The IRS accidentally republished 112,000 taxpayer data records in November after they were initially published as a result of a technical error earlier this year.

Blame for the incident has reportedly fallen on an outside contractor working on behalf of the IRS and tasked with managing a database for the government department.

The incident relates to the upload of 990-T forms which contain private information used by tax-exempt entities, including government entities and retirement accounts, to pay income tax on income that comes from specific investments or that which is unrelated to their exempt purpose, according to a letter sent to congressional leaders, Bloomberg Tax reported.

In September 2022, the IRS said that some Form 990-T data had been made available for bulk download in its Tax Exempt Organization Search (TEOS), which shouldn't have been made public. At the time, it removed the files and was set to replace them with updated files in the future.

However, this time a contractor reuploaded older files to the database with the original data, instead of new ones which ensured the forms were set to be kept private. The IRS had given the corrected data to the contractor on 23 November, but the contractor had not removed the old files from their system.

The IRS was only made aware of the files being available again on their website when a third-party researcher reached out. The IRS then told the contractor to remove them immediately.

Around 104,000 of 106,000 forms previously shared in September were reuploaded to the site. Some forms contained names or business contact information, and the IRS is currently contacting people affected by the data breach. When more than 100,000 forms suffer a disclosure, the IRS is forced by the law to inform Congress.

The revenue service is also reportedly reconsidering its relationship with contractor Accenture on this project. IT Pro has contacted the company for comment.

“The IRS is continuing to review the situation to identify opportunities to establish additional controls and strengthen existing controls to protect taxpayer information,” said US Treasury spokesperson John Rizzo.

Congress is questioning if Amazon was misleading about its use of third-party seller data to develop products.

According to a recent Wall Street Journal report, Amazon staff members claimed the company used insider data related to independent sellers to help develop its own competing products.

The report states that, in one case, the company allegedly went so far as to analyze a third-party car-trunk organizer’s sales and profit margins to decide if launching a competing product was in its best interest.

The House Judiciary Committee has spent the last few months engaged in an antitrust investigation that includes Amazon and many other large tech companies. In July 2019, an Amazon lawyer told the subcommittee the company doesn't use individual seller data to compete with third-party sellers.

After this report, leading members of the subcommittee, Reps. Jerry Nadler (D-NY) and David Cicilline (D-RI), were steadfast in responding to Amazon’s latest transgressions.

“It is deeply concerning that, beginning with the hearing last year, they may have misled Congress rather than be fully forthcoming on this matter, notwithstanding our repeated requests in this regard,” Nadler said in a statement shared to the House Judiciary Committee’s website.

“At best, Amazon’s witness appears to have misrepresented key aspects of Amazon’s business practices while omitting important details in response to pointed questioning,” Cicilline added. “At worst, the witness Amazon sent to speak on its behalf may have lied to Congress.”

Amazon responded to the lawmakers’ calls for clarification and announced it would launch an internal investigation to address these accusations.

“It’s simply incorrect to say that Amazon was intentionally misleading in our testimony,” a company spokesperson told The Verge. “While we don’t believe these claims made by the Wall Street Journal are accurate, we take these allegations very seriously and have launched an internal investigation.”

The WSJ report is one of many controversies to have overshadowed Amazon recently. The company has also faced concern after the alleged mistreatment of workers led to strikes at a number of warehouse facilities.

Ofcom has imposed a sanction on a regional radio station after a guest claimed that the coronavirus outbreak was linked to China's rollout of 5G technology.

Uckfield Community Radio, in Sussex, was found to have breached broadcasting rules on 28 February when one of its presenters failed to "sufficiently challenge" claims made by an interviewee about COVID-19.

As a result, the station must broadcast a summary of the regulator's findings to its listeners on a date to be confirmed.

The guest appeared on the Tony Williams morning show, introduced to listeners as a 'registered nurse', and made claims that the initial outbreak of the virus in Wuhan, China was linked to the rollout of 5G technology. The interviewee also made claims that people were being misled about the coronavirus – which Ofcom said "undermined trust" in the advice given out by relevant authorities.

The interview began with a short disclaimer from the guest, which even referenced Ofcom: "Everything that I give today is information, it is not intended to replace any advice given by your medical practitioner if you are sick always seek advice from your GP".

Ofcom received a number of complaints about the broadcast and its resulting investigation concluded that the station failed to protect listeners. The regulator said it had breached 'rule 2.1' of the Ofcom Broadcasting Code and due to the seriousness of the breach, it has directed the station to broadcast a statement of the findings on a date which will be confirmed later.

"Uckfield FM broadcast a discussion which contained potentially harmful claims about the coronavirus virus, including unfounded claims that the virus outbreak in Wuhan, China was linked to the roll out of 5G technology," Ofcom said in its ruling.

Uckfield FM has since apologised for any "confusion and concern" resulting from the broadcast and the unfounded link between the coronavirus and 5G.

Last week, US President Donald Trump was challenged by reporters who suggested his wording of the outbreak was racist when he referred to it as the "Chinese virus".

