask for, we asked for it from the person who had been drawn to our attention and our request was accepted without demur. Q195 Geraldine Smith: Mr Hartnett, a junior official was able to copy this information and just send it through the post. How many other junior officials would have been able to do that and had access to that information or, indeed, how many people? Mr Hartnett: At least two more, and I do not know whether there are two more on top of that as I sit here, so I do not want to give you an assurance, but I know it is no more than five. That is the lot. Q196 Geraldine Smith: They could do that individually without having to rely on anyone else? Mr Hartnett: No. Only three staff had access to the secure room and access to the secure computer. One of the questions that I need an answer to is how did those staff use the two IT people who supported them. I am absolutely confident that it is three people, it is unlikely to be five, but I want to be absolutely precise before I give you an assurance. Q197 Geraldine Smith: Have you any idea where the disks are? Mr Hartnett: I find it incredibly hard to be even mildly whimsical about this at the minute. It has been suggested that they are in interesting places like the Palace of Westminster and Buckingham Palace. I do not know where the disks are; I really wish I did. Chairman: Well, I have not got them anyway! Mr Bacon: They are not on eBay, have you checked? Q198 Mr Williams: Can I just come to the NAO for a moment. When you contacted the Department on 13 March, who did you contact? Was it the same junior official because someone provided you with information at that stage? Was it the same junior official on 13 March who was asked to provide the information at that stage? Miss Mawhood: The email of 13 March was to the junior business manager, the request for information. Q199 Mr Williams: Was that the person we are talking about? Was it the same person on both occasions? On 13 March was it the same individual you contacted? Miss Mawhood: No, the individual had changed by October and we had been given another designated contact for the October. Q200 Mr Williams: Who gave you that? Miss Mawhood: I am not entirely sure but I think it was the person from March, who said, "I am no longer doing the job". I am speculating a bit here, but my recollection is, that is normal procedure when somebody moves to another job, they say, "This is the individual taking over my job". Q201 Mr Williams: Your presumption was that although it was not the same person it was an official at the same level that you contacted on both occasions? Miss Mawhood: I would imagine that was the case, yes. Q202 Mr Williams: Does that not present you with a problem? Mr Hartnett: I am not sure it is quite like that, Mr Williams, and, again, this is something we have got to get to the bottom of. My understanding is that the arrangements in March came through what I will call the "proper channels". What I know --- Q203 Mr Williams: So we are not pussy-footing, explain the difference between proper channels and this particular incident. Mr Hartnett: There were discussions with the right junior people to get access to the material. Q204 Mr Williams: The right junior people, so people possibly at the same level but different individuals. Mr Hartnett: In emails which I have seen, again an incomplete picture, and they are not emails before you today, there is some evidence that the March people, or at least one of them, was involved in October. There were a variety of people involved in October and I believe there are emails which suggest the same official played a role in March and in October. Q205 Mr Williams: If it was all right for the official who was at that level to send information in March, why was it not all right for the official at that level, even if it was not the same person, to send it later in the year? If the protocol stated that was right or wrong --- Mr Hartnett: Mr Williams, if I have given you any suggestion that any official could properly have agreed to part with the complete Child Benefit database to an NAO auditor to take off our premises in March, I am sorry because I have never meant to say that, but I am not sure that I have. This material should never have left our premises. Q206 Mr Williams: Would that have applied to the information on 13 March as well? Mr Hartnett: I am sorry, I am not sure I understand the question. Q207 Mr Williams: Would the 13 March information be allowed to leave the premises or not? Mr Hartnett: No, nothing should have left our premises. Q208 Mr Williams: On that occasion either? Mr Hartnett: On that occasion either. Q209 Mr Williams: This is interesting. So now we have got duplication of the same fault. When he came in, was he not told what his duties were and were not? Mr Hartnett: My understanding, based on the evidence available so far, is that in October there was no understanding at a more senior level that something wrong had happened in March. When the disk was put in --- Q210 Mr Williams: You are saying what happened in March was wrong in March? Mr Hartnett: Absolutely. Q211 Mr Williams: So the precedent had been created and the NAO was working according to precedent. No-one was aware of the exchange of information in March except the poor little individual at the bottom of the pile who is least able to defend himself who sent the stuff? Mr Hartnett: My understanding, based on the evidence available, is that junior officials knew that