People gather outside Buckingham Palace shortly before the queen’s death (Image: Samir Hussein/WireImage)
People gather outside Buckingham Palace shortly before the queen’s death (Image: Samir Hussein/WireImage)

SocietySeptember 9, 2022

London on the night the Queen died

People gather outside Buckingham Palace shortly before the queen’s death (Image: Samir Hussein/WireImage)
People gather outside Buckingham Palace shortly before the queen’s death (Image: Samir Hussein/WireImage)

Few tears, many smartphones. Henry Cooke reports from Buckingham Palace.

I thought she was going to make it. 

My office in central London was not quite sure what to make of the news, released early on Thursday afternoon (or in the middle of the night in New Zealand), that Queen Elizabeth II was on “medical alert”. Some thought it must be over; others like me knew she would have the best healthcare in the world – surely this was the beginning of the end, the start of a long battle, not the end itself? The Queen had started her reign when Winston Churchill was prime minister, surely she wouldn’t slip away just 48 hours after inviting her 15th PM to form a government?

My workplace didn’t quite stop – we still had meetings, wrote emails, made phone calls. The commercial radio station we have on didn’t stop playing music or having ad breaks. The myth that we would all get a week of bank holidays if she did die was soon debunked. Rumours went everywhere – a particularly strong one stated we would get some kind of statement at around 5pm, but 5pm came and went. I figured if she had died already, there was no way it wouldn’t have leaked by this point.

But then the skies darkened and the rain started bucketing down. It started to feel a lot more real. About an hour later, minutes ahead of the BBC stream I was watching, the tweet came through confirming her death. 

I opened the window to look up and down the Soho street where I work. The 70-year reign was over, but nothing seemed to have changed. People standing around outside pubs started gesturing at their phones, exclaiming, showing their phones to their friends, but otherwise continuing to have a good time. 

Her Majesty Queen Elizabeth II as she is introduced to officials at the Catherdral Of St Paul in Wellington on her last visit to New Zealand in 2002 (Photo by Ross Land/Getty Images)

It’s not every day you are in the centre of a monarchy when its longest reigning ruler dies, so I finished my work and headed down to Buckingham Palace, where crowds were gathering to see the official notice put out on the railing. The new king was not there – indeed from what I can tell the entire royal family was 800km north in Balmoral. But this was the natural place for Londoners to come to mourn.

Was it mourning? There wasn’t much crying. Maybe the tears will come later, unleashed by the ceremony of the funeral in a week or so. Then again, publicly crying is not particularly British – this isn’t some tinpot dictatorship where you need to show public fealty to the regime.

Instead, as I got closer to the palace I mostly saw people doing what all modern people do when interesting historic things happen – taking photos or videos on their smartphones. Piccadilly Circus had a huge wraparound image of the Queen already up, which people dutifully took selfies in front of.

In front of the palace itself people amassed on the Queen Victoria statue to get a good view of the palace, with the union jack at half-mast. The wind wasn’t really playing ball, so whenever it did pick up, tens of phones were raised in unison. One side of the Memorial Gardens was crowded by legions of TV journalists, all standing under identical white gazebos and well-separated from the public. 

I couldn’t see anyone crying, although there were solemn faces. People stayed close to the gates, putting down bouquets of flowers and taking endless photos, leading one man to yell “once you’ve taken your 10 photos can you please move on?” Folks shared beers from the handy M&S. Instead of grief, many of the conversations I heard concerned logistics: Wasn’t it amazing how all the media had cut into everything? Wasn’t it wild how air traffic control was keeping the skies clear (I’m not sure if this one was true). Wasn’t it interesting how early King Charles had decided on his official name? I myself couldn’t help but think of politics: Tony Blair had cemented his prime ministership with his reaction to Princess Diana’s death, coining the phrase the “people’s princess”. Would this be a similar moment for Liz Truss?