The European Union's General Data Protection Regulation (GDPR) has been the biggest shake-up of data protection laws the world has ever seen. Since its introduction in May 2018, the way businesses across Europe collect, store and use data has come under greater scrutiny.

However, its introduction also came amid the UK's prolonged exit from the EU. This led to uncertainty around the UK adopting the legislation as its main purpose was to harmonise data transfers throughout member states. However, GDPR has and will continue to exist in the UK in the form of the Data Protection Act (DPA) 2018, as will the Data Protection Act (DPA) 1998.

The DPA 2018 is often referred to as 'UK GDPR' but is actually an update to the DPA1998. It was changed to translate the majority of the GDPR's principles so that they fit into existing UK laws.

The 1998 law is still in use for cases of data misuse or theft that happened before 23 May 2018 (the implementation date of DPA 2018). Although this law has been in play for some time, it's important businesses understand how both work since they can still be found in breach of the older one for legacy incidents.

It's also important to understand that data laws have had to evolve, which may have changed some articles of the Data Protection Act 1998. Organisations must understand how much the law has changed and its current scope in terms of compliance, as well as how it can still make an impact on your business.

What does the Data Protection Act 1998 mean?

The Data Protection Act 1998 was the law governing the processing of personal data by all organisations, be they public or private, including charities.

All data breaches in the UK are investigated by the Information Commissioner's Office (ICO) and the same was true then, although the act provided guidelines for the type of penalty that could be applied if someone was found to have been in contravention of the rules.

Data Protection Act 1998: Summary

The Data Protection Act 1998 regulated the use and protection of personal data, and outlined the responsibilities a business had to protect that data. It superseded the Data Protection Act 1984 and Access to Personal Files Act 1987.

It was amended in 2003 to give individuals more control over digital marketing communications they receive, meaning they must opt-in to receive emails, SMS text messages etc from an organisation if they've never had contact with it before.

What was personal data defined as?

According to data protection principles, and previous regulations, personal data is defined as information related to an individual that can be used either in isolation or in tandem with other data sources, to reveal that individual's identity. If there is such pre-existing data held by a data controller, then personal data also encompasses information that may come under this entity's possession.

This also included expressions of opinion about that person and any intention the data controller or another individual may have in regards to them.

The DPA 1998 also provided protection for sensitive personal data, which was defined as information relating to a person's racial or ethnic origin, political and religious or similar beliefs, membership of a trade union, physical and mental health, sex life, any criminal charges or allegations against them, and any proceedings against them (such as a court case or a prison sentence).

What data formats were covered?

The DPA defined possession of data as that which resided in a machine or on paper in a readable, accessible way. Regarding paper forms of information, the ICO classified paper filing systems as individuals' records being held in a "systematic, structured way" that provided easy access to those individuals' information.

Data was also classified as "accessible records" covering health or education. While this information wasn't necessarily held in a structured, easily accessible way, it was important enough that the DPA stipulated it should still be protected.

Data controllers' "data processing" activities were also subject to the DPA's rules. Processing was a very broad term covering plenty of things, but was thought of as relating to every interaction had with personal data. As the ICO noted, almost any activity concerning data would constitute processing.

What were the penalties for a data breach?

There were a number of penalties and processes available to the ICO when it came to taking action on data protection.

The most material impact was perhaps the possibility of a fine. As of April 2010, the ICO was able to issue penalties of up to £500,000 for offences taking place on or after that date, although the maximum fine was only ever imposed once (against Facebook during the 2018 Cambridge Analytica scandal).

It was also able to lay out processes an organisation should have undertaken in order to improve its data protection posture, and was able to conduct audits to ensure compliance (these could have been consensual or, if necessary, compulsory).

If a breach occurred, in addition to the possibility of a £500,000 fine, the ICO was able to prosecute anyone it believed had committed a criminal offence under the act.

What is the Data Protection Act 2018?

After 20 years, UK data protection regulations received an overhaul following Royal Assent on 23 May. The Data Protection Act 2018 updates the UK's data protection legislation to make it more relevant to the way technology is used today and harmonises laws with that of GDPR.

The act mirrors GDPR in many aspects, including tougher sanctions for data breaches (up to £17 million or 4% of global turnover).

The new Data Protection Act 2018 modernises the UK's data protection framework to account for the value of people's personal data today, offering people stronger rights over what others can do with their data, and requiring companies to gain people's consent to use their information.

Generally, most provisions under the 1998 act have been strengthened, requiring far more from organisations when it comes to seeking consent and holding data for longer than necessary.

When it comes to processing data, companies are now required to make efforts to be transparent, which was not necessarily required under the 1998 act. It's also far more difficult to collect data under the 2018 act, as it needs to have an explicit purpose.

What specific data could be collected was also up for interpretation under the 1998 act, as organisations could use it provided it wasn't deemed "excessive" compared to its original purpose. Under the 2018 act, the processing is limited to only that data considered relevant.

For more information on the new Data Protection Act 2018, and how it works alongside GDPR, head here.

Data Protection Act 1998: Important terms and further reading

Data subject: Data subject is a term used in both the GDPR and DPA. It refers to an individual who is the subject of personal data.

