Almost 100 HMRC staff disciplined over computer misuse, FOI reveals

HMRC has issued 92 disciplinary notices to members of staff as a result of computer misuse over the last two years, according to data released as part of a Freedom of Information request.

Covering the years 2017-18 and 2018-19, the results of a Parliament Street think tank (FOI) request showed that the number of disciplinary actions had increased with time, with the most common offence being that of "misuse of email".

Figures specifically detailed the number of first warnings, final warnings and dismissals given to employees relating to misuse of email, computer equipment, telecommunications, social media and other internet services.

The offence that led to the most dismissals was the misuse of computer equipment, resulting in eight dismissals in 17-18 and between one and five in 18-19.

Where results amounted to less than five, the exact figure wasn't issued due to fears that the individual may be identified, an eventuality that could breach GDPR and therefore ommitted under section 40(2) of the Freedom of Information Act 2000.

The most common offence committed over the two financial years was 'misuse of email', resulting in 25 written warnings, including both first and final, being issued by the UK's tax collector to its employees.

There was a sharp rise in social media offences in 18-19, leading to nine written warnings compared to zero in the previous year.

What constitutes "misuse" isn't clearly defined in HMRC's reply to the FOI request, nor is it clear what the specific offences were to warrant each type of disciplinary action.

What's encouraging is that in nearly all areas, except for social media, the number of disciplined offences appeared to decrease or stay the same which indicates that employees might be becoming more aware of how their actions could lead to damaging data breaches.

"Tackling employee misuse of IT systems should be a top priority for all public sector organisations, particularly those which handle the financial data of millions of people," said Christy Wyatt, CEO at Absolute Software.

"This kind of activity often involves individuals abusing access to personal information and in some cases sharing it, leading to a potential data breach. Organisations like HMRC need to adopt an enterprise resilience mindset not only around potential bad employee behaviour, but fortifying their overall security posture and risk management profile."

It also appears that HMRC doesn't have to issue warnings before ordering the dismissal of staff. Taken from the 17-18 figures, the number of written first warnings given to staff was less than the number of issued dismissals for the same offence in the same year.

According to a 2017 report, 74% of enterprise cyber security incidents can be attributed to insider threats such as employees, so having a robust disciplinary framework for public sector IT misuse is in HMRC's best interests.

The threat of data incidents from rogue employees is still as high today as it was in 2017. A report from Deep Secure indicated that more than half of UK employees would be willing to steal and sell company data on to third-parties. A quarter of respondents said they could be swayed for as little as 1,000.