‘Become a member and help us keep local, independent journalism thriving.’
Alice Neville
— Deputy editor

One man started a rousing rendition of God Save The Queen, to much applause and a bit of eventual attention from the news cameras. He started again once he had finished, presumably for the benefit of the cameras, and got the same applause. Another man yelled “God Save The King!” to absolutely zero response. A separate man screamed the first line of God Save The Queen, and then complained “no takers for the second verse?” as no one joined him. 

Away from London the country as a whole moved into a state of sustained ceremony. Long-planned strikes were cancelled. The idea of politics – at the picket line or in Westminster – shrunk away into insignificance, at least for a while. 

Queen Elizabeth II. Photo: Buckingham Palace

The rain got heavier so I put on the BBC and started to walk home. Emotion struck me quite unexpectedly as the BBC played clips of Elizabeth as a child recording a message for children evacuated from London, then for lonely Brits during lockdown. I suppose it is the single unwavering purpose of the BBC to make you sad when the Queen dies, but it worked. Away from the crowds and flowers and selfie sticks I felt close to tears myself. 

The lack of power Elizabeth II had was probably her institution’s greatest strength. It’s much easier to accept a hereditary monarchy when the power they hold is all on paper. No one blamed the Queen for the slow sense of decline that set in here after World War II, for the Suez Crisis, or for how high energy bills are. Instead she was vested with symbolic qualities above parliamentary politics: Humility, compassion, fantastic manners. The prime ministers who have served under her do appear to have valued her counsel – which is fair enough given she would have read more civil service papers than any other human alive after her first two or three prime ministers. 

Of course this is not a service her 16 prime ministers in New Zealand got to make much use of. The idea of Jacinda Ardern asking the Queen’s representative in New Zealand for counsel is absurd, and she could hardly text her majesty. Some will use this moment to push for New Zealand to pull out of this system and embrace a republican future, but as ever I doubt our political class will ever really be bothered. It’s hard to defend our setup on a symbolic level, but on a logistical level it’s got serious advantages over the messy process of setting something else up.

The BBC worked its magic, but I didn’t quite cry. As I got further from the palace, London felt more and more normal. A homeless man outside Green Park station pleaded in increasingly agitated tones for help, and almost everyone kept on walking, eager to get out of the rain.

Keep going!
He Puna Taimoana hot pools in New Brighton, Christchurch (Design: Tina Tiller)
He Puna Taimoana hot pools in New Brighton, Christchurch (Design: Tina Tiller)

OPINIONSocietySeptember 9, 2022

No, the Christchurch hot pools weren’t ‘hacked’ – the council just messed up

He Puna Taimoana hot pools in New Brighton, Christchurch (Design: Tina Tiller)
He Puna Taimoana hot pools in New Brighton, Christchurch (Design: Tina Tiller)

It’s much easier to claim you’ve been hacked than to ‘fess up to failing to protect customer data, writes Dylan Reeve.

If there’s one important thing to know about modern computing, it’s probably this: security is hard.

In some ways internet security is easier now than it’s ever been – we have built-in antivirus; our home internet connections are usually pretty safely firewalled; most of the big websites we use have entire departments filled with well-trained geeks keeping things secure.

But also we’re in a time where everything is online. Hell, some car companies are using our ubiquitous always-online reality to turn things like heated seats into monthly subscriptions.

While getting stuff on to the internet is easier now than ever before, it’s also, therefore, easier to screw that up somehow. And that appears to be what happened to Christchurch City Council’s He Puna Taimoana hot pools.

The Stuff article about this issue, headlined ‘Computer hacker steals sensitive information from 20,000 Christchurch hot pools customers’, illustrates how the facts can be obfuscated when information security is covered those who – through no fault of their own – lack the specialist knowledge to fully understand what’s going on.

A better headline for their article would have been ‘Christchurch City Council organisation leaves sensitive information from 20,000 customers unprotected online’.

Obligatory hacking stock photograph

I’ve written before about organisations crying “hacking” when they make mistakes that see their information shared more widely than they intended, and headlines about this latest situation, based on public statements from the council, did just that.