Data controller: As with data subject, data controller is used in the GDPR and DPA. It means a person who individually or with a group of other people decides how and why any personal data is or will be processed.

For more information on the DPA, you can visit the ICO's guide to data protection, and click here for more information on the GDPR.

The business environment is growing increasingly complex, with companies asked to manage the dual challenge of exponential growth of data and increased regulation, or face fines and long-term damage to their brands.

This whitepaper explores how companies can implement an information governance program: a set of controls, processes and technologies to maximise the value of information assets while minimising risks of non-compliance with data privacy requirements.

Download it now to learn how to develop a policy framework and establish an information governance team.

Work on four of the six IT systems central to standards, environmental control and border control in the event of a no-deal Brexit has not yet been completed, less than two weeks until Brexit.

Despite the UK currently scheduled to leave the European Union (EU) without a deal on 29 March, the Department for Environment, Food and Rural Affairs (Defra) has yet to fully prepare for a no-deal outcome.

MPs with the Public Accounts Committee (PAC) expressed concern in its latest report that both Defra and the Department for Transport's current plans are not solid enough to address the scale of the challenge that a no-deal Brexit presents.

Two of Defra's IT systems have gone live, and four are in the process of being tested, according to the committee's latest report. This follows previous concerns, raised in November, that none of the six systems had yet undergone sufficient testing.

The biggest risk to delivering the four incomplete IT systems is that a number of them depend on a "common registration module" that itself is not yet complete. Work is in progress to make this more user-friendly.

In the event the IT systems have not been completed by 29 March, Defra told the PAC that it has a set of "manual fall-backs". But these manual processes would be slower, have a higher error rate, and be more burdensome for users. The departments will also lose elements of the system integration.

Both departments are also considering staffing needs for the issues that will result from a no-deal Brexit, including forming 24-hour emergency centres.

15/11/18: Defra blasted for "alarming" lack of critical IT tests ahead of Brexit

The Department for Environment, Food and Rural Affairs (Defra) has been lambasted for failing to test critical IT systems ahead of the UK's withdrawal from the European Union.

Six systems, including a food import notification system and another that will replace the EU's platform for monitoring chemicals, are being developed but have yet to be fully tested, causing MPs to raise concerns about the department's complacency and ability to function post-Brexit.

The most complex of Defra's systems, a food notification system, won't be tested until "January or February", according to Parliament's Public Accounts Committee (PAC), falling worryingly close to the March 2019 deadline.

Defra Ministers have admitted there is a risk with not sufficiently testing these systems, the PAC said, due to the scale and complexity of the task at hand, and conceded issues are bound to arise. However, they reassured the committee while giving evidence that the six systems will be available in time in the event of a no-deal scenario.

"Brexit looms but the Department for Environment, Food & Rural Affairs is a long way from being ready," said PAC chair Meg Hillier MP. "Anyone working in the dark is prone to stumble but in Defra's case I am concerned that the Department has lost sight of its priorities."

In light of great risks associated with a no-deal Brexit, Hiller added that it is "alarming" how little information Defra has provided publicly to allow businesses and organisations to prepare. The Department is too complacent, moreover, about the levels of disruption to trade.

"Brexit border planning is not sufficiently developed," she added. "Six critical IT systems are still to be tested and there is a risk that in the Department's rush to prepare necessary legislation, the quality of that legislation will suffer."

The PAC highlighted several issues in its report including a very limited engagement with SMBs, as well a plan that involves testing all the IT systems at once from January. This, the committee says, will inevitably throw up new issues, and put increasing strain on the chances of the new systems working in time.

Defra says it does not accept the PAC's conclusions, and have accused the committee of inaccurately reflecting its level of preparation.

"The PAC have ignored key findings from the National Audit Office (NAO), which found that 'Defra has achieved a great deal and to a very demanding timescale'," a Defra spokesperson told IT Pro.

"In producing this one-sided report, the PAC have failed to acknowledge the substantial progress we have made in replacing EU functions, hiring key staff and building new IT systems."

The spokesperson added Defra has met several targets on additional staff hiring and reducing IT workload inefficiencies, and quoted praise from the separate NAO report that said the department "has achieved a great deal in difficult circumstances".

The NAO report, incidentally, also levelled criticism mirroring the PAC's findings on implementing the new IT systems, saying: "because it has not fully defined its future service requirements, Defra has not yet ensured that the new IT systems it is developing can meet future operational capability".

In the event the new food import notification system is not ready by March 2019, the spokesperson continued, there are contingencies in place to ensure the import for live animals, animal products, and high-risk food continues with minimal disruption.

The additional IT systems Defra is developing include platforms to support export health certificates, fish catch certificates, fluorinated gases and ozone-depleting substances, and veterinary medicines authorisation.

The PAC has issued a number of recommendations and demanded that Defra provide them with a further update by the end of December on whether the key IT projects are on track for testing in the new year. MPs have also demanded a further update later in January on the results of the testing.

The culture secretary will hold talks with Mark Zuckerberg today in an attempt to engage the Facebook CEO just weeks before the government releases proposals to regulate big tech companies.

