Appropriate sharing of industry information of incidents

[CapabilityB]

Seems like it keeps popping up, people sharing internal information that at the time shouldn't be being shared, and also should not even have been accessed by internal people as it is of no use to their role at the time, but they are rubbernecking.

I remember having to shutdown sharing of control logs internally following the Stonehaven incident given it was a serious ongoing incident which was of no relevance to the number of people taking an interest.

I think the approach suggested here should be considered.

https://www.theguardian.com/society...f-tiger-william-chapman-records-yvette-cooper

(Link to guardian article quoting government sources that suggest NHS staff who had no reason to access records to an incident should be sacked)

 

[speedy1]

Do you at acknowledge the difference between medical records and train incident details though? The two seem quite different

I think the approach suggested here should be considered.

Is there an argument behind that?

Actual rubbernecking for example causes unnecessary delays on the roads

 

[TUC]

There is a key difference between NHS medical records and control logs in that former relate to individual confidential patient information which are behind a secure system and should only be accessed for reasons genuinely related to that patient's care. I presume that control logs are also, as a matter of employment conditions, also expected to be trested confidentially, but they do not relate to individuals in the same way or have quite the same levels of security. That is not at all to justify the leaking of them, but they are different.

 

[Swedenorer]

It doesn't matter what the records are; there will in any large organisation there will be rules about who can access it and for what purpose. If there isn't then there is something wrong.

The person who leaked some cab video posted on here regarding the buffer collision would in some organisations I could mention be the focus of a detailed enquiry, I am 99% certain that they will have done something leading to instant dismissal if found.

Leaving aside any confidentiality concerns, I strongly suspect that such records would also be considered the property of your employer, and misuse again could be dealt with severely on those grounds.

 

[TUC]

In the NHS there will be a record of whose login accessed whose record at what time (which does make the public concern over the security of electronic patient records rather curious in that there is a lot clearer a trail than, for example, when any random member of staff could walk into a filing room and pull a paper record unnoticed).

 

[Swedenorer]

And they no doubt did. But organisations weren't daft either.

Back in the dark ages, we had a large office of a multinational computer firm near here. What their member of staff had neglected to remember when using one of their photocopiers to produce one of those joke things that used to circulate was that every platten was engraved with the firms initials and a code number and use of each was restricted to certain staff.

One rather blue edition of one of these got outside and within a few days so had a staff member. I'm old enough to remember when the Royal Mail would supply a company at a cost with stamps perforated with special codes to detect theft.

 

[Harpo]

The answer is very simple. If something has been placed in the public domain officially, it’s OK to share it.

Anything else is a leak and liable to breach the confidentiality agreement with your employer.

 

[Rab Smith]

It doesn't matter what the records are there will in any large organisation there will be rules about who can access it and for what purpose. If there isn't then there is something wrong. The person who leaked some cab video posted on here re the buffer collision would in some organisations I could mention be the focus of a detailed enquiry, 99% certain that they will have done something leading to instant dismissal if found. Leaving aside any confidentiality concerns I strongly suspect that such records would also be considered the property of your employer and misuse again could be dealt with severely on those grounds.

It's the first thing I thought of when I seen that in cab video, that has been leaked. I suspect there will already be questions being asked within their management.

In my Company, it is strictly forbidden to release any information contained in the incident control log and will lead to disciplinary proceedings.

 

[WillC]

Suspect the drivers are the same though - I wish to be the centre of attention, by knowing something others do not, and sharing this. It's a bit pathetic, but very human it seems. For medical records the position is very clear, and outcome becoming equally clear.

 

[GordonT]

I wonder if social media has contributed to the mania displayed by some to be the first or only person to post attention grabbing but wholly inappropriate visual and textual depictions of incidents with no regard for the feelings of those directly affected by the incidents or the need to respect confidentiality.

Typified by folk reaching for their phone to video a road accident rather than summoning or providing assistance, and without any concern for family members becoming aware of the event through their post on the socials.

 

[WillC]

I wonder if social media has contributed to the mania displayed by some to be the first or only person to post attention grabbing but wholly inappropriate visual and textual depictions of incidents with no regard for the feelings of those directly affected by the incidents or the need to respect confidentiality.

Totally. It's not just the ability to boast down the pub to 3 mates, it's the global attention mania. Invoke legal penalties a la NHS I say.

 

[Tetchytyke]

The more people you share something with, the more likely it is that someone will look at it when they’re not supposed to. The cab video is an example of that: it was seemingly placed on an industry system which could be accessed by thousands of people. Of course it will have been shared, and clearly someone shared it with someone who couldn’t be trusted, and now we are where we are.

It’s inevitable, even with the NHS rules people were seemingly accessing the medical records of the man who was mauled to death in the tiger enclosure a couple of weeks ago.

 

[WillC]

The different is that NHSE records can only be accessed by NHS staff, they cannot be shared externally, unless copied etc.

Videos are easy to copy and share.

