The government must be quietly grateful to the distractions of August. Only Computer Weekly noticed that nine local authority workers have been sacked for accessing the personal records of celebrities, and their acquaintances held on the core database of the government's ID scheme.

This is a significant story because government ministers have always dismissed campaigners' claims that once all personal information is stored in a single database it will become vulnerable to abuse by those with access to the system. Ministers have repeatedly insisted that security will be absolute and that severe penalties will deter anyone tempted to read files illegally.

Not true. The magazine's website reported that the nine fired were among 34 people who illegally accessed information. Some were reprimanded, some resigned and some were sacked but none was prosecuted. Using a freedom of information request, Computer Weekly found that Cardiff and Glasgow Councils sacked people who had looked up celebrities in the customer information system (CIS) which is run by the Department of Work and Pensions (DWP) and contains 90 million records. Various other councils sacked people for looking up their friends, their own details and in one instance, a girlfriends.

The really important point is that these cases come from sample checks, this raises the prospect that the security of CIS is in fact much more regularly breached. "Over 200,000 government officials have access to the database," says the website, "including 480 local authorities, and numerous government departments, including the Department of Work and Pensions, HM Revenue & Customs, and the Courts Service. The Child Support Agency uses the CIS to trace missing parents."

A DWP spokesman suggested that the small number of breaches recorded indicated that unauthorised access by officials was spotted quickly. He did not, of course, acknowledge that these cases came from sample checks generated by the system.

This is absolutely critical. For years Professor Ross Anderson of Cambridge university and NO2ID have been arguing that by their nature large databases will never be free of such abuse. Anderson's Rule means you cannot construct a database with scale, functionality and security because if you design a large system for ease of access it becomes insecure, while if you make it watertight it becomes impossible to use.

And yet government presses ahead with the grand scheme of linking database together and allowing access to hundreds of thousands of officials. A note on security contained in a DWP Information bulletin, unearthed by NO2ID, hints at the possible problem when it mentions access to tax data from Her Majesty's Revenue and Custom. "DWP and HMRC customer information is shared with local authorities on the understanding that only authorised access is permitted." The document goes on to admit that the sample checks have revealed serious security breaches and warns that anyone found abusing the system will face sanctions ranging from disciplinary action to prosecution. Investigators will plot "audit trails showing the full access history of those under suspicion," says the document rather unconvincingly This may catch may a few bored council workers who have trespassed in a friend's file but lets just imagine a more sophisticated attack involving one of those crime syndicates specialising in identity theft and about which we hear so much from ministers trying to scare us into accepting the ID card. It surely would be an irony if the aggregation of personal information in the United Kingdom were to make identity theft more, not less, likely.

The CIS system will be the foundation of the ID card scheme. It came into being in 2005 after Accenture and the Department of Work and Pensions completed a pilot. It is designed to provide an overview of personal details of anyone who has a national insurance number. It includes the deceased, their beneficiaries and details of ethnic background. In other words, the customer information service, which incidentally has a friendly supermarket ring about it, presents a hugely attractive target for organized crime and maybe a lot of other bad hats too – foreign intelligence services, for example.

Back in 2005 Computer Weekly suggested that CIS was "good news" because "its relatively simple design looks like achieving success." Today it is clear that this is the problem – it is too user friendly to be secure, which is extremely worrying given we are only at the start of this process of merging databases.

Anyway, I leave you with that cheerful thought as I go on my holiday. I shall be away for a couple of weeks or so and unlike Tomasky will not have a computer or Blackberry with me.