Secretary of state for digital, culture, media and sport (DCMS) Jeremy Wright will be granted 30 minutes of Zuckerberg's time, according to the BBC, at the company's Californian headquarters today.

The meeting has been scheduled in the wake of growing pressure on the role social media giants are playing in exacerbating mental health conditions in young people, with repeated suggestions from the government they are ready to legislate.

Facebook has also this week been lambasted by the DCMS select committee in the findings of its 18-month investigation into fake news and disinformation, with the influential group of MPs accusing the tech giant of behaving like "digital gangsters".

Zuckerberg had refused to meet with or give evidence to the committee during its investigation, much to the ire of its chair Damian Collins MP, who has made countless attempts to engage the Facebook founder.

But the culture secretary, leading a UK delegation that includes digital minister Margot James, will speak with Zuckerberg about ways to prevent online harm, in an attempt to gauge his views ahead of publishing a legislative white paper. The Californian trip will also include meetings with Apple, Google, and Twitter among other firms.

Due in the next few weeks, the white paper will outline the government's thinking on how to regulate tech giants for the first time, with mounting speculation that any new proposals will include setting up an industry watchdog.

An independent regulator, akin to Ofcom for telecoms firms, are among the range of measures proposed in the DCMS committee's report, as well as its demand for a compulsory code of conduct.

The 108-page report particularly focused on how Facebook failed to prevent the spread of fake news and disinformation on its platform during political campaigns, as well as failed to deal with known sources of harmful content.

The committee also accused the social media firm of deliberately disregarding data privacy principles and willfully breaking data laws in the interests of "profit over data security".

"We believe that in its evidence to the Committee Facebook has often deliberately sought to frustrate our work, by giving incomplete, disingenuous and at times misleading answers to our questions," Collins said after the publication of his report.

"Even if Mark Zuckerberg doesn't believe he is accountable to the UK Parliament, he is to the billions of Facebook users across the world. Evidence uncovered by my Committee shows he still has questions to answer yet he's continued to duck them, refusing to respond to our invitations directly or sending representatives who don't have the right information."

The Information Commissioner, Elizabeth Denham, has said that future regulation on technologies and policies that are underpinned by data must include her office.

Speaking at the Institute for Government, Denham said that personal data and it's regulation were "indivisible" from conversations about AI, Brexit and the spread of misinformation.

Her comments come after a year of high-profile action against Facebook, which the ICO fined over the Cambridge Analytic scandal. However, on Thursday Denham wanted to discuss the further implications of data rather than just its protection.

"I've given evidence to Parliament, over a dozen times, and not just talking about issues of data protection, but on wider issues that have data at their heart," she said. "Data ethics, the deployment of AI in the UK, the security implications of Brexit, algorithmic decision making, fake news and disinformation.

"You can't discuss these issues, or have an informed policy direction without taking data protection into account. So personal data and its regulation are indivisible from these conversations."

Denham, who came to the UK in 2016, said that she had been looking around other regulatory bodies and found that none had quite the "breadth of the remit of the ICO" but her comments suggest that even that is not enough.

"It used to be a relatively sleepy area of law - freedom of information and data protection - but now information rights are an essential plank of modern democracies," she said.

"It's all about trust and confidence that people have in government institutions. Simply put, freedom of information and data protection support the legitimacy of public administration."

Denham went on to say that the ICO "will take action, whenever and wherever, data obligations are disregarded" but added that the challenge it presents keeps her up at night: "That is a really big challenge for us and a really big challenge for my office because public expectations are so high and we've got to keep our eye on many developing policy debates and conversations where data use arises."

The Information Commissioner's Office (ICO) has issued guidance for UK organisations on how to cope with data transfers being blocked in the event Britain crashes out of the European Union (EU) without a deal.

Despite bringing the General Data Protection Regulation (GDPR) into UK law in the form of the Data Protection Act 2018, leaving the EU without a deal in place means Britain will be, for a time, classed as a third country' until an adequacy agreement can be implemented.

This means that while some data can be transferred from the UK to European Economic Area (EEA) countries, something supported by the UK government, there will be a stop to all flow of personal information in the opposite direction until a data adequacy agreement comes into force, according to the ICO.

Personal information has been able to flow freely between the UK and EU countries to date because all nations have adhered to the same standards. The EU also allows the free-flow of data between member states and non-EU countries through data adequacy decisions.

But any such arrangements will take time to conclude and cannot logistically be in place by March 2019, the legislative date of withdrawal, unless Article 50 is extended or suspended. This means businesses will need to consider their circumstances and adapt their operations accordingly.

It could also severely hamper the delivery of public services, including many NHS Trusts and their suppliers, which store data on often-EEA-based AWS servers.

"The guidance we have produced will help organisations plan ahead and ensure that personal data continues to flow," said Information Commissioner Elizabeth Denham.

"We will be providing further information to the small number of organisations in the UK that rely on approved Binding Corporate Rules for their transfers to explain how they may be affected.

"We will continue to help all organisations understand how any future changes in data protection regulation will affect you and the measures you need to put in place."

