Peter Tomlinson | 1 Mar 2007 12:20
Picon

Cabinet Office Consultation on Information Assurance

UK Govt has substantially revised its e–Government framework for 
Information Assurance (IA), with one document replacing the seven policy 
documents dating from 2002. The framework (as quoted in the CSIA web 
site) "provides IA policy and guidance to support the development, 
procurement, provision and maintenance of e-services by, or on behalf 
of, government. This framework will aid those responsible for 
e–Government service provision on behalf of central government 
departments and their supporting agencies, non–departmental public 
sector bodies, local authorities and other public sector bodies." The 
new framework is available for public consultation and comment at 
http://www.cabinetoffice.gov.uk/csia/consultation/. Its tougher than the 
2002 set of policy documents!

Closing date for comment is 13 March, which is not far away, but 
unfortunately the consultation was not widely publicised. Should you 
wish to ask for an extension to that deadline, I have an email from 
Cabinet Office indicating that requests for an extension should be sent 
to CSIA. It says:

"If you think that you will wish to offer some substantive comments on 
the e-Government Framework for Information Assurance and will be unable 
to respond by 13 March then I suggest that you alert CSIA to your areas 
of concern by emailing CSIA at CSIA@... 
<mailto:CSIA@...>"

Peter

Ben Laurie | 1 Mar 2007 13:31
Picon

Re: Cabinet Office Consultation on Information Assurance

Peter Tomlinson wrote:
> UK Govt has substantially revised its e–Government framework for
> Information Assurance (IA), with one document replacing the seven policy
> documents dating from 2002. The framework (as quoted in the CSIA web
> site) "provides IA policy and guidance to support the development,
> procurement, provision and maintenance of e-services by, or on behalf
> of, government. This framework will aid those responsible for
> e–Government service provision on behalf of central government
> departments and their supporting agencies, non–departmental public
> sector bodies, local authorities and other public sector bodies." The
> new framework is available for public consultation and comment at
> http://www.cabinetoffice.gov.uk/csia/consultation/. Its tougher than the
> 2002 set of policy documents!
> 
> Closing date for comment is 13 March, which is not far away, but
> unfortunately the consultation was not widely publicised. Should you
> wish to ask for an extension to that deadline, I have an email from
> Cabinet Office indicating that requests for an extension should be sent
> to CSIA. It says:
> 
> "If you think that you will wish to offer some substantive comments on
> the e-Government Framework for Information Assurance and will be unable
> to respond by 13 March then I suggest that you alert CSIA to your areas
> of concern by emailing CSIA at CSIA@...
> <mailto:CSIA@...>"

I just blogged about this: http://www.links.org/?p=199.

Cheers,

(Continue reading)

cryptome | 2 Mar 2007 15:11
Picon
Favicon

NSA Releases UK Crypto Docs

NSA has released under FOIA nine crypto docs in response to a request
for information on "Non-Secret Encryption" and JH Ellis. One is a formerly
secret paper by Ellis written in 1977. Another is a formerly confidential
paper by Clifford Cocks written in 1998. Ellis and Cocks were long
associated with CESG.

Three of the nine papers were formerly classified as Top Secret Codeword.

http://cryptome.org/nsa-nse/nsa-nse-01.htm

Peter Tomlinson | 2 Mar 2007 18:21
Picon

Re: Cabinet Office Consultation on Information Assurance

Ben Laurie wrote:

> Peter Tomlinson wrote:
>
>> UK Govt has substantially revised its e–Government framework for
>> Information Assurance (IA), with one document replacing the seven
>> policy documents dating from 2002. The framework (as quoted in the
>>

<snip>
>
> I just blogged about this: http://www.links.org/?p=199.
>

I see on your blog, Ben, that you make a big point about the framework concentrating on identification of the "client" rather than switching to authorisation once registration has been done, or even in some cases going for authorisation only without collecting classic ID information. Surely this is the nature of mainstream public administration: to ask for name and then perhaps other information every time they encounter you. Its also the nature of the NHS: go to the health centre and you are asked for your name, and then the street address as confirmation; go to the pharmacy to collect your prescription and its the same: name and address.

Recently I went to a traditional owner-managed opticians for an eye test, having been lucky to not need one for a very long time (but a long time ago I went to the same opticians). Giving my name to the young lady, after first telling her that I had been there a long time ago, she entered my name into the computer and instead of asking for my address she read out the address from the screen - and thus I discovered that I have a namesake living across the other side of the city. The young lady was trying to be helpful; the public servant is trying to ensure that only the right person receives the service. (A week later, when leaving with the glasses, the old man said "Don't leave it so long next time, sir".)

Maybe the public sector doesn't yet trust ICT systems; maybe they just have not made the connection between a new method (e-transactions) and the ability to move to authentication once registration has occurred (and registration can of course collect null data, such as with an anonymous e-purse card: all they need to do is record that a card with a particular serial no has been issued, and perhaps a folding cash payment used to load initial value).