 

[LowLevel]

Years ago I worked for the NHS and Civil Service. It was always made clear that inappropriate access to files would basically lead to dismissal and random checks occurred frequently where you had to submit the reason for access into the system.

You were never allowed to access your own or family records and were expected to disclose a conflict of interest and pass the work off to somebody else if a random encounter occurred.

On the railway I think the main culprits are probably enthusiasts who may struggle to differentiate their interest from a duty to their employer. The actual data may be different but it's not like it's whistleblowing - it's just feeding personal interest.

 

[styles]

NHS records are not quite comparable, as they have a special status in law. They are personal data, which brings them into scope of the Data Protection Act/GDPR. They are even "special category" data as it relates to a person's health, which attracts even further restrictions on processing than most personal data. The other big stories around inappropriate access of personal records tends to be around high-profile policing cases (e.g. the Wayne Couzens/Sarah Everard case). Criminal records data also has its own special status in data protection legislation, so not quite comparable.

There may be times when accessing or sharing incident data breaches data protection legislation, e.g. if it turns out the driver fell asleep at the wheel the day after having a medical with a sleep apnea disorder diagnosed, but often not.

It will breach employment contracts and/or internal IT, information services, or confidentiality policies, but short of proving an offence under the Computer Misuse Act or contempt of court if there's a criminal investigation ongoing, these are likely to just be dealt with by normal disciplinary procedures. They are not as severe, in law at least, as the NHS cases where people are invading privacy of individuals after having it drilled into them the rules around this.

For what it's worth, the Control Centre Incident Log system does log individual logins as well as records accessed, and there are warnings about this. There shouldn't really be much defence against an accusation of accessing such records without good reason, short of saying someone did it with your login (which would put you in breach of some other IT policy). Anyone should be able to explain their reasons for accessing a log, and if they can't then I think disciplinary action is fair game. I wouldn't suggest it's an immediately-sackable offence like accessing patient medical records, unless they can be proven to have leaked it, but some sort of disciplinary action, absolutely.

I also sometimes wonder how people find the time for this. When I've worked full-time employment I've usually been too busy for this sort of thing. I am in control of my own schedule these days, but 9-5 employment I can't imagine spending my time on something like that.

 

[Horizon22]

I presume that control logs are also, as a matter of employment conditions, also expected to be trested confidentially, but they do not relate to individuals in the same way or have quite the same levels of security. That is not at all to justify the leaking of them, but they are different.

There are plenty of quite clear warnings on the railway's main logging tool (CCIL) to say that it is a confidential and there are also watermarks - a relatively recent addition - to prevent screenshots being shared.

In terms of downloads that is much harder (i.e the Liverpool Street buffer collision) as there must have been hundreds of downloads, many to browsers which would be harder to track. Individual logs can, and have been, closed to specified users only before.

== Doublepost prevention - post automatically merged: Yesterday at 12:26 ==

For what it's worth, the Control Centre Incident Log system does log individual logins as well as records accessed, and there are warnings about this. There shouldn't really be much defence against an accusation of accessing such records without good reason, short of saying someone did it with your login (which would put you in breach of some other IT policy). Anyone should be able to explain their reasons for accessing a log, and if they can't then I think disciplinary action is fair game. I wouldn't suggest it's an immediately-sackable offence like accessing patient medical records, unless they can be proven to have leaked it, but some sort of disciplinary action, absolutely.

Yes and no. You can in theory look at any log across the entire country, which is completely innocent behaviour. As "railway rumour" spreads, then probably hundreds of people viewed the log who had no direct interest in it but were curious. That's very different from then leaking that content. I'm not sure there's an easy way of tightening this, without inadvertedly stopping lots of people who do need to know or would find it extermely useful as part of their day job what is happening as part of that log entry.

The problem is trying to police thousands of people - the overwhelmingly majority who wouldn't dare do something so stupid - to stop the one person who might leak it. But of course, one "bad egg" can ruin it for everyone!

 

[contrex]

And they no doubt did. But organisations weren't daft either. Back in the dark ages we had a large office of a multinational computer firm near here. What their member of staff had neglected to remember when using one of their photocopiers to produce one of those joke things that used to circulate was that every platten was engraved with the firms initials and a code number and use of each was restricted to certain staff. One rather blue edition of one of these got outside and within a few days so had a staff member. I'm old enough to remember when the Royal Mail would supply a company at a cost with stamps perforated with special codes to detect theft.

I believe it has been the practice in high level Civil Service and/or government circles to provide copies of very sensitive documents all slightly differently worded in various places and a record kept of who got which one.

 

[styles]

Yes and no. You can in theory look at any log across the entire country, which is completely innocent behaviour.

Sure, but this should still be easily justifiable?

As "railway rumour" spreads, then probably hundreds of people viewed the log who had no direct interest in it but were curious. That's very different from then leaking that content.

Indeed, which is why I recommend a different course of action based on whether there's proof somebody has actually leaked it or not. I wouldn't suggest sacking people for being nosy, but if it breaches whatever the current warning text says, it probably does warrant an informal warning that repeatedly doing this may land them in some hot bother so best not to.