Minimising disruption post-Brexit

The broader guidance includes a set of frequently asked questions (FAQs) regarding the various information and data regulations with which businesses have had to comply, as well as a six-step checklist for organisations to follow.

The FAQs highlight such queries as what will the UK data protection law be if we leave without a deal?', and Will the GDPR still apply if we leave the EU without a deal?'

The ICO's six-step checklist, meanwhile, highlights a range of measures organisations will need to implement to ensure minimal disruption beyond March.

These include continual GDPR compliance, assessing transfers to and fro the UK, reviewing the organisational structure if operating across Europe, reviewing privacy information and documentation, as well as raising the level of awareness among senior staff.

One key measure that businesses can implement are Standard Contractual Clauses between themselves and EU-based organisations. The ICO has also produced an interactive walkthrough mainly targeting SMBs to determine whether this is a suitable measure for them to implement.

The walkthrough includes help with completing the essential clauses of these contracts and also minimises the costs of putting these into place. The ICO is also aiming to incorporate an online tool that can automatically generate these contracts.

Prospects of 'no deal' are rising

The guidance has been issued amid political uncertainty surrounding the draft Withdrawal Agreement, with a host of voices both domestically and in Europe warning the prospects of no deal' are rising.

The likelihood of the Theresa May's agreement securing enough support by MPs is low, with the Prime Minister repeatedly claiming the only other two options on the table if her deal is rejected are no deal' and no Brexit'.

The guidance sets out a number of key examples of organisations that may be affected by the change in circumstance.

No-deal withdrawal wouldn't impact, for instance, a hotel in Cornwall that takes bookings from individuals across Europe that provide their personal details including names, and contact details, and sends personal data back to them.

The international transfers' aspect of no-deal withdrawal could affect the business if it uses a cloud IT service which stores or processes the data anywhere outside of the UK; for example an AWS server in the Netherlands.

Restricted transfers can, however, continue if this is covered by an adequacy decision made by the UK government.

The UK government also intends to recognise previous EU adequacy decision made by the European Commission prior to the exit date. These will allow restricted transfers to continue for those organisations whose data activities have already been covered by an adequacy decision.

The only exception, the ICO says, regards the EU/US Privacy Shield, which the UK will not be a part of without a deal, as it is a specific EU/US arrangement.

In the early hours of the morning, it was reported that China's primary security authority has deleted 9,800 social media accounts due to inappropriate content, reported Reuters.

The Cyberspace Administration of China (CAC) made a statement in relation to its campaign launched on 20 October 2018, saying it had erased a massive amount of the increasingly prevalent 'self-media' accounts that emerged in recent months.

The accounts were erased for "spreading politically harmful information, maliciously falsifying (Chinese Communist) party history, slandering heroes and defaming the nation's image".

The wiped accounts had appeared on two of China's premier social media platforms, WeChat and Weibo. Tencent and Sina, the two companies who own and operate the platforms were also summoned by the CAC and admonished for failing to prevent "uncivilized growth" and causing "all kinds of chaos".

The term 'self-media' is used to refer to social media channels, much like ones found on Snapchat's stories, posing as genuine media outlets. The channels produce original content which spans a breadth of topics but aren't officially registered with authorities.

The prevalence and popularity of these accounts have been largely attributed to the interesting and sometimes sensational content that they churn out, which comes as a breath of fresh air from the state-regulated official sources which like to keep content produced in Chinese cyberspace in-line with communist party ideals.

Despite freedom of expression being codified in China's constitution, the one-party state does allow some leniency but keeps a strict limit on the extent to which the party can be criticised.

The US Federal Communications Commission has admitted that the alleged hack which blocked pro-net neutrality comments never happened, sparking outrage amongst activists.

FCC Chairman Ajit Pai released a statement yesterday confirming that the outage that prevented many people from leaving comments on the FCC's net neutrality proposal last May was not caused by "external" actors as previously suggested, but instead by inadequate IT systems, implying that it was overwhelmed by the sheer volume of commenters.

The statement follows the conclusion of an investigation by the FCC's Inspector General into the agency's claims that it fell victim to a DDoS attack. Pai has primarily blamed ex-CIO David Bray for spreading the DDoS story, as well as implying that the technical failings were the result of mismanagement by the Obama-era FCC leadership.

"I am deeply disappointed that the FCC's former Chief Information Officer (CIO), who was hired by the prior Administration and is no longer with the Commission, provided inaccurate information about this incident to me, my office, Congress, and the American people," Pai said in a statement.

"It has become clear that in addition to a flawed comment system, we inherited from the prior Administration a culture in which many members of the Commission's career IT staff were hesitant to express disagreement with the Commission's former CIO in front of FCC management."

He also stated that the organisation's Electronic Comment Filing System (ECFS) was deeply in need of updating, and the FCC has pledged to improve it with the help of a congressional grant.

Many campaigners, however, are now calling for Congress to reinstate the net neutrality rules rolled back by the FCC, with Fight for the Future's deputy director Evan Greer arguing that the FCC's actions have rendered the pretext for the repeal "illegitimate".

