Incident: MI5 Subscriber Data Collection Error due to Spreadsheet Formatting.

Published Date: 2011-07-01

Postmortem Analysis
Timeline 1. The software failure incident where MI5 wrongly collected subscriber data on 134 telephone numbers due to a software error happened in 2010 [6064].
System 1. MI5's system used for requesting subscriber data and internet protocol addresses failed due to a spreadsheet formatting error and an incorrect setting on the system, respectively [6064].
Responsible Organization 1. MI5 - The software failure incident, where subscriber data was wrongly collected due to a spreadsheet formatting error and data on internet protocol addresses was acquired without proper authorization, was caused by MI5 [6064].
Impacted Organization 1. MI5 [6064]
Software Causes 1. A spreadsheet formatting error caused MI5 to wrongly collect subscriber data on 134 telephone numbers [6064]. 2. An incorrect setting on the system used by MI5 led to the acquisition of data on the histories of 927 internet protocol addresses without proper authorization [6064].
Non-software Causes 1. Human error in the form of a spreadsheet formatting mistake led to the incorrect collection of subscriber data on 134 telephone numbers by MI5 [6064]. 2. Lack of proper authorization from a sufficiently senior officer (GD3 rank or above) resulted in MI5 acquiring data on the histories of 927 internet protocol addresses without proper clearance [6064].
Impacts 1. MI5 wrongly collected subscriber data on 134 telephone numbers due to a software error, leading to the acquisition of irrelevant data with no connection to any investigation or operation [6064]. 2. The software error also resulted in MI5 acquiring data on the histories of 927 internet protocol addresses without proper authorization from a sufficiently senior officer, leading to unauthorized data collection [6064]. 3. The incident necessitated manual checking of numbers before requesting subscriber data and correcting the setting on MI5's systems to prevent future errors [6064].
Preventions 1. Implementing thorough testing procedures: Conducting comprehensive testing, including both automated and manual checks, could have helped identify the spreadsheet formatting error before it led to the incorrect collection of subscriber data [6064]. 2. Implementing proper data validation checks: Having validation checks in place to ensure that the correct data format is being requested and processed could have prevented the software error that led to the collection of irrelevant subscriber data [6064]. 3. Implementing access control measures: Enforcing strict access control policies and requiring authorisation from sufficiently senior officers before acquiring certain types of data could have prevented unauthorized data collection incidents like the one involving the internet protocol addresses [6064].
Fixes 1. Implementing manual checks before requesting subscriber data from communications providers [6064] 2. Correcting the setting on the system used by the Security Service to prevent unauthorized acquisition of data on internet protocol addresses [6064]
References 1. Interception of communications commissioner Sir Paul Kennedy's annual report 2. Sir Peter Gibson, the intelligence services commissioner's annual report

