Select Committee on Merits of Statutory Instruments Twenty-Seventh Report

Memorandum by Alexander Thompson PhD

1.  ContactPoint is a digital service, and as such is subject to the same rules that all are subject to. This makes the service critically vulnerable and impossible to secure adequately. My evidence below gives the reasons why this is the case, and why the development and deployment of ContactPoint must be delayed until such time that these critical issues can be addressed.

2.  ContactPoint is designed to be delivered over the internet, via standard internet browsers. It will be accessible to authorized users who will be provided with a username, password and URL in order to gain access to the system. This means that anyone, including unauthorized users, with the ContactPoint URL, a username, password and password, can get into the system, and then begin to copy the entries one by one.

3.  A malicious person with limited programming skills could write a simple computer programme to copy the ContactPoint entries one by one over a long period of time and from a variety of different internet locations. All the malicious user needs to do this is to obtain a working user name and password. Since this system is to be widely available (to hundreds of thousands of users) there will be widespread trafficking of usernames and passwords, and it will be impossible to monitor all the users all of the time to make sure that they are all legitimate all of the time.

4.  I direct you to look at the service known as 'Bugmenot'[38] . This service supplies the public with working usernames and passwords to sites on the internet that require authentication for access. The process of using Bugmenot is partially automated via a browser add-on; users need only click inside of their browser to obtain a shared username and password to anyone of millions of websites, and then they are allowed unauthorized access. Should the current shared username and password be disabled, Bugmenot provides alternatives until a. username and password combination works. If no username and password combination succeeds, then Bugmenot prompts the person who wants access to enter their own username and password should they obtain one, so that others may use it. Bugmenot demonstrates that it is easy to not only to share usernames and passwords, but it is possible to automate the collection and distribution of usernames and passwords.

5.  Once ContactPoint data is released, it can never be returned. The ContactPoint policy statement says:

"A range of sanctions are available to manage inappropriate use, and can include disciplinary action, fines and custodial sentences."

This statement betrays a fundamental misunderstanding of the nature of data, and the inherent problems that aggregating sensitive information in this way presents. Inappropriate use of databases cannot be 'managed'. The fundamental nature of data is that it is infinitely replicable. Once a copy of data leaves a storage device and is outside of a secure system, it is able to be copied without detection an infinite number of times with almost no effort. This is true of all data. There is no way to secure data so that it cannot be copied, and all databases are subject to this fundamental nature of data. The disciplinary actions, fines and custodial sentences that the ContactPoint policy statement suggests will not return the illegally copied ContactPoint data to the database, nor will they erase the unauthorized copies spreading in the wild. Once the ContactPoint data is released, it is released forever. When we consider that the data in the case of ContactPoint is the intimate details of every child in Britain, the whole exercise is thrown into a very different light; it becomes instantly clear that ContactPoint is more of a potential threat to children than it is a potential benefit.

6.  Security breaches on the ContactPoint system as outlined below will permanently compromise the safety of every child whose information is leaked. This is clearly an unacceptable risk especially when there are other ways in which the requirements of 'Every Child Matters' can be met in this respect. By assembling this system, all the children of the UK are put at risk. ContactPoint is being created because a statistically small number of children are being mistreated. By creating this system, Her Majesty's government is putting at risk all the children of the UK, where they were not before being put in such a vulnerable position.

Types of security breach

Shared usernames and passwords

7.  Usernames and passwords are routinely shared in offices and IT departments all over the world. Many are displayed on PostIT® notes attached to the computers used to gain access to systems. In a system as large as ContactPoint, accessible over the internet with hundreds of thousand of authorized user accounts, it is absolutely inevitable that people will share usernames and passwords, and that this sharing will extend beyond the offices of the personnel that have authorized access to the system.


8.  Since ContactPoint is going to be delivered over the internet via browsers, this means that it will be possible to attack the database with any computer anywhere, by a number of different methods, ranging from a Distributed Denial of Service attack (DDoS) to a direct breach of the database where its entire contents are copied. If ContactPoint is deployed to its present specifications, it will be one of the most valuable databases ever created, and as such, will be highly sought after prize to hackers, who are motivated mainly by the status of their targets. This is why hackers attempt to penetrate fortress networks and database such as those held at The Pentagon and NASA on a daily basis, since to gain unauthorized access to them earns them the admiration of other hackers.