the NAO auditor had gone away with the disks, I am assuming given to them by our people, and that absolutely should not have happened. Q212 Mr Williams: On both occasions. Mr Hartnett: That broke our procedures and our procedures were broken again in the October. Q213 Mr Williams: That is interesting. Incidentally, at your end, Sir John, there seemed to be a certain lack of concern because we are told that HMRC contacted NAO by email about the missing disks on 1 November and yet it was not until 15 November, ten days later, that your security officer sent an email to all NAO staff asking them to see if they had received it. Why did it take so long? You had been waiting for it for weeks. Why was it that the security man at your end did not show a greater sense of urgency? I do not want to land him in trouble, I just want to know the circumstances. Miss Mawhood: During that period we were in contact with HMRC and we were getting indications that they thought they might have found the disks, so there was not confirmation that the disks had been lost until 8 November when they contacted us to say they had raised a security incident. Q214 Mr Williams: That clarifies it a bit. Again, I may have misunderstood an answer and if I have just tell me so and we will move straight on. When Austin was asking a question, and I may have misunderstood you, you may have said "low" risk but I noted you saying you thought there was "no" risk to the public at the beginning. Mr Hartnett: No, I have not said that, Mr Williams. The advice we had was that there was a risk but that it was a comparatively low risk. Q215 Mr Williams: "Low" not "no". Mr Hartnett: I apologise if I was not clear. Q216 Mr Williams: It is my geriatric ears, do not worry. In your evidence at the Treasury Committee, and it was in answer to Mr Dunne when he asked about writing to 25 million people, you said you had not written to 25 million, you had written to 7.25 million. Why? Mr Hartnett: Because the overwhelming majority of the individuals in the 25 million are children of the 7.25 million. Q217 Mr Williams: That is interesting. That has not come out very clearly. When you say the overwhelming majority, what numbers are we talking about? Mr Hartnett: 15-point-something million. Q218 Mr Williams: So the 25 million whose bank accounts the press have been reporting as being at danger were not 25 million, although it is still a lot of people. Give me that figure again? Mr Hartnett: Can I break down the 25 million? Q219 Mr Williams: Yes. Mr Hartnett: I will be helped if I get it wrong. 7.25 million of households and then 15 million and something of children in respect of whom Child Benefit is claimed, a number of alternative payees, some agents and then there is a tiny number of some thousands - I do not mean to demean the number but I just cannot remember it - of another group. Q220 Mr Williams: Instead of thinking in terms of people, if we think in terms of bank accounts the figures are significantly lower than the figures that we have been reading about in the press, is that so? Mr Hartnett: I have never seen the suggestion, but help me if I have got it wrong here, that it was 25 million bank accounts. I have got the precise break down if it helps. Claimants 7.29 million, children 5.5 million, alternative payees 2.3 million, appointees, which I think is a technical term, just less than 2,200 and agents around 11,700. Q221 Mr Williams: If there was 7.9 million why did you only write to 7.25 million? Mr Hartnett: No, 7.29 million. We have written to everybody. Q222 Mr Williams: You said there were 7.29 but according to your evidence you only wrote to 7.25. I am just wondering who was left out. Mr Hartnett: Nobody I think, Mr Williams. We did not aim to leave anyone out at all. Mr Williams: There is nothing else to cover, it has all been covered. Q223 Chairman: We are almost at the very end now. Can I just ask you one question which I have been wanting to ask you for some time. I was sent an email from one of your staff - she wants to remain anonymous - who says: "The original structure of the Department was each of the 300 or so officers were responsible for all the taxpayers within the geographical area surrounding the location of the office itself. In 2000 we moved to an area management structure to take the place of all the offices in the UK which were merged into larger units". Then she goes on about the staff you have lost. She seems to be implying that because of the way you changed the structure it is much more difficult to keep track of security. I have had another email, again the person wishes to remain anonymous and they are a member of your staff, saying that he is about to retire after 35 years and is glad to go because he is witnessing the disregard for providing a service to the taxpayer who contact HMRC by telephone, and he goes on about tax credits and all the rest of it. It does seem to me that you may have problems with some of your staff about morale and the way they feel they had a very dedicated Inland Revenue-type department in small units, your accounts had never been qualified, and now people are being forced into these ever larger units and it is difficult to provide the kind of service to your clients, the taxpayers, that you did before. Do you recognise that there may be anything in what these people say to me in their emails? Mr Hartnett: I recognise the concerns that are expressed and I hear them occasionally from my staff who have been