[sims] Urgent Capita SIMS Data Issue - Issued by childrens services

[enjay]

Remember some of the "errors" in Check 99 might be genuine. Ours picked up a duplicate address which was actually a younger sibling of an existing student and the family have moved house without telling us!

[Banjo]

I don't think we are affected, but can someone check my logic please?

 

• 24 Jan 2018 - Autumn release applied
  
• 12 Jul 2018 - Summer release applied
  
• There is no record in SOLUS3 of patch 22527 being applied.
  

Between the above dates, we had no CTF files imported (looking at Routines > Data In > CTF > View Import History Log) , therefore no contacts should have been adversely affected by the CTF import problem. Am I correct?

 

However, diagnostic check 99 has come back with 46 "Possible contact link issues" and one "no current address". I'm guessing these could be general contact issues in the database that are not necessarily related to the CTF bug.

 

I'd welcome other opinions

 

The issue has been around since mid 2017. I would check your CTF log a little further back.

[DrCheese]

Remember some of the "errors" in Check 99 might be genuine. Ours picked up a duplicate address which was actually a younger sibling of an existing student and the family have moved house without telling us!

 

Some of ours are where we've had a student leave & then a few years later their sister/brother starts and they've moved house in between, so it's flagging up. Others are because the contact has been listed as contact 3/4 before for other students (which we don't take addresses for, only phone numbers) & now have their own kids here, so we take full details, which means it's being flagged as "no previous address"

[matt40k]

why anyone buys SIMS is beyond me

 

Short term it's easier. Applying a patch getting the office staff to do some data checking is lot easier then migrating. The problem is, its only going to get worse.

[limawhiskey]

The issue has been around since mid 2017. I would check your CTF log a little further back.

 

We definitely have CTF imports that were done just prior; towards the end of the 2016/17 academic year and at the start of 2017/18.

 

All the sources I have seen imply that the bug came in with the Autumn upgrade; the Capita guidance states:

potentially affected CTF imports includes those run between SIMS 2017 Autumn Release (from May 2017 with patch 22527) and the deployment of [spring / Summer 2018 workstation patch 1]

 

So @Banjo see what you are saying but I don't believe we have applied patch 22527.

 

Does anyone know how can I check which patches have been applied for certain?

Confusingly, "Workstation Patch 1" is not even visible for me in SOLUS3 unless I select "Show all updates". What's more, the release date conflicts with Capita's guidance. I do have "Consolidated Workstation Patch 1" but that doesn't even tie in properly with Capita's information as it was released to us on 16 August.

 

I'm with everyone that thinks Capita have handled this appallingly - I have read so many conflicting bits of advice since the CTF issue came up that I'm struggling to understand the truth of the matter!

[newpersn]

How did you fix the "Possible Contact Link Issues". I only got one.

[Banjo]

You can open up SSMS and run this code to pull off the patches applied. Bold is your DB name that you may need to change

 

SELECT TOP (1000) [update_log_id]

,[patch_id]

,[update_id]

,[successful]

,[description]

,[update_type]

,[date_applied]

,[error_description]

FROM [SIMS].[sims].[db_update_log] order by date_applied desc

Edited September 10, 2018 by Banjo

[ir0n_jaw]

Hi all, long time lurker here.

 

Quick straw poll on this issue: Out of those schools affected, how many of your school or MAT leadership teams are aware genuinely tracking this issue? Also, how many of your organisations (where affected) are treating this as a proper data breach?

 

I'm the IT Director for a large MAT and am intending to illustrate to our Board just how significant this issue is and the resulting action has been. I get the feeling reading this thread (unless I'm reading it wrong), that most schools are resigned to taking it on the chin and simply fixing any errors as opposed to taking significant action. In my view, this is a substantial failing by a major data processor and the way they've handled the issue is pretty appalling.

 

Keen on finding out what your situation is.

[DODICT]

agreed - my opinion of the company and the product were already low so the delivery is about par for my expectations. I'll be doing a MIS review shortly which was instigated by the poor product rather than the shockingly bad handling of a significant bug they introduced. There is a reason why MATs are moving away - as soon as someone strategic that has the understanding and the authority they realise the product inst cutting it and is very uncompetitively priced in the current market.

[DODICT]

the first communication about it was under an sales pitch for options and talked about a CTF import problem not the significant risk of a data breach, oh and its been this way for months despite schools logging the issues with support and being given entirely inappropriate workarounds. My full understanding of the issues only came when speaking to SchoolsICT not from the 'enhanced' support some of our schools get from capita.

[ir0n_jaw]

the first communication about it was under an sales pitch for options and talked about a CTF import problem not the significant risk of a data breach, oh and its been this way for months despite schools logging the issues with support and being given entirely inappropriate workarounds. My full understanding of the issues only came when speaking to SchoolsICT not from the 'enhanced' support some of our schools get from capita.

 

My experience mirrors yours. Only now where I have a fuller picture, do I see the significance of it and I'm horrified at how long its taken to get some action. Just one of our schools has 1200 affected records where the Data Manager will have to manually compare paper records to SIMS ones. Even then, where the students have left the school, we're left with incorrect records that will be difficult if impossible to correct.

 

It's a total mess.

[limawhiskey]

You can open up SSMS and run this code ...

Thanks, that was really useful and helped me confirm that we had not applied patch 22527.