9.  ContactPoint will be delivered via the internet, and will be accessible by any computer. This means that it will be possible to compromise the database by delivering a virus or Trojan horse programme onto the PCs of ContactPoint users that will allow remote access to hackers. The hacker achieves this by tricking the ContactPoint user into looking at a malicious web page that compromises the user system. The hacker then controls the ContactPoint user's computer remotely, as if he were the authorized user sitting at the computer inside the authorized location. In this scenario, there is no shared username and password required, because the hacker is impersonating an authorized user on their own computer. This attack is very difficult to detect, because every indication is that this is an authorized user. This method can also be used to steal the usernames and passwords of multiple users who access ContactPoint through a particular PC, if it sits in an office.

Piecemeal Duplication

10.  The extraordinarily valuable data in ContactPoint will be accessed many millions of times by the hundreds of thousands of authorized users who browse the system. As this routine use takes place, people will be making copies of the entries and the unique numbers associated with each child. In time (perhaps over a small number of years) every entry in the ContactPoint database will have been accessed and copied at least once. This means that every database entry will be out of the ContactPoint system. It will then be possible to re-create the ContactPoint database in privately held secret databases. This is the best case scenario; where it takes years for the data to be replicated.

Authorized user abuse

11.  The ContactPoint policy statement says that users given access to the system will be subject to 'enhanced criminal records checks'. These criminal record checks can only determine whether or not the person in question has ever previously been convicted of a crime. These checks cannot predict if the user's character will change in the future. Given that hundreds of thousands of people are going to be granted access to ContactPoint, it is guaranteed that some of them leak details to unauthorized persons, and once the leak has occurred, the child's security is permanently compromised. There are many instances of insider abuse in every other government controlled database[39]. The police have experienced many instances of such breaches, as have Whitehall and every other Government department, and once again, no sanction, no matter how severe, can put the data back in the database. ContactPoint will not only be of interest to Paedophiles. It will be a resource worth billions of pounds to marketers of products targeted at children. These commercial entities will be willing to pay for unauthorized access to ContactPoint's database of names, ages, genders and addresses of all the children in the UK, enabling them to use the demographic data to accurately target children and parents. ContactPoint is a business opportunity without precedent. There will be unimaginable pressure to gain both authorized and unauthorized access to it, and this will greatly accelerate the creation of illegal copies of the database.


12.  The idea behind ContactPoint is fundamentally flawed. It puts the children of the UK at risk as never before by aggregating their information into a single, easily accessible and inherently insecure system, where the details of where they live, who their parents are and other information about them can be copied and abused. The creators of ContactPoint have not taken into consideration the nature of data; that it can never be secured and that it can always be copied. They have also failed to understand that a system with hundreds of thousands of users cannot ever be free from insider abuse, and they have failed to learn from the lessons of previous insider abuses that have taken place in other government database systems.

13.  ContactPoint is guaranteed to cause real harm to many more children than are presently harmed by criminal predators. It will cause the numbers of children subjected to abuse to increase, the exact opposite of the intentions of its creators.

14.  Finally, by denying the rights of the Parents to opt out of ContactPoint, Her Majesty's Government is usurping the natural role of the parent as the ultimate guardian of children by dictating what is and is not of benefit to them. The children of the UK are being reduced to the level of numbered chattel by this system, which is unacceptable, no matter how good the intentions of those behind this ill conceived initiative.


15.  If the flaw in the current ContactPoint design and implementation plan cannot be addressed in full, it is my professional opinion that it should not be deployed until such a time that all of its problems are addressed and solved. Parents must be allowed to opt out of ContactPoint, since the children of the rich and famous will be allowed to do so for their own protection, this protection must be extended to all children equally. The fact that this option is going to be given to certain families proves that ContactPoint is a threat to all children.

  29 June 2007



39 Back

previous page contents

House of Lords home page Parliament home page House of Commons home page search page enquiries index

© Parliamentary copyright 2007