in the Department for a long time. I think they have a concern about change but all organisations need to change. It is really important to look around for evidence. Many of the representative bodies, tax advisers for example, who have looked at the merger and looked at our restructuring have said it was the right thing to do and the Ombudsman has said there has been no diminution of performance because of merger. Q224 Chairman: Can I put one point to you on that. Please refer to Sir Gus O'Donnell's review published this afternoon. He says here: "The senior leadership has not been successful injecting pace, confidence and dynamism throughout the Department. More staff take a negative view of the impact of changes than a positive one, 48%:21%". That must worry you as the chief executive of this organisation, does it not? Mr Hartnett: Those figures are of concern to me and we are working very hard with our people to promote a better understanding of change. I have brought a little book with me called Our Ambition which is how we are trying to explain to our people what we are trying to achieve. One of the things I have instituted is a huge number of face-to-face meetings with our people since this data was lost, but from January, something that is common in a number of areas of life, Town Hall meetings with our people where we spend about a third of the meeting with board members and directors explaining what the organisation is trying to achieve and letting our people who are in the frontline tell us their ideas and thoughts so that we can engage with them. This is an important initiative for us. I and some of my colleagues have been back to the frontline recently, and I spent time in Cardiff and Newport on the frontline of our Department getting a much better understanding of how it works. Q225 Mr Bacon: Mr Hartnett, you have a whole series of breaches that you have reported to the Information Commissioner as significant breaches since April 2005, I think the figure is seven and that is excluding the breach yesterday. Why did all of those breaches and those earlier control failures not alert senior management to the fact that you had got a serious problem? Why was it only very recently that Mr Lodge was appointed after this series of failures over recent years? Mr Hartnett: The answer, Mr Bacon, is this: every one of those issues we have analysed and made some changes. This very serious issue which led to the resignation of our chairman led to my appointment. On the back of the discussions that we had been having in the organisation I decided, with my board colleagues, to bring forward a number of changes. This is not a sudden thing. As I said to Mrs Browning, we have already made some changes and we are now speeding those up very rapidly. I go back to what Mr Poynter said, I think at the start of his interim report, and that was when he came to look at this we had already done the things he would have expected us to do. Q226 Mr Bacon: You are the third chairman in two and a half years. Mr Hartnett: I am. Q227 Mr Bacon: This is an organisation that has recently undergone a big merger and we know how difficult big mergers are in any organisations, public or private sector. The Inland Revenue and Customs & Excise each had their own significant problems which were often aired in this Committee. At the same time, or around the same time, you took on a huge new function, Child Benefit, which, given your annual expenditure is £15 billion, an indication of the scale of the importance of Child Benefit is that it takes up two-thirds of that expenditure, and at the same time you are reducing your staff. It almost beggars belief that in that environment the staff will not feel under huge pressure and that corners will sometimes get cut when they are trying to cope with so much at once with fewer people doing it. Is that not fair? Mr Hartnett: Mr Bacon, I have already explained to the Committee that we are making huge improvements in effectiveness, efficiency and quality. I have acknowledged that our staff are concerned by change, which is why at board level and immediately below it we are going to be engaging face-to-face with the largest possible number we can going forward. The Chairman has brought out the sort of concerns that some of our people have and we are engaging with them on that. Q228 Mr Touhig: Your predecessor, of course, kindly agreed to come to Wales, to Cardiff, to meet some of my constituents having problems with tax credits, and I would like to extend that invitation to you. Will you accept? Mr Hartnett: Of course. Mr Touhig: Thank you very much. Q229 Chairman: That is a good note on which to end. Mr Hartnett: Chairman, can I just clarify two things very, very quickly. The first is I did not quite get an opportunity to comment on the 2,111 incidents. I would just like to say to this Committee what I said to the Treasury Select Committee. In order to improve our arrangements for security we are encouraging the reporting of anything that could be considered a security incident. The second thing I want to say quickly is to add to what I said to Mr Dunne on Winzip 8. From our perspective it provides a very crude and very weak encryption method that we thought was irrelevant and insufficient from a security perspective and that was why we at HMRC had taken the view that the disks were password protected only. Chairman: I think we have well and truly discussed this issue this afternoon. Thank you very much.
|