"Under Ajit Pai's leadership, the FCC sabotaged its own public comment process," she said in a statement. "From ignoring millions of fraudulent comments using stolen names and addresses to outright lies about DDoS attacks that never happened, the agency recklessly abdicated its responsibility to maintain a functional way for the public to be heard."

"Pai attempts to blame his staff, but this happened on his watch, and he repeatedly obstructed attempts by lawmakers and the press to get answers. The repeal of net neutrality was not only unpopular, it was illegitimate. Congress must act now to pass the CRA resolution to reverse this decision and restore basic protections for Internet freedom."

The outage that the FCC initially blamed on a DDoS attack occurred last year, while the regulator was still in the process of gathering feedback and comments on whether or not to keep net neutrality rules in place. Powerful telco lobbies were in favour of repealing the rules, but polls showed that most ordinary people supported them, and the FCC's request for comment represented one of the only opportunities for them to make their opinions heard.

This was fuelled particularly by comedian John Oliver, after a segment on net neutrality from his HBO show Last Week Tonight went viral. The segment included simple instructions on how to leave a comment in support of net neutrality, and the FCC was promptly flooded with over 1.6 million responses. Shortly afterwards, the ECFS experienced a major outage, leaving people unable to post any further comments.

Although it's impossible to say for certain that the influx of feedback was a direct result of Oliver's segment, it's highly likely - particularly as the same thing happened in 2014. In a separate episode three years earlier, Oliver also issued a similar plea to users asking them to get in touch with the FCC to support net neutrality rules, after which the regulator received another deluge of comments.

The FCC's comments system went down in this instance too but, at the time, the watchdog (then led by Democrat Tom Wheeler) blamed the outage on the unexpected spike in traffic, coupled with old and ailing software.

While logic (and Pai's statement) would suggest that the same thing happened last year, the FCC instead insisted that the recent outage was the result of a DDoS attack. FCC officials also told reporters that the 2014 outage was also caused by a DDoS and that Wheeler was covering it up, according to a Gizmodo report.

Multiple sources have disputed these accounts, citing the FCC's refusal to produce any evidence in support of its claims. In fact, the Government Accountability Office is still in the midst of an independent investigation into the FCC's claims. This investigation is separate from the Inspector General's report, which has not yet been made public.

"The Inspector General Report tells us what we knew all along," said Jessica Rosenworcel, a Democrat member of the FCC and staunch defender of net neutrality; "The FCC's claim that it was the victim of a DDoS attack during the net neutrality proceeding is bogus."

Image: Shutterstock

The public has growing increasingly aware of its privacy rights over the last 12 months, according to the Information Commissioner's Office (ICO), which regulates data protection in the UK.

The data watchdog highlighted an increase in complaints and self-reported breaches, as well as a significant rise in calls from the public and organisations, as evidence that privacy and data protection matters have become more important to people.

Data protection complaints rose by 14.5% in 2017/18, according to the ICO's annual report, released this week, and it recorded a 29% rise in self-reported data breaches from organisations, from 2,447 to 3,156. Self-reporting is now mandatory under GDPR, so the number is expected to rise yet further over the course of 2018/19.

Moreover, the data regulator received almost 46,000 more calls than the previous year - an increase of 24.1% - while the number of live chats requested rose by 61.5%. Approximately two-thirds, 68%, of enquiries were from members of the public while the remainder were from organisations - with the vast majority of enquiries, 85%, concerning the DPA.

"This is an important time for privacy rights, with a new legal framework and increased public interest," said information commissioner Elizabeth Denham.

"Transparency and accountability must be paramount, otherwise it will be impossible to build trust in the way that personal information is obtained, used and shared online."

The ICO issued 1.29 million in fines for serious failures under the old Data Protection Act 1998 (DPA). These were issued alongside 138,000 in fines to charities for unlawfully processing personal data, and a further 80,000 penalty issued to a data broking organisation.

Breaches of the Privacy and Electronic Communications Regulations (PECR), meanwhile, saw 26 organisations fined a collective 3.28 million for nuisance calls and spam texts, altogether amounting to the greatest number, and amount, of penalties the ICO has issued in its history.

The watchdog launched 19 prosecutions in 2017/18 resulting in 18 convictions under the DPA, and issued a further six cautions. One highlight mentioned in the report was the ICO's ongoing investigation into 30 organisations, including Facebook and Cambridge Analytica, into the misuse of personal data in political campaigning.

As part of these investigations, the regulator levied a 500,000 fine against Facebook earlier in July - the maximum possible fine under the old DPA - for two breaches of the 1998 act.

Because the offences had been committed prior to 25 May, they were not adjudicated under GDPR - which carries with it a maximum fine of 20 million, or 4% of an organisation's global annual turnover (whichever is higher), for the most serious breaches.

In the lead up to the European Union's (EU's) tough new set of data laws coming into force, the ICO also offered guidance and advice to organisations racing to comply - including the set-up of a small business helpline, and the launch of a UK-wide 'Your Data Matters' awareness campaign.

"At the time of my previous annual report the office was heavily involved in preparations for the upcoming General Data Protection Regulation (GDPR), working on guidance with our EU counterparts and identifying how our own processes needed to change to take account of the GDPR," Denham continued.