 

So unless the Capita advice changes we appear to have been lucky enough that our data manager stopped importing CTFs at the right time.

[TwistedHelixis]

Just had a thought in regards to the Capita 'it's not our data so it's the schools that are not GDPR compliant' statement.

 

If I accessed another schools Sims system and changed a few email addresses without anyone at that school realising, who is to blame? Would it be the school that had no idea or my fault as I changed the data.

[ir0n_jaw]

Just had a thought in regards to the Capita 'it's not our data so it's the schools that are not GDPR compliant' statement.

 

If I accessed another schools Sims system and changed a few email addresses without anyone at that school realising, who is to blame? Would it be the school that had no idea or my fault as I changed the data.

 

I think it would be the school's responsibility to make sure that Capita only operated under their instructions. Therefore, allowing them to connect whenever they want without adequate checks in place would be the school's failing. Regardless, they are not currently demonstrating themselves as a fit and proper data processor - so we need to hold them to account IMO.

[enjay]

If I accessed another schools Sims system and changed a few email addresses without anyone at that school realising, who is to blame? Would it be the school that had no idea or my fault as I changed the data.

 

I think that depends on how you accessed my SIMS system to make those changes. If you did it because my firewall passwords were all the factory default and I had an admin password of "changeme", I think it would be my fault. If you carried out a hack GCHQ would be proud of, it would be on you.

 

That isn't the situation here though. What we have here is Capita releasing a bugged update, identifying the bug, quietly fixing it then denying responsibility for any problems caused by the bug. If you want a non-IT analogy, it is similar to the water company identifying a leaking pipe but denying responsibility for the puddle in the road.

[pete]

Just had a thought in regards to the Capita 'it's not our data so it's the schools that are not GDPR compliant' statement.

 

If I accessed another schools Sims system and changed a few email addresses without anyone at that school realising, who is to blame? Would it be the school that had no idea or my fault as I changed the data.

 

It would be both of you.

 

You would be charged with unauthorised access to a computer system.

 

The school would likely end up in special measures (failed safeguarding) for their inability to protect student data. There could be ICO fines on top of that too.

[Quatermass]

I had to use my account to agree to the "We checked so it isn't Capita's fault" disclaimer (which proceeds to record your username as the one getting rid of the message, Capita is really keen to distance themselves from any responsibility surrounding this).

 

Do you know where it records this username?

[CAM]

Do you know where it records this username?

 

Nope. It just says your username will be recorded when clicking Accept.

[Ditto]

I need to go back to the start of the thread to refresh my mind with the original problem, but my question is: as a non-SIMS school, but one that has received a significant number of CTFs from other schools that use SIMS, is there anything I can look out for to indicate the sending school has been impacted. If yes, what impact does it have on us - what should I be notifying the DPO?

[DODICT]

I need to go back to the start of the thread to refresh my mind with the original problem, but my question is: as a non-SIMS school, but one that has received a significant number of CTFs from other schools that use SIMS, is there anything I can look out for to indicate the sending school has been impacted. If yes, what impact does it have on us - what should I be notifying the DPO?

 

I'd suggest you just need to ensure you verify the contact details at the soonest opportunity. While you are not responsible for the erroneous info, Neither are Capita in their view?! , you still have an obligation to make your incoming students aware the info you hold and give them the opportunity to correct it. Especially when you know there are question marks over its validity.

 

I know many schools that haven't imported contacts from admissions anyway due to inaccurate info so its a process thats manageable - the school just needs to make a judgement call on whether to use the contact info at all in the interim.

[enjay]

As @DODICT says, you need to verify the contact details yourself, but you were probably going to do that anyway.

 

One small silver lining is the CTFs from your feeder schools are unlikely to be affected. The issue would only affect one of your new students if they have moved schools for Year 6, if they've been in the feeder school longer than that, their data won't be affected.

[DODICT]

As @DODICT says, you need to verify the contact details yourself, but you were probably going to do that anyway.

 

One small silver lining is the CTFs from your feeder schools are unlikely to be affected. The issue would only affect one of your new students if they have moved schools for Year 6, if they've been in the feeder school longer than that, their data won't be affected.

 

They could ! as the CTF issue is updating contacts for erroneous students even if these students have stayed put. Other students CTF files being imported could have corrupted the outgoing year 6's even if they have been there for 6+ years.

 

Has Capita's comprehensive explanation of the issues and risks not made it clear to everyone yet ? ? !

[enjay]

They could ! as the CTF issue is updating contacts for erroneous students even if these students have stayed put. Other students CTF files being imported could have corrupted the outgoing year 6's even if they have been there for 6+ years.

 

Indeed. Ignore me and listen to @DODICT

[vikpaw]

@vikpaw - the guidance seems to have been updated:

 

SIMS 7 - CTF Issue

 

How to Identify and Correct Data Impacted by the CTF Import Incident [PDF]

Thank you for this @limawhiskey - updated now. Apologies for the delay.

[limawhiskey]

Do you know where it records this username?

I don't know if it's recorded elsewhere, but you can find it in your SIMS database in the db_update_log table by reading the row for patch 24229.

 

SQL query - you may need to update the SIMS database name (in italics) to match yours:

SELECT [error_description]  FROM [[i]sims[/i]].[sims].[db_update_log]  WHERE patch_id = 24229