Data Security, Transfers and Access Sandra Tudor HMRC September 2008

2 Presentation Overview Data Security in HMRC – 2007 to 2008 Impact on Trade Statistics Data Governance Data Sharing and Data Access The DARTTS project

3 Data Security – 2007 Following an incident in 2007, there was a wide-ranging review of data security in HMRC This led to The Lockdown Clarification of Guidance Roles Responsibilities Processes and Some system improvements

4 Trade Statistics and data security: Processing Key features Secure Mainframe & Unix systems with password access Trade statistics located on a complete floor ‘Electronic folder’ for trader specific information Secure restricted access areas on shared network drives Restricted discussions with operational colleagues concerning individual data items Limited access to aggregate data prior to release Encrypted laptops, with restrictions on movement of laptops & Blackberries

5 Trade Statistics and data security: Data Access Existing Trade Statistics checks Check if the data are in the public domain (or pre-release) If not usually published Do we want to release the data? Do we need/have a legal gateway? Access to Trade Statistics is governed by EC legislation; HMRC legislation; EU Statistical Code of Practice; UK Code of Practice; and new UK Statistical legislation passed in 2008

6 Trade Statistics and data security: Data Transfers New process for ‘bulk data - once agreed we can release the data Complete a Data Transfer Request Security classification, transfer method, customer, frequency, etc. Send to our ‘Data Guardian’ for approval from IT Security Group Once authorised, send data We move large volumes of aggregated data each month and needed to speed up the new approval process

7 Trade Statistics and data security: Data Transfers (2) We developed a matrix of product type by category Published/ unpublished Pre-release ‘Publishable’ Trader level or aggregated Suppressions (disclosure control) applied/ not applied/ not applicable Security classification Usually restricted or not classified

8 Data Security – 2008 Impacts Needed additional resource to manage new process steps Missed some initial delivery deadlines New system is less flexible and takes longer ‘Lockdown’ on laptops and removable media is still impacting Benefits Better management processes and assurance Reduced number of outputs Better compliance with the National Statistics Code of Practice

9 Data Governance We also Created a new Data Governance role Including stronger information and records management Reviewed password access controls for statistical systems Reviewed all the regular data outputs with customers In spite of previous reviews we found some products could be stopped Introduced a more rigorous RACI analysis Responsible, Accountable, Consult, Inform

10 Data Sharing example The DARTTS project, USA and UK Data Analysis & Research for Trade Transparency System Projects set up between US Homeland Security and other countries to fight Trade-Based Money Laundering (TBML) The software analyses outliers in data using time series, price/weight ratios and asymmetries Anomalies are investigated first to check for data errors – leading to potential improvements in data quality Remaining anomalies are investigated as potential fraud – duty fraud or TBML

11 Data Sharing example, continued The DARTTS project, USA and UK Requirement for an anonymised set of trade data on trade between USA and UK UK Trade Statisticians facilitated data extraction from administrative data, and provided the algorithm for anonymising the data We will benefit from the data cleaning aspect We have delivered the first set of data for the pilot Revised specification waiting for approval Initial analyses has already shown some data issues in two chapters Our analysis suggests these are data errors

12 Data sharing: benefits Bilateral matching/asymmetry work with other countries’ statisticians Allows us to resolve more errors Data cleansing Feeding back trader data errors to Customs Provide input to Fraud analyses and targeting But need to balance with security requirements HMRC work on creating a new Data lab Building on ONS model Initially for tax statistics We have prospective GSS demand for trade data

Thank you HM Revenue & Customs