It has emerged that senior HMRC staff knew of the 25 million person child benefit CD transfer method and had been involved in a previous transfer in March this year.
The National Audit Office (NAO) requested data to audit the Child Benefit part of the HMRC accounts in March this year. The NAO would contact HMRC's accounting function for this, which is headed by Stuart Cruikshank, the chief financial officer. He sits on ExCom, the HMRC board, which was headed by the now-departed Paul Gray.
Gray has been said to have resigned because of a single blunder by a junior official at HMRC's Washington, Tyne & Wear, office who sent the two CDs outside procedures. This is arrant nonsense.
HMRC's Washington office had previously sent two CDs in exactly the same way, via courier TNT which handles HMRC's bulk mail transfers, in March. The junior official was told what to do by his management. No wonder he is being kept anonymously in a local hotel because if he talked the responsibility throughout HMRC ranks would become apparent.
The NAO requested the child benefit data from HMRC in March. A nameless senior business manager responded and said they would have to have the full data; it would cost too much to have the HMRC's computer systems strip out the excess data. He copied a nameless assistant director on the comunication.
That computer system is managed by Deepak Singh, the HMRC's chief information officer. The systems are outsourced under an Aspire contract, run by CapGemini. It has recently announced the sacking of 600 of the employees on the contract because of a restructuring of the contract reflecting HMRC's need to save costs.
Naturally the Aspire operation would not strip out data from 25 million records for nothing.
So the NAO was told it would receive the full data by someone in Cruikshank's department who had been in contact with someone in Singh's department. Then a junior official in Washington was given, or already had, access to the requisite computer system and database, extracted the data from the database, burnt it to CD, stuck the two CDs in an office transfer envelope and dropped it in the mail tray for courier collection.
My understanding is that there is no special transfer service for special items akin to registered mail. My understanding is that this was known about by the managers that instructed the junior official.
The March CD transfer worked okay and the CDs arrived. The October transfer, six months later when the NAO wanted to repeat its child benefit account check, did not.
It is obvious from this that an assistant director and a senior business manager in Cruikshank's department knew about the CD transfer method and knew what was on the CD. It is also obvious that managers in Singh's IT function also knew about the details of the database access and the transfer method.
Estimating layers of management I would say at least four people, the senior business manager and assistant director in Cruikshank's department, and two layers of management in Singh's, knew about the transfer of 25 million people's identity information to the NAO and how it was done.
That is why Paul Gray resigned, because the HMRC was implicated in this transfer from bottom to top. He knew it; it was his job to run the HMRC ship and he had to go.
It was not because of a junior official's blunder. That blunder was no blunder; it was normal policy.
As Gray has gone, so should at least four other people in HMRC. I daresay they know it too, but if they did the honourable thing and fell on their swords then the problems in HMRC would become even more apparent and attention would be directed towards its creator, Gordon Brown.
His future depends upon a nameless junior official, kept in what is suspiciously like protective custody in an anonymous Tyne & Wear hotel, keeping his or her mouth shut.
Let's hope he or she does not.
More information has come to light. At least nine people, not four, at HMRC knew about the bulk database transfer. The computer system, a mainframe, was not operated by Aspire but by EDS. Lastly TNT does offer a registered mail service and this was used on the second and successful attempt in October to transfer two CD's worth of data to the NAO.