For some reason, it would appear the council-owned pools had been using a system that puts important files in “the cloud” – the nebulous term we use for stuff we store on the internet in a way we don’t really understand – and due to, presumably, some type of configuration error, more than 20,000 files (some containing sensitive personal information like passport details) were accessible to anyone who knew, or could figure out, where to look.

Why, exactly, was a council swimming pool storing sensitive personal data about their customers? Well it’s not immediately clear exactly what data was being stored online, but being a council facility, the complex offers discounted rates to local residents, for which proof of address and identity may be required. Part of this process can be completed online through the pool’s website, and requires the submission of a “proof of address”.

We live in a world of digital technology, and cheap storage, so it is often easy for organisations, when designing systems like this, to simply say, “oh, we’ll just store it all in case we need it later”. So, rather than just sighting the records in question, they’ll take a copy and hold on to them in case they want to double check later. Under New Zealand privacy law, organisations are only allowed to collect information they need for a lawful purpose, and they have an obligation to protect the information they collect. But many don’t think about whether they need to actually store all that they collect beyond the very moment it’s needed.

Spoiler: this data wasn’t ‘hacked’ either

In general, storing stuff online is easy and cheap now. You can signup for an account with Microsoft Azure, Amazon Web Services or Google Cloud in just minutes, and there are countless ways to integrate existing software tools with those services. This ease of setup is also an ease of screw-up, however, and it’s simple to make a configuration mistake that might open your data to anyone who stumbles upon it.

But we also live in a time where irresponsibly handling customer data is frowned upon so, like many before them, the council decided to frame their mistake in this instance as the malicious action of someone else.

The Stuff article about the incident describes the event as “hacking” which is certainly how the council would like the situation understood, and says, in the opening paragraph, “information about as many as 20,000 members of the public has been stolen in a data breach”.

But a detailed post from US data breach news website, DataBreaches.net, which first notified the council about the issue, describes the situation very differently, explaining that a researcher had stumbled upon the unsecured “blob” (a general file storage container) on Microsoft’s Azure cloud service and attempted to notify the council without response before reaching out to DataBreaches.

In this instance the council had been relying on “security by obscurity”, essentially the idea that something is secure just by being hard to find – sort of like putting your life savings under a mattress, instead of a safe, on the grounds that no one is likely to look there.

Unfortunately for the council (and literally tens of thousands of other organisations worldwide which have made the same mistake), the contents of their unsecured storage had been discovered and indexed by at least some specialist search engines online that are used by both white hat (ethical) and black hat (criminal) hackers for research and exploitation.

The initial researcher, and subsequently DataBreaches, downloaded only enough data from the cloud service to understand what was stored there and by whom, and then made good faith efforts to contact those responsible for the issue so they could correct it.

However in his email to affected customers, Christchurch City Council head of sport and recreation, Nigel Cox, said that a third party, which he accurately described as a “white-hat hacker” had “accessed and illegally downloaded files stored on the He Puna Taimoana cloud server”, suggesting a level of illicit activity that simply wasn’t present, and also subtly avoiding the question of the council’s culpability for failing to secure the data.

The article about the issue from DataBreaches concludes with this summary:

The council should have disclosed this incident by saying, “We screwed up and didn’t lock down all the files we had with your personal information. We’re sorry for that and embarrassed. Thankfully, a kind and ethical researcher discovered our mistake, and when they couldn’t reach us to alert us, they asked a journalist they trusted to make the notification. The researcher and their employer destroyed all the data they had downloaded.”

Organisations of all sizes need to take the time to understand the implications of the technologies they’re relying on, and when they (almost inevitably) screw something up, they should be up front with their customers and the public about what happened. Similarly, journalists who are covering the complex world of IT and information security should take the time to check with subject matter experts before taking an organisation’s word for it that they were “hacked” – because most of them would much prefer that framing over “screwed up”.