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident related to MI5 wrongly collecting subscriber data due to a software error has happened within the same organization. The interception of communications commissioner Sir Paul Kennedy's annual report highlighted how a spreadsheet formatting error caused MI5 to collect data on telephone numbers incorrectly. This incident led to the acquisition of irrelevant subscriber data, which had no connection to any ongoing investigations or operations. However, steps were taken to rectify the formatting fault and manually check numbers before requesting subscriber data [6064]. (b) There is no specific mention in the articles about the software failure incident related to MI5 happening at other organizations or with their products and services.
Phase (Design/Operation) design (a) The software failure incident in the article was related to the design phase. The incident occurred due to a spreadsheet formatting error that caused MI5 to wrongly collect subscriber data on 134 telephone numbers. The error led the service to apply for data on the identity of telephone numbers ending in 000 instead of the actual last three digits. This design flaw resulted in acquiring subscriber data that had no connection or relevance to any investigation or operation being undertaken by the Security Service [6064]. (b) The article does not provide information about a software failure incident related to the operation phase.
Boundary (Internal/External) within_system (a) The software failure incident reported in Article 6064 falls under the within_system category. The failure was attributed to a spreadsheet formatting error within the system used by MI5, which caused the service to collect subscriber data on telephone numbers ending in 000 instead of the actual last three digits. Additionally, the incident involving the acquisition of data on internet protocol addresses without proper authorization was also linked to an incorrect setting on the system used by the Security Service [6064].
Nature (Human/Non-human) non-human_actions (a) The software failure incident in Article 6064 occurred due to non-human actions. Specifically, a spreadsheet formatting error caused MI5 to wrongly collect subscriber data on 134 telephone numbers, as the service applied for data on the identity of telephone numbers ending in 000 instead of the actual last three digits. This error was not intentional and was a result of a formatting fault in the system used by MI5 [6064].
Dimension (Hardware/Software) software (a) The software failure incident mentioned in the article was primarily due to a software error rather than hardware issues. The incident occurred because of a spreadsheet formatting error that caused MI5 to wrongly collect subscriber data on telephone numbers [6064]. The error led to the service applying for data on the identity of telephone numbers ending in 000 instead of the actual last three digits. Additionally, the acquisition of data on internet protocol addresses without authorization was attributed to an incorrect setting on the system used by the Security Service [6064]. (b) The software failure incident was attributed to contributing factors originating in software. The errors mentioned, such as the spreadsheet formatting error and the incorrect setting on the system, point to software-related issues that led to the failure incident [6064].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident described in Article 6064 was non-malicious. The failure occurred due to a spreadsheet formatting error that caused MI5 to wrongly collect subscriber data on 134 telephone numbers. This error led to the acquisition of subscriber data that had no connection or relevance to any investigation or operation being undertaken by the Security Service. Additionally, the incident where MI5 acquired data on the histories of 927 internet protocol addresses without authorization was also attributed to an incorrect setting on the system used by the Security Service. These errors were not intentional but rather resulted from technical mistakes within the software systems [6064].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident related to poor decisions can be seen in the article. The software error that led MI5 to wrongly collect subscriber data on 134 telephone numbers was attributed to a spreadsheet formatting error. This error caused the service to apply for data on the identity of telephone numbers ending in 000 instead of the actual last three digits. This mistake was a result of a poor decision in the formatting of the spreadsheet, leading to the incorrect data collection [6064].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the article. The interception of communications commissioner Sir Paul Kennedy's annual report highlighted that MI5 wrongly collected subscriber data on 134 telephone numbers due to a software error caused by a spreadsheet formatting mistake. This error led the service to request data on telephone numbers ending in 000 instead of the actual last three digits, showing a lack of professional competence in handling the software system [6064]. (b) The software failure incident related to accidental factors is also present in the article. It mentions that MI5 acquired data on the histories of 927 internet protocol addresses without proper authorization from a sufficiently senior officer due to an incorrect setting on the system used by the Security Service. This indicates that the failure was accidental, resulting from an incorrect system setting rather than intentional actions [6064].
Duration temporary (a) The software failure incident related to MI5 wrongly collecting subscriber data on telephone numbers and acquiring data on internet protocol addresses was temporary. The incident was caused by a spreadsheet formatting error and an incorrect setting on the system used by the Security Service. These specific contributing factors introduced by certain circumstances led to the failure. However, measures were taken to correct the errors, such as destroying the acquired data, fixing the formatting fault, and correcting the setting on the systems to prevent future occurrences [6064].
Behaviour crash, omission, value, other (a) crash: The software error in the MI5 system led to the collection of subscriber data on 134 telephone numbers that had no connection or relevance to any investigation or operation being undertaken by the Security Service. This indicates a failure where the system lost its state and did not perform its intended function correctly [6064]. (b) omission: The incorrect setting on the system used by MI5 resulted in the acquisition of data on the histories of 927 internet protocol addresses without authorization from a sufficiently senior officer. This omission to obtain proper authorization before collecting the data showcases a failure of the system to perform its intended functions correctly at that instance [6064]. (c) timing: There is no specific mention of a timing-related failure in the articles provided. (d) value: The software error in the MI5 system caused the acquisition of subscriber data and internet protocol addresses that had no connection to any ongoing investigations or operations. This indicates a failure where the system performed its intended functions incorrectly by providing irrelevant data [6064]. (e) byzantine: There is no indication of a byzantine behavior in the articles provided. (f) other: The software error in the MI5 system led to a formatting fault where subscriber data was acquired based on telephone numbers ending in 000 instead of the actual last three digits. This behavior is not explicitly described in the options (a) to (e) and can be categorized as an 'other' behavior where the system behaved in an unexpected manner, resulting in incorrect data acquisition [6064].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence unknown (a) death: People lost their lives due to the software failure (b) harm: People were physically harmed due to the software failure (c) basic: People's access to food or shelter was impacted because of the software failure (d) property: People's material goods, money, or data was impacted due to the software failure (e) delay: People had to postpone an activity due to the software failure (f) non-human: Non-human entities were impacted due to the software failure (g) no_consequence: There were no real observed consequences of the software failure (h) theoretical_consequence: There were potential consequences discussed of the software failure that did not occur (i) other: Was there consequence(s) of the software failure not described in the (a to h) options? What is the other consequence(s)? The articles do not mention any consequences related to death, harm, basic needs, property loss, or non-human entities resulting from the software failure incident reported. The incident primarily involved errors in data collection by MI5, leading to the acquisition of irrelevant subscriber data and internet protocol addresses. The consequences discussed in the articles were related to data privacy, security breaches, and the need for manual checks and corrections to prevent future errors.
Domain information, government (a) The failed system was related to the information industry as it involved the wrongful collection of subscriber data by MI5 [6064]. (b) No information provided in the articles about transportation industry. (c) No information provided in the articles about natural resources industry. (d) No information provided in the articles about sales industry. (e) No information provided in the articles about construction industry. (f) No information provided in the articles about manufacturing industry. (g) No information provided in the articles about utilities industry. (h) No information provided in the articles about finance industry. (i) No information provided in the articles about knowledge industry. (j) No information provided in the articles about health industry. (k) No information provided in the articles about entertainment industry. (l) The failed system was specifically related to the government industry as it involved the Security Service (MI5) wrongly collecting subscriber data and internet protocol addresses due to a software error [6064]. (m) No information provided in the articles about other industries.

Sources

Back to List