UK police have lost over 150,000 fingerprints, DNA, and arrest history records after accidentally wiping them from national policing systems. The Home Office said it was working with police to “assess the impact” of the glitch within the plans and that no records of criminals or dangerous persons had been deleted. It said the wiped records were those of people arrested and released when no further action was taken.
Policing minister Kit, Malthouse said that “a standard housekeeping process that runs on the Police National Computer [PNC] deleted several records in error” and that “a fast time review has identified the problem and corrected the process, so it cannot happen again”.
Malthouse added: “The Home Office, the National Police Chiefs Council, and other law enforcement partners are working at pace to recover the data. While the loss relates to individuals arrested and then released with no further action, I have asked officials and the police to confirm their initial assessment that there is no threat to public safety.”
However, it is currently unclear which specific policing systems experienced the problem and how widespread it was. Although the PNC holds a range of personal data on individuals – from information on arrests and convictions to vehicles and property – it does not contain fingerprint or other biometric information in the IDENT1 system.
Similarly, information related to DNA is held in the National DNA Database, not the PNC, which means the technical issue has affected several UK policing databases. The problem has also affected the UK’s visa system, which had to suspend processing applications for two days.
Shadow home secretary Nick Thomas-Symonds has called on home secretary Priti Patel to take responsibility for the computer error and clarify its impact.
“This is a grave security breach that presents huge dangers for public safety,” he said. “The incompetence of this shambolic government cannot be allowed to put people at risk, let criminals go free, and deny victims justice.”
The Home Office did not comment when asked by Computer Weekly what the justification was for holding records on thousands of individuals when no further police action was taken.
The PNC currently holds information on about 12.6 million individuals and retains this information until either their 100th birthday or 100 years from the date it was first reported to police, depending on the intelligence category the data falls into.
Kevin Blowe, a coordinator at the Network for Police Monitoring (Netpol), said the data loss, which has been criticized by sections of the press and politicians for “allowing offenders to go free”, has “certainly led to an outbreak of reactionary pearl-clutching, including from some opposition politicians”.
He added: “If, however, the Home Office is correct and no records of criminal or dangerous persons have been deleted, but only records of those arrested and then released without further action, then there are far more essential questions that need answering.
“Why are police keeping huge amounts of personal data that it doesn’t need, apparently on the off-chance that it might become useful as intelligence in the future? How is this not on a par with the police keeping millions of facial images of innocent people on a searchable database, long after the courts ruled that this was unlawful?”
The Home Office did not comment when asked whether the lost data was retrievable and whether it had any idea when it would be recovered.
Ezat Dayeh, a systems engineer manager at data management firm Cohesity, said: “The bottom line here is that critical data must be protected. It is hard to believe that there is no protection, no backup, and policies that would prevent this kind of data from being lost. They should recover this data within hours if they have only discovered the deletion. If not, and their backup doesn’t stretch back far enough, then questions need to be asked.
“Human error, ransomware, or even something as innocent as accidental deletion or a power failure can lead to files not being accessible. But organizations should regularly back up their files and verify that all that data is secure and usable. It’s not just a best practice in data management or an IT issue; it’s an organizational must and a compliance measure often required by law.” The PNC last experienced a significant problem on 21 October 2020, going down for more than 10 hours after an electrical power outage.
