The Unsecured State Part 5 - Abandoned Inquiries

This is part 5 of a series of blog posts looking at the security of the UK Government's web infrastructure.


The primary cause of the vulnerabilities I've exposed over this series is abandonment.

In a flurry of excitement a website is commissioned and created. Then, as time wears on, people begin to drift away from the project. Job titles change, people are reshuffled, and senior management's gaze focuses elsewhere.

Who is now responsible for updating and maintaining the software? No one. Like an unwanted puppy, it has been abandoned on the street and proceeds to pick up all manner of diseases in its malnourished state.

So we move on to the tragic fate of the abandoned Public Inquiry website. Long after "lessons have been learned" these sites stand in monument to the vast human undertaking required to make sense of a tragedy.

Not so much.

Leveson

The Leveson Inquiry last updated its website in November 2012.

Since then, it has been left to rot. Much like the Noble Lord's proposals on regulating Britain's feral media.

That's fairly mild. As weeks turn into years, we can expect the site to decay further.

What about Inquiries which ended many years ago? The National Archives maintains a list of all previous inquiries and an archive of their original websites.

Taking a look through some of the more high profile site reveals a very sorry state.

Victoria Climbié

Victoria Climbié was tortured and murdered by her guardians. The public inquiry, headed by Lord Laming, had a hugely positive effect on the way child protection works in the UK.

The official report - along with hundreds of news sites - still link to this long abandoned site.

Climbie Report-fs8

Rather than keeping the website running, keeping all the documents in public view, the domain was allowed to lapse.

Where upon a "Mr Benedict Sykes" bought the domain, and it became stuffed full of barely related keywords and adverts.

Climbie Spam

Benedict is a "creative, innovative and extremely credible Online Marketing Manager".

I'm not sure how credible it is to take a report into a murdered child and then use it to sell links to investment guides and addiction councelling. But then I don't have the same well defined set of ethics as Mr Sykes...

At Benedict we adopt a simple ethical code for all online activities taken on behalf of our clients. Our ethics are based around our belief that the internet's true purpose is to supply users with the right information at the right time. We abide by Google's rules and go further in being guided by our own philosophy on what the internet should and could be one day.
Benedict's Ethical Philosophy

A fine way to profit from a child's senseless death.

Harold Shipman

The serial killer Harold Shipman murdered around 250 people. The inquiry into his activities found serious failings in the way the state controls doctors, pharmacists, and coroners. The total cost of the inquiry was £21 million.

That wasn't enough money to keep the site registered in perpetuity, apparently.

It has now been taken over by Gary Taylor - an affiliate marketer - who has redirected it to a spam site full of loan adverts.

Shipman Website

Both the Shipman Inquiry website and the new spam site are registered to Gary. He links to the personal loans site in his Google+ profile. On his personal website he boasts about his SEO prowess.

It's not Gary's fault that the Government couldn't be bothered to keep the site running - indeed, he appears to have bought it from some other 3rd party.

The site should have been left standing in memorial to the victims. A tribute to let their families know that the state recognises their loss and will do everything in its power to stop such horrors from being inflicted on other people.

But now it's just a sordid way for the Midlands Young Entrepreneur Of The Year (2008) to make a few quid.

Bloody Sunday

After £190 million and 10 years, the Saville Report into Bloody Sunday was published in 2010.

Despite all that time and money, the site is now a haven for spammers. Thousands of news websites point there, countless newspapers will have made reference to the site, all now unwitting pawns in an anonymous spammer's SEO Expert's game.

Bloody Sunday Spam

The Iraq War

Hey, remember when the Security Services said Iraq had Weapons of Mass Destruction which could be launched within 45 minutes? Yeah, turns out they lied.

The Butler Review came to the conclusion that the "intelligence" which used to justify the war with Iraq was unreliable.

Butler Review Spam

The Hutton Inquiry investigated the apparent suicide of Dr David Kelly. Prior to his death, he had been exposed as the person behind claims that the Government "sexed up" the intelligence relating to Weapons of Mass Destruction.

Hutton Spam

Both Inquiry websites are now used by spammers. Profiting from the bloody consequences of war - all because the British state cannot pay for the upkeep of a few websites.

&c.

And so it goes on. There are around a dozen Public Inquiry Sites which have been allowed to lapse and are now in the hands of spammers.

Even when the government has managed to keep hold of the domain - they aren't managing their portfolio properly. Zahid Mubarek was murdered by a violent racist after the prison service placed them in a cell together. The Home Office spent year resisting calls for an inquiry until the Law Lords ordered David Blunkett to set one up.

Today www.ZahidMubarekInquiry.org.uk is still owned by the Home Office - but no longer has a working website behind it. It's as if they want to flush the reports of an institutional racist prison service down the memory hole.

This is our digital heritage - and it is being squandered.

Legacy

Over the last week I've exposed how Parliament's website was open to attack, how a key Department for Education database could be hijacked, that the NHS is riddled with insecure websites, and that local government websites don't fare much better.

There needs to be a radical re-think in the way that the state approaches digital infrastructure. This means long term legacy planning - not just thinking in terms of election cycles. It means employing people who know what they are talking about - not just the heads of "Think Tanks". It means no longer being afraid of technology - but rather embracing the promise it brings of a better world for all.

Sadly, for now, when dealing with the UK Government's attitude to their websites, I think it best to hang a large banner above your browser reading "Lasciate ogne speranza, voi ch'entrate"


6 Responses to “The Unsecured State Part 5 - Abandoned Inquiries”

  1. Andy Mabbett Image of Andy Mabbett

    A shocking state of affairs.

    A simple solution would be for all such inquiry websites to be at example.gov.uk or example.justice.gov.uk - then, if there really is a good reason not to maintain them, they can be redirected to the home page, http://www.gov.uk - or to the National Archives' version of the site.

    Local government is no better. When I worked for Birmingham City Council, I found that the council had over 100 websites (including registered and unused, or lapsed, domains) other than the main one. Many were unmaintained, or not adequately maintained. Several involved paying external providers to replicate services already available corporately. One even displayed the defunct mobile phone number of a former staff member, in whose name - as a private individual - it was registered, and whom we were unable to contact. Some of the URLs were on promotional goods such as rulers, cups, keyrings and bags, whose expected lifetime exceeded that of the defunct website.

    Reply
  2. Bob Jones Image of Bob Jones

    A key point missed here is that these inquiries need to be seen as utterly independent of the government, which means not sitting on *.gov.uk or using standard GDS or otherwise centralized infrastructure. It is a tough problem to keep them maintained in perpetuity when the inquiry budget is fixed.

    Reply
    • Terence Eden Image of Terence Eden

      Independent - as in set up by the government, given a remit by the government, paid for by the government, and reporting to the government.

      This is a solved problem - just redirect the .org.uk site to the National Archives. That's what happens to the majority of such sites.

      Cost for the domain is in the order of £10 per year - what's a couple of hundred quid compared to the vast cost of running these inquiries?

      Reply
  3. john c Image of john c

    For me the Leveson inquiry redirects to the National archives. I remember they had many variations of the Butler inquiry domain - wonder what happened to them.

    Reply

What Do You Reckon?