But don't get me wrong: I agree that the comment must be made, and will add it to my list. Also I will go back to the review of the 2002 papers that Steve Beecroft and myself did a while ago (with the help of the now late Phil Perry, who was too ill to help by the time that we actually wrote the report) and compare that report with the new document.

Peter



Adrian Midgley | 2 Mar 2007 21:53

Re: Enquiry from Health eCard

Ian Jackson as chiark postmaster wrote:
> I have received an enquiry from someone by the name of Kornbluth at
> healthecard.co.uk, who would apparently like to take part in the
> discussion here.
This is almost certainly a good place for them to have passed through
before engaging in their business.

Ian G Batten | 5 Mar 2007 10:08

Re: Enquiry from Health eCard


On 2 Mar 2007, at 20:53, Adrian Midgley wrote:

> Ian Jackson as chiark postmaster wrote:
>> I have received an enquiry from someone by the name of Kornbluth at
>> healthecard.co.uk, who would apparently like to take part in the
>> discussion here.
> This is almost certainly a good place for them to have passed through
> before engaging in their business.
>

I see their website says ``You can then simply plug this into the USB  
port of any computer''.  I've got USB ports on Linux boxes of various  
processor varieties, Solaris machines, Macs, waiting to test this.   
I'd be interested to know how they're going to do a passphrase  
thingie without having a binary on the card.

ian

Ian G Batten | 5 Mar 2007 10:51

Re: Enquiry from Health eCard


On 5 Mar 2007, at 09:37, Mark Lomas wrote:

6 Dalston Gardens, Stanmore, HA7 1BU

http://stores.ebay.co.uk/THE-BEDDING-FACTORY-OUTLET

They appear to have an excellent reputation as a vendor of duvets and, indeed, `cosy booties'.   I didn't see operating a secure data centre to store passphrases of medical records systems in a highly available manner listed as a service, but that could just have been an oversight.
ian

Roland Perry | 5 Mar 2007 11:22

Re: Enquiry from Health eCard

In article <27DA750C-B4C3-4626-AF4E-FF2015FC6F96@...>,
Ian G
Batten <ian.batten@...> writes
>6 Dalston Gardens, Stanmore, HA7 1BU
>
>http://stores.ebay.co.uk/THE-BEDDING-FACTORY-OUTLET

Which is K&E Kornbluth Ltd. (ebay account "kornbluth15")

Meanwhile back at Healthecard:

   1. Elaine Kornbluth , Chairman and Managing Director, founder of
                              the Health eCard System
   2. Dr. David Krasner,  Medical Director
   3. Jul Kornbluth, Research & Development.
   4. Anthony Kumar,  Chief Technical Officer

So we seem to have two family companies running from the same premises.
Nothing wrong with that.
--

-- 
Roland Perry

Ross Anderson | 6 Mar 2007 10:24
Picon
Picon
Favicon

Health committee consultation on medical privacy etc

I'd just like to remind list members that the Commons health committee is
holding hearings on the Electronic Patient Record, with a submission
deadline of March 16th. If you think it's a bad idea for your records to
be kept on a national database rather than on a server in your GP's
surgery or in your local hospital, this is an opportunity to communicate
your point of view. The URL is

  http://www.parliament.uk/parliamentary_committees/health_committee/hcpn070205.cfm

Ross

Ben Laurie | 1 Mar 2007 12:48

Re: Cabinet Office Consultation on Information Assurance

Peter Tomlinson wrote:
> UK Govt has substantially revised its e–Government framework for
> Information Assurance (IA), with one document replacing the seven policy
> documents dating from 2002. The framework (as quoted in the CSIA web
> site) "provides IA policy and guidance to support the development,
> procurement, provision and maintenance of e-services by, or on behalf
> of, government. This framework will aid those responsible for
> e–Government service provision on behalf of central government
> departments and their supporting agencies, non–departmental public
> sector bodies, local authorities and other public sector bodies." The
> new framework is available for public consultation and comment at
> http://www.cabinetoffice.gov.uk/csia/consultation/. Its tougher than the
> 2002 set of policy documents!
> 
> Closing date for comment is 13 March, which is not far away, but
> unfortunately the consultation was not widely publicised. Should you
> wish to ask for an extension to that deadline, I have an email from
> Cabinet Office indicating that requests for an extension should be sent
> to CSIA. It says:
> 
> "If you think that you will wish to offer some substantive comments on
> the e-Government Framework for Information Assurance and will be unable
> to respond by 13 March then I suggest that you alert CSIA to your areas
> of concern by emailing CSIA at CSIA@...
> <mailto:CSIA@...>"

I just blogged about this:

http://www.links.org/?p=199

Cheers,

Ben.

--

-- 
http://www.apache-ssl.org/ben.html           http://www.links.org/

"There is no limit to what a man can do or how far he can go if he
doesn't mind who gets the credit." - Robert Woodruff


Gmane