They Lost It. All Of It.

Overview

The video (The Fine Print, host Andy) reviews decades of major UK government and contractor data-security failures to argue the state has not earned the public’s trust to run a national digital ID that would hold biometrics and passport data.

Main themes:

• Systemic human error and poor cyber hygiene.
• Insecure contractor practices and weak regulatory/accountability responses.
• The danger of centralizing immutable biometric data.

Notable breaches and failures (technical details and impacts)

• Sheffield ANPR exposure (April 2020)

  • An exposed IP address leaked 8.6 million vehicle-movement records (number plates, timestamps, camera images including faces and bystanders) with no authentication.

• HMRC child benefit CDs (November 2007)

  • Two unencrypted CDs with 25 million records (names, DOBs, NI numbers, bank details) lost in internal mail. Bank details could have been removed, but the cost was judged too high.

• Ministry of Defence (September 2021 and five months later)

  • Emails sent using CC instead of BCC exposed 265 Afghan interpreters.
  • A leaked spreadsheet of 18,714 asylum applicants (including names of special forces/intelligence personnel) triggered an emergency resettlement cost of ≈ £850M.

• Police Service of Northern Ireland (August 2023)

  • FOI response spreadsheet contained a hidden tab with full details of 9,483 officers; data circulated to dissident groups, causing high relocation/compensation costs.

• Electoral Commission

  • Hackers were in systems for 14 months and accessed data on 40 million voters via known Microsoft Exchange vulnerabilities. Staff reused default passwords; the Commission failed its own Cyber Essentials test.

• Capita (March 2023 ransomware; later cloud leak)

  • 1 TB stolen affecting 6.6M people across 325 pension schemes.
  • Root cause: a single admin account with unrestricted access flagged in prior pentests but not fixed. ICO fined Capita (fine reduced). Later, benefits data was left in a public cloud bucket. Despite failures, Capita continued to win large government contracts.

• Local councils

  • Hackney (October 2020): breach via a dormant account using identical username/password; 440k files exfiltrated.
  • Leicester (March 2024): 3 TB stolen, including passport scans, driving licences and bank statements for up to 400k residents; a central-management compromise also affected city street lights.

• Transport for London (September 2024)

  • Breach affecting ~10M people; only two teenagers arrested; ICO cleared TfL.

• Age-verification / identity-verification firms

  • AU10Tix: admin credentials stolen by malware in Dec 2022, posted publicly Mar 2023, and remained active when found June 2024 — ~18 months of exposed access to ID documents. Used by TikTok/X, Uber, PayPal, LinkedIn.
  • Persona: front-end exposure revealed 269 verification checks, retention of government ID numbers, facial analytics and device fingerprints for up to 3 years. Discord dropped Persona.
  • ID Merit: left a database of over 1 billion identity records (names, addresses, DOBs, national IDs from 26 countries) publicly accessible without a password.

• gov.uk digital identity (gov.uk/1) — replacing the failed Verify system

  • Stores facial recognition data, passport scans and driving licences; reported 13M users.
  • Whistleblower reported ~500k vulnerabilities (10k+ critical); red-team tests found malware could be introduced without alerts.
  • As of late 2024, met only 21 of 39 required security standards.
  • Budget overruns: from £35M to £329M+; delivery pushed to 2028; broader scheme estimated at £1.8B.

Technologies and security issues highlighted

• Common failure modes

  • Unencrypted data and public cloud buckets with no authentication.
  • Reused or default passwords; dormant accounts with trivial credentials.
  • Excessive admin privileges and single points of administrative compromise.
  • Unpatched known vulnerabilities (e.g., Microsoft Exchange).
  • Mis-sent emails (CC vs BCC) and exposed front-ends.
  • Long retention policies for sensitive identifiers and biometrics.

• Centralization risk

  • Central biometric/passport repositories are high-value “honeypots.” Biometric data is immutable — once breached, it cannot be reset like a password.

• Regulatory and accountability failures

  • ICO often issues reprimands or reduced fines; contractors with poor track records continue to win contracts.
  • Structural incentives: failures are rarely punished and can be followed by new lucrative contracts.

• Data lifecycle concerns

  • Leaked government data flows into data-broker ecosystems, gets aggregated and sold, and fuels targeted scams (particularly harming vulnerable people such as elderly relatives).

Product/service mention (sponsor) — Incogn (data-broker removal service)

• Purpose

  • Contacts data brokers to remove personal data across hundreds of sites. Can handle links you provide (unlimited plan). Family plan supports up to 4 people (useful for protecting vulnerable relatives).

• Verification / claims

  • First data-removal service independently verified by Deote.

• Limitations

  • Not a cure-all: cannot undo historical government leaks, but is a practical mitigation to reduce presence in marketing and fraud databases.

• Promotional details (from the video)

  • Code: “fineprint” for 60% off an annual plan and a 30-day money-back guarantee.

Analysis and conclusions

• Historical pattern

  • The video argues the UK government’s record — lost discs, unpatched systems, spreadsheet mistakes and exposed contractor infrastructure — shows structural incompetence and perverse incentives.

• Risks of mandating digital ID / age assurance

  • Mandating age assurance or digital ID without strict security/privacy requirements or an approved provider register is dangerous; several verification providers have already leaked sensitive ID data.

• Biometric centralization

  • Centralizing biometric identities is inherently risky: when breached, biometrics cannot be reset.

• Public sentiment and activism

  • Public distrust is high (survey cited: 63% don’t trust the government with data).
  • Parliamentary petition nearly 3 million signatures illustrates public concern.

• Call to action

  • The video urges public awareness and information-sharing to create pressure for accountability and safer designs.

Named organizations, bodies, and companies referenced

• Government departments / agencies: HMRC, Ministry of Defence, Department for Work & Pensions, Home Office, Ministry of Justice, Government Digital Service (GDS), National Cyber Security Centre (NCSC), Electoral Commission, ICO (Information Commissioner’s Office), Public Accounts Committee.
• Private contractors / vendors: Capita, Fujitsu, AU10Tix, Persona, ID Merit.
• Others: Transport for London, Police Service of Northern Ireland, Hackney Council, Leicester City Council.
• Advocacy / reporting: BBC, Electronic Frontier Foundation (EFF), Big Brother Watch.

Main speaker and sources

• Main speaker: Andy (host of The Fine Print).
• Primary sources cited or quoted in the video: ICO, NCSC, whistleblower reports, BBC investigations, Public Accounts Committee, Electronic Frontier Foundation, and published incident reports involving the named companies and public bodies.

“Centralizing biometric identities is inherently risky — when breached, biometrics can’t be reset.”