"In 2017/18 this activity has upped a few gears and involved many more staff. We have produced well received guidance on the new law for organisations, and have also continued a successful change management process to ensure our internal processes and workflows are up to the demands placed upon us by GDPR."

Picture: Information commissioner Elizabeth Denham

The Electoral Commission has called for urgent reforms to the electoral law saying that British democracy "may be under threat" following a series of online political scandals.

In a report called "Digital campaigning: increasing transparency for voters" the elections regulator is calling on Westminster and the UK's devolved governments to combat the largely unregulated world of online political campaigning.

The Commission wants the government and social media companies to improve transparency around the targeting of voters online and combat misinformation, the misuse of personal data and overseas interference in elections.

"The last decade has seen an explosion in the use of digital tools in political campaigning," the report states. "Perceptions have also changed in that time.

"The use of social media was first heralded as a positive revolution in the mass engagement of voters. More recently we have seen serious allegations of misinformation, misuse of personal data, and overseas interference. Concerns that our democracy may be under threat have emerged."

To combat this threat, the Electoral Commission has called for a change in the law to require all digital political campaign material to state who paid for it and for a new legislation to make it clear that spending in UK elections and referendums by foreign organisations and individuals is not allowed.

It also calls for political campaigns to declare their spending soon after or during a campaign and more detailed paperwork on how they spend money online. It would also like to increase the maximum fine it can impose on organisations and individuals who break the rules. The current limit is 20,000 per offence.

"Urgent action must be taken by the UK's governments to ensure that the tools used to regulate political campaigning online continue to be fit for purpose in a digital age," said Sir John Holmes, chair of the Electoral Commission.

"Implementing our package of recommendations will significantly increase transparency about who is seeking to influence voters online, and the money spent on this at UK elections and referendums."

The interventions come in the aftermath of the 2016 EU referendum. The regulator has a pending report due next month into Vote Leave spending and according to a leaked copy of the investigation obtained by the BBC, it is likely to find the Brexit campaign broke spending rules.

The Commission has also welcomed social media companies' commitments to political campaigning transparency and called on them to deliver their proposals for online databases of political adverts in time for UK elections in 2019 and 2020.

Following the Cambridge Analytica scandal that saw online voters influenced during Donald Trump's presidential campaign, the Commission also called on social media companies to put in place new controls to check that people or organisations who want to pay to place political adverts about elections and referendums in the UK are legally permitted to do so.

Picture: Shutterstock

Businesses are constantly seeking to ensure they are fully compliant with regulatory demands over data sharing and information governance - especially in light of GDPR, which came into force on 25 May 2018. But beyond this, large organisations are always seeking to improve their data and information governance skills more generally.

Information governance, according to the Data Governance Institute, is a system of decision rights and accountabilities for information-related purposes. The institute says these are "executed according to agreed-upon models, which describe who can take what actions with what information, and when, under what circumstances, using what methods".

This may also offer employees a reliable avenue for dealing with the host of different regulatory and legal hurdles that apply to handling customer or user data. With various pieces of legislation in force simultaneously this could be confusing.

These include The Computer Misuse Act 1990; The Data Protection Act 1998; The Human Rights Act 1998; The Freedom of Information Act 2000; and The Privacy and Electronic Communication Regulations 2003, as well as the GDPR-inspired Data Protection Act 2018.

Important targets

Information governance offers a framework to bring together aspects of data handling into one single, over-arching policy, ensuring it complies with all relevant data laws. This not only makes it easier for employees to access the information they need to run their day-to-day tasks, but it also means the entire organisation is more likely to be compliant.

Information Governance can also help cut costs associated with the collection, management and storage of data, allowing firms to take advantage of low-cost cloud services they perhaps would not have been able to use in the past, because of the sensitivity of the data they hold, for example.

Because the data is already compliant before employees access it, workers are able to use it freely to make better business decisions, ultimately resulting in higher levels of productivity across the entire organisation.

As part of information governance, the company will also need to outline and adhere to their individual data strategies, policies and standards, ensuring everyone in the organisation understands them and is using them as a unified entity. There's no point having policies and strategies if not everyone is using or sticking to them, including management and the board.

Information governance should be the centre of IT strategy and it should be used to dictate how data management projects and services are developed and implemented.

Measuring success

Organisations can measure the success of their information governance efforts against the following:

• Has the application of information governance practices fixed any outstanding problems that led to its original deployment?
• Are data standards well-defined and comprehended by users who need to be mindful of them?
• Is data and information of a superior quality or of better use as a consequence of the modifications made?
• Do users within an organisation recognise the main parts they play in information governance within their department?

Best practices

When implementing an effective information governance strategy, it is crucial to follow best practices.

Have executive sponsorship the success of information governance within an organisation often;rides on executive sponsorship of the initiative in order for it to remain a priority.

Know your starting point Before you can figure out where your information governance initiative takes you, you need to assess your starting point and incorporate this into your initial governance strategy.

Be realistic Always make sure that your organisation's information governance project has a realistic and achievable starting point. Start small, build up and develop successes to promote information governance to the wider user base.