 

[Horizon22]

Sure, but this should still be easily justifiable?

Indeed, which is why I recommend a different course of action based on whether there's proof somebody has actually leaked it or not. I wouldn't suggest sacking people for being nosy, but if it breaches whatever the current warning text says, it probably does warrant an informal warning that repeatedly doing this may land them in some hot bother so best not to.

Who do you think would be able to actually do all of this? Proving who the actual person was would be a nightmare. Not to mention you could have employees from maybe 15 different companies look into it, each with slight quirks to their disciplinary and IT policy and trying to get one company to raise an issue with an employee of another company is pretty difficult (and again, hard to prove). And where is the policy that says someone can't read it? And who is to say they didn't have justification for it?

What I would suggest is maybe a "splash" page after you log in with a generic warning that you have to click OK before proceeding.

 

[sharpener]

I believe it has been the practice in high level Civil Service and/or government circles to provide copies of very sensitive documents all slightly differently worded in various places and a record kept of who got which one.

I can remember a game used on a training course which relied on the team sharing information to solve the problem. The briefing documents were supposedly identical but relied on such differences. It was carefully edited so that line and paragraph breaks were in the same places.

On another occasion where there was a high likelihood that confidential information would be leaked I marked the individual copies of a memo so that if folded in a particular way it was obvious whose copy had been re-copied.

 

[styles]

Who do you think would be able to actually do all of this?

All of what? I'm not suggesting some mass monitoring operation across all the incidents in CCIL. But if internal details are leaked about a very high-profile case, inspection of the log views may be in order.

Proving who the actual person was would be a nightmare.

I've not suggested anybody needs to do any more than currently is being done to prove anything. Just saying that if you do come across evidence of somebody having leaked it, disciplinary action would be appropriate.

Not to mention you could have employees from maybe 15 different companies look into it, each with slight quirks to their disciplinary and IT policy and trying to get one company to raise an issue with an employee of another company is pretty difficult (and again, hard to prove). And where is the policy that says someone can't read it? And who is to say they didn't have justification for it?

See the warnings already in place. Not suggesting changing them or trying to harmonise company IT policies.

What I would suggest is maybe a "splash" page after you log in with a generic warning that you have to click OK before proceeding.

There's already warnings. Maybe an additional one would cut down on abuse, I dunno.

 

[Dr Hoo]

Who do you think would be able to actually do all of this? Proving who the actual person was would be a nightmare. Not to mention you could have employees from maybe 15 different companies look into it, each with slight quirks to their disciplinary and IT policy and trying to get one company to raise an issue with an employee of another company is pretty difficult (and again, hard to prove). And where is the policy that says someone can't read it? And who is to say they didn't have justification for it?

What I would suggest is maybe a "splash" page after you log in with a generic warning that you have to click OK before proceeding.

Presumably under GBR there should be a move towards a single set of information security and disciplinary policies. I get that non-GBR operators such as TfW and Freight would also still require access.

I’m rather surprised that in this day and age ‘any Tom, Dick or Harry’ can get to see everyone’s information. Even back around 1980 when freight customers could access the TOPS system in relation to their own wagons they couldn’t see anyone else’s. So for example Shell could see their own petroleum traffic but not Esso’s.

Why is it necessary for ScotRail staff to be able to ‘surf’ London Overground’s information and what Network Rail is doing at Liverpool Street during their lunch break?

 

[66701GBRF]

Why is it necessary for ScotRail staff to be able to ‘surf’ London Overground’s information and what Network Rail is doing at Liverpool Street during their lunch break?

It probably isn't necessary in that case but the system is set up so all operators have visibility of incidents across the network just in case it does effect them. And by "effect" it could quite simply be as basic as a few minutes of service delay. It would be an impossible task for the system admin to know everything that will or won't affect every company.

 

[35B]

Logging systems for access to materials are old hat, and where they're actively used, staff are very cautious about looking at anything "unofficially". I was once in a meeting where we were being shown a database for the purpose of understanding how it was used, with the data subject present and freely granting permission, and the session was kept to no more than a couple of minutes because the clerk whose session was being used for the purpose risked having to go through an investigation simply because of the behaviour pattern.

It's clear from this incident, and recent NHS accounts, that the logging is much less exhaustive, and therefore that what is considered "reasonable" is much wider. While exemplary discipline may be valid, and set a useful precedent*, the real challenge is to change the culture towards something more like the organisation I visited.

 

[Horizon22]

All of what? I'm not suggesting some mass monitoring operation across all the incidents in CCIL. But if internal details are leaked about a very high-profile case, inspection of the log views may be in order.

I've not suggested anybody needs to do any more than currently is being done to prove anything. Just saying that if you do come across evidence of somebody having leaked it, disciplinary action would be appropriate.

See the warnings already in place. Not suggesting changing them or trying to harmonise company IT policies.

There's already warnings. Maybe an additional one would cut down on abuse, I dunno.

I checked today and actually there was a surprising lack of warnings.