RiskUKOctober2017

News Update
Biometrics Commissioner’s third
Annual Report scrutinised by Big
Brother Watch
The 2016 report of the Commissioner for the
Retention and Use of Biometric Material was
submitted to Home Secretary Amber Rudd on
14 March this year and has now been
published for public consumption.
The role of the Biometrics Commissioner
was established by the Protection of Freedoms
Act (PoFA) 2012, with Paul Wiles appointed as
the second Commissioner on 1 June 2016.
Wiles’ role is to provide independent oversight
of the regime which was established by the
PoFA – and which came into force on 31
October 2013 – to govern the retention and
use by the police in England and Wales of DNA
samples, DNA profiles and fingerprints.
In addition to casework responsibilities in
relation to DNA and fingerprints, Wiles also
has a UK-wide oversight function as regards
their retention and use by the police service
on national security grounds.
Stretching to no fewer than 125 pages, the
detailed 2016 report deals primarily with
developments since the publication of the
Commissioner’s 2015 report. In essence, it
covers Wiles’ casework activities, the general
operation of the PoFA regime and a variety of
issues that have arisen in connection with its
operation in both the normal policing and
national security spheres.
In response to the report, Renate Samson
(CEO of Big Brother Watch) said: “We welcome
the Biometric Commissioner’s warnings and
concerns about the ongoing creation and
retention of facial biometrics and facial
recognition technology by police forces across
the country. It’s of very serious concern that
the Home Office appears to be so
unwaveringly set on embedding facial
biometric recognition technology into policing
without debate, regulation, legislation or
independent scrutiny.”
Samson continued: “Rather than throwing
millions of pounds at the building of such
intrusive capabilities, the Home Office should
be investing in updating police IT systems to
ensure that the hundreds of thousands of
innocent people’s custody images and facial
biometrics are deleted automatically as soon
as they’re released without charge, bringing
them into line with DNA and fingerprints.”
Professor Paul Wiles has spent much of his
career as an academic criminologist at a
number of UK universities and is currently a
governor at Sheffield Hallam University as well
as a trustee of the National Centre for Social
Research. Until 2015, Wiles served as an
advisor to the Sentencing Council and has also
worked as a local Government commissioner.
“Untrained and neglected IT staff
increasing cyber security skills
gap” warns (ISC)²
A survey of 3,300 IT professionals conducted
by (ISC)² has revealed that widespread
underfunding in training in-house IT talent is
contributing towards the critical cyber security
skills gap. The report shows that businesses
are exposing themselves to cyber threats by
ignoring and neglecting IT professionals, with
65% of IT workers reporting that their security
advice isn’t followed.
Almost half of IT workers state that their
firms don’t invest sufficiently in ensuring that
their IT staff are security-trained, despite a
shortage of cyber security workers across 63%
of businesses. This indicates that the cyber
skills deficit is rooted in businesses failing to
listen to advice from IT staff and upskill inhouse
talent.
The report suggests that this is a leadership
issue, with 49% of respondents accusing
business leaders of a failure to understand
cyber security requirements. According to the
report, the end result is that the majority of
companies are even less able to cope with a
cyber attack than they were last year.
In February this year, (ISC)² suggested that
the cyber security skills gap will grow to 1.8
million by 2022 if current hiring and training
trends continue.
The latest research is based on responses
given by practising IT professionals from
around the world who participated in the 2017
Global Information Security Workforce Study.
Key findings from surveyed IT professionals
include the following: 43% said their
organisation doesn’t provide adequate
resources for security training, only 35%
agreed that their security suggestions are
acted upon, 55% stated their organisation
doesn’t require IT staff to earn a security
certification and 63% said their organisation
has too few security-focused workers.
“Our findings suggest that too many
organisations are so fixated on their inability
to attract top cyber security expertise that
they often overlook a tremendous pool of
talent already on staff and intimately familiar
with their infrastructure and processes,” said
(ISC)² CEO David Shearer CISSP. “The quickest
way for many organisations to protect
themselves against cyber threats is through
continuous education and empowerment of
their IT team’s constituent members.”
7
www.risk-uk.com