Have checkpoints with specific milestones, an organisation can check what is and isn't working in order to make changes and ensure the long-term viability and sustainability of the project.

Gmail and Google Search have been partially blocked in Russia after the state's communication watchdog accused the US search engine of helping people continuing to use the banned chat service Telegram in the country.

Russia blocked certain Google IP addresses in Moscow, St. Petersburg, Kazan, Krasnoyarsk and other cities yesterday after they were added to Roskomnadozor's list of banned sites.

"Google hasn't complied with Roskomnadzor requests and, despite a court ruling, keeps allowing Telegram Messenger to use its IP addresses to operate in Russia," the watchdog said on its official page on the VK.com social network. "Therefore, Roskomnadzor included some Google IP addresses into a register of banned internet resources."

Gmail, Google Search and some Android app push notifications are affected, according to TechCrunch.

This is the latest development in Russia's war on Pavel Durov's encrypted Telegram messenger service, which Russian authorities had started blocking on 16 April after Durov failed to comply with legislation requiring the company to give the federal security services access to users' encrypted messages.

Despite the ban, Telegram users were able to continue accessing the service by using VPNs and hopping from various IP addresses on sites like Google to bypass the block.

The decision to block Telegram has also forced Kremlin officials to switch to Mail.ru's ICQ chat service.

In a post on his own Telegram channel, Durov warned that Russia is heading into an era of "full-scaled internet censorship", and that this was its strongest crackdown on internet freedom so far.

"For seven days Russia has been trying to ban Telegram on its territory - with no luck so far. I'm thrilled we were able to survive under the most aggressive attempt of internet censorship in Russian history with almost 18 million IP addresses blocked.

"My thanks to all the members of the #DigitalResistance movement. Keep up your great work setting up socks5-proxies and VPNs and spreading them among your Russian friends and relatives. They will be needed as the country descends into an era of full-scale internet censorship."

A Google spokesperson told TechCrunch: "We are aware of reports that some users in Russia are unable to access some Google products, and are investigating those reports."

Picture: Shutterstock

Shh - what's that? If you listen very, very carefully, you'll hear it; it's the sound of countless security experts smashing their heads against their keyboards in frustration. The cause, as so often before, is the government's laughable attitude to data privacy and cyber security.

Where to begin with this latest shambles? You may recall that First Secretary of State Damian Green was allegedly found to have rude and naughty pictures of the pornographic variety on his government-issued computer, which Green denies.

Nadine Dorries, Conservative MP for Mid Beds, leapt to Green's defence over the weekend, pointing out that if porn was found on Green's computer, it may not have been him who was downloading and/or viewing it on taxpayer time. After all, she said, her staff use her login to access her official computer all the time. Even interns on exchange programmes!

Er, sorry... What?

Yes folks, you read that correctly - Dorries is so free and easy with her access credentials that she even hands them out to visiting exchange students. To make matters worse, several of her fellow MPs admitted they also share their login details with staff, including Nick Boles, Will Quince and Robert Syms.

Of course, Dorries was quick to downplay the seriousness of her actions, stating that all she has on her computer is a shared email account, with no access to government documents. Boles, similarly, said that only the four people he employs to deal with correspondence from constituents have access to the passwords, which are regularly changed.

For the avoidance of doubt, let's be crystal clear: this is a dangerous, insecure and irresponsible practice. Under no circumstances should anyone be sharing one login between multiple staff members. There are numerous ways to ensure staff members can access a shared computer, mailbox or file storage system without having one login that simply gets passed around, and the fact that government MPs are apparently not using any of them is extremely alarming.

Dorries and co claim that sharing their login with staff isn't an issue, but let's take the time to unpick some of the many, many problems with these arguments.

Firstly, there's the issue of lateral movement. Dorries says that the only thing on the computer is a shared email account. Even if that's true, the computer itself is 'Westminster-based', and is likely to be connected to some kind of internal network. This opens up the possibility for lateral movement, using Dorries' machine as a way to gain access to a more important target within the network.

Then there's the issue of data protection. The shared mailbox used by the staff of Dorries and Boles presumably contains at least a partial list of constituents' names and email addresses, along with who knows what additional information shared as part of their correspondence. Behaviour like this puts all of that information at risk.

Last but not least, accountability is the biggest problem with using a shared login - and one that is best illustrated, ironically, by the very issue that prompted Dorries' admission in the first place. She is quite right in stating that if Green's access credentials were shared by his staff, there's no way of proving that it was him that was allegedly looking at porn, but that's a huge problem.

Let's imagine that, instead of perusing some nudes, the First Secretary of State was instead accused of using his computer to leak classified intelligence data to Russian agents. With a single shared login, it's virtually impossible to trace the source of the leak back to the mole. If everyone has their own credentials, it's instantly obvious.

The concept of not sharing your username and password with anyone is a basic, fundamental tenet of cyber security best practice, and the tools to ensure that you shouldn't need to share your credentials have existed for years. Considering that the Tories are supposed to be the party of business, its own staff seem to be trailing laughably far behind the curve when it comes to keeping up with industry security standards - which would be funny if it wasn't so alarming.