The Unsecured State Part 5 - Abandoned Inquiries

This is part 5 of a series of blog posts looking at the security of the UK Government's web infrastructure.

---

The primary cause of the vulnerabilities I've exposed over this series is abandonment.

In a flurry of excitement a website is commissioned and created. Then, as time wears on, people begin to drift away from the project. Job titles change, people are reshuffled, and senior management's gaze focuses elsewhere.

Who is now responsible for updating and maintaining the software? No one. Like an unwanted puppy, it has been abandoned on the street and proceeds to pick up all manner of diseases in its malnourished state.

So we move on to the tragic fate of the abandoned Public Inquiry website. Long after "lessons have been learned" these sites stand in monument to the vast human undertaking required to make sense of a tragedy.

Not so much.

Leveson

The Leveson Inquiry last updated its website in November 2012. Since then, it has been left to rot. Much like the Noble Lord's proposals on regulating Britain's feral media.

• The admin page is freely available - although "protected" by an expired SSL certificate.
• The search functionality is broken. Reducing its usefulness.
• The outdated WordPress 3.7.1 powers the site.

That's fairly mild. As weeks turn into years, we can expect the site to decay further.

What about Inquiries which ended many years ago? The National Archives maintains a list of all previous inquiries and an archive of their original websites.

Taking a look through some of the more high profile site reveals a very sorry state.

Victoria Climbié

Victoria Climbié was tortured and murdered by her guardians. The public inquiry, headed by Lord Laming, had a hugely positive effect on the way child protection works in the UK.

The official report - along with hundreds of news sites - still link to this long abandoned site.

Rather than keeping the website running, keeping all the documents in public view, the domain was allowed to lapse.

Where upon a "Mr Benedict Sykes" bought the domain, and it became stuffed full of barely related keywords and adverts.

Benedict is a "creative, innovative and extremely credible Online Marketing Manager".

I'm not sure how credible it is to take a report into a murdered child and then use it to sell links to investment guides and addiction councelling. But then I don't have the same well defined set of ethics as Mr Sykes...

At Benedict we adopt a simple ethical code for all online activities taken on behalf of our clients. Our ethics are based around our belief that the internet's true purpose is to supply users with the right information at the right time. We abide by Google's rules and go further in being guided by our own philosophy on what the internet should and could be one day. Benedict's Ethical Philosophy

A fine way to profit from a child's senseless death.

Harold Shipman

The serial killer Harold Shipman murdered around 250 people. The inquiry into his activities found serious failings in the way the state controls doctors, pharmacists, and coroners. The total cost of the inquiry was £21 million.

That wasn't enough money to keep the site registered in perpetuity, apparently.

It has now been taken over by Gary Taylor - an affiliate marketer - who has redirected it to a spam site full of loan adverts.

Both the Shipman Inquiry website and the new spam site are registered to Gary. He links to the personal loans site in his Google+ profile. On his personal website he boasts about his SEO prowess.

It's not Gary's fault that the Government couldn't be bothered to keep the site running - indeed, he appears to have bought it from some other 3rd party.

The site should have been left standing in memorial to the victims. A tribute to let their families know that the state recognises their loss and will do everything in its power to stop such horrors from being inflicted on other people.

But now it's just a sordid way for the Midlands Young Entrepreneur Of The Year (2008) to make a few quid.

Bloody Sunday

After £190 million and 10 years, the Saville Report into Bloody Sunday was published in 2010.

Despite all that time and money, the site is now a haven for spammers. Thousands of news websites point there, countless newspapers will have made reference to the site, all now unwitting pawns in an anonymous spammer's SEO Expert's game.

The Iraq War

Hey, remember when the Security Services said Iraq had Weapons of Mass Destruction which could be launched within 45 minutes? Yeah, turns out they lied.

The Butler Review came to the conclusion that the "intelligence" which used to justify the war with Iraq was unreliable.

The Hutton Inquiry investigated the apparent suicide of Dr David Kelly. Prior to his death, he had been exposed as the person behind claims that the Government "sexed up" the intelligence relating to Weapons of Mass Destruction.

Both Inquiry websites are now used by spammers. Profiting from the bloody consequences of war - all because the British state cannot pay for the upkeep of a few websites.

&c.

And so it goes on. There are around a dozen Public Inquiry Sites which have been allowed to lapse and are now in the hands of spammers.

Even when the government has managed to keep hold of the domain - they aren't managing their portfolio properly. Zahid Mubarek was murdered by a violent racist after the prison service placed them in a cell together. The Home Office spent year resisting calls for an inquiry until the Law Lords ordered David Blunkett to set one up.

Today www.ZahidMubarekInquiry.org.uk is still owned by the Home Office - but no longer has a working website behind it. It's as if they want to flush the reports of an institutional racist prison service down the memory hole.

This is our digital heritage - and it is being squandered.

Legacy

Over the last week I've exposed how Parliament's website was open to attack, how a key Department for Education database could be hijacked, that the NHS is riddled with insecure websites, and that local government websites don't fare much better.

There needs to be a radical re-think in the way that the state approaches digital infrastructure. This means long term legacy planning - not just thinking in terms of election cycles. It means employing people who know what they are talking about - not just the heads of "Think Tanks". It means no longer being afraid of technology - but rather embracing the promise it brings of a better world for all.

Sadly, for now, when dealing with the UK Government's attitude to their websites, I think it best to hang a large banner above your browser reading "Lasciate ogne speranza, voi ch'entrate"