Scott Morrison’s response to asylum seeker data breach a ‘horrible mistake’
|
Version 0 of 1. Scott Morrison’s response to the exposure of asylum seekers’ details on the immigration department’s website was a “horrible mistake” that had made the situation worse, the chairman of the Australian Privacy Foundation says. On Wednesday Guardian Australia revealed that the personal details of almost 10,000 people in detention – including names, nationalities, dates of birth and ID numbers – had been publicly accessible on the department’s website. The immigration minister subsequently revealed the location of the file in releases and interviews, potentially alerting people who had not realised they had downloaded the data to its existence. “To compound the error by enabling people who may not have realised they had the data to find the data is a horrible mistake,” Roger Clarke said. Greens senator Sarah Hanson-Young said the minister’s revelations about the location of the document was an act of extreme recklessness. “The minister’s attitude to all of this is just total recklessness … He either doesn’t understand the dangerous situation he has placed refugees in or he doesn’t care,” she said. Guardian Australia did not disclose the location of the file to prevent further breaches of privacy. Neither the minister’s office nor the department has responded to questions about how many times the file had been downloaded while it was accessible on the department’s website. More than a thousand people in the department would have had access to information of similar sensitivity to that which was released, a former department manager says, raising further concerns about its handling of personal information. Greg Lake, a former immigration department regional manager and whistleblower who left the department in December 2012, said that when he was employed, more than a thousand people – including “very junior officers” – had access to highly personal information. Several hundred people had the ability to export files like the one that was inadvertently released. “The data is very widely available. It was probably available to a thousand staff members, maybe more,” he told Guardian Australia. “In other words, a lot of people had access to this information and could have produced this information that was revealed publicly.” Stephen Wilson, a privacy and security consultant with the Lockstep group, said: “You just wouldn’t think that hundreds of people would need to know or have access to that database. “There’s not a lot of face validity in that number of people having access – it seems high.” Lake was critical of the department’s handling of data. “My initial reaction is to say we’re supposed to uphold people’s privacy, and this is a legal obligation that the department has failed to uphold. It also really does put them or their families in danger back home. Leaving Sri Lanka without permission can be a criminal offence.” Lake said that during his time at the department “there were emails I saw sent around with lists of client names, IDs, language names, IDs, family make-up that were emailed to dozens of people at times”. |