Almost 100 HMRC staff disciplined over computer misuse, FOI reveals

Staff dismissed over misuse of emails, computer equipment and social media


HMRC has issued 92 disciplinary notices to members of staff as a result of computer misuse over the last two years, according to data released as part of a Freedom of Information request.

Covering the years 2017-18 and 2018-19, the results of a Parliament Street think tank (FOI) request showed that the number of disciplinary actions had increased with time, with the most common offence being that of "misuse of email".

Figures specifically detailed the number of first warnings, final warnings and dismissals given to employees relating to misuse of email, computer equipment, telecommunications, social media and other internet services.

The offence that led to the most dismissals was the misuse of computer equipment, resulting in eight dismissals in 17-18 and between one and five in 18-19.

Where results amounted to less than five, the exact figure wasn't issued due to fears that the individual may be identified, an eventuality that could breach GDPR and therefore ommitted under section 40(2) of the Freedom of Information Act 2000.

The most common offence committed over the two financial years was 'misuse of email', resulting in 25 written warnings, including both first and final, being issued by the UK's tax collector to its employees.

There was a sharp rise in social media offences in 18-19, leading to nine written warnings compared to zero in the previous year.

What constitutes "misuse" isn't clearly defined in HMRC's reply to the FOI request, nor is it clear what the specific offences were to warrant each type of disciplinary action.

What's encouraging is that in nearly all areas, except for social media, the number of disciplined offences appeared to decrease or stay the same which indicates that employees might be becoming more aware of how their actions could lead to damaging data breaches.

"Tackling employee misuse of IT systems should be a top priority for all public sector organisations, particularly those which handle the financial data of millions of people," said Christy Wyatt, CEO at Absolute Software.

"This kind of activity often involves individuals abusing access to personal information and in some cases sharing it, leading to a potential data breach. Organisations like HMRC need to adopt an enterprise resilience mindset not only around potential bad employee behaviour, but fortifying their overall security posture and risk management profile."

It also appears that HMRC doesn't have to issue warnings before ordering the dismissal of staff. Taken from the 17-18 figures, the number of written first warnings given to staff was less than the number of issued dismissals for the same offence in the same year.

According to a 2017 report, 74% of enterprise cyber security incidents can be attributed to insider threats such as employees, so having a robust disciplinary framework for public sector IT misuse is in HMRC's best interests.

The threat of data incidents from rogue employees is still as high today as it was in 2017. A report from Deep Secure indicated that more than half of UK employees would be willing to steal and sell company data on to third-parties. A quarter of respondents said they could be swayed for as little as 1,000.

Featured Resources

2021 Thales access management index: Global edition

The challenges of trusted access in a cloud-first world

Free download

Transforming higher education for the digital era

The future is yours

Free download

Building a cloud-native, hybrid-multi cloud infrastructure

Get ready for hybrid-multi cloud databases, AI, and machine learning workloads

Free download

The next biggest shopping destination is the cloud

Know why retail businesses must move to the cloud

Free Download

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Veritas Backup Exec 21.3 review: Covers every angle
backup software

Veritas Backup Exec 21.3 review: Covers every angle

14 Oct 2021
HPE wins networking contract with Birmingham 2022 Commonwealth Games
Network & Internet

HPE wins networking contract with Birmingham 2022 Commonwealth Games

15 Oct 2021