Latest / 360 with Katie Woolf / NT Academic Centre for Cyber Security Director Professor Mamoun Alazab says the NT Government needs to inform people who’ve had their health information compromised

Transcript

NT Academic Centre for Cyber Security Director Professor Mamoun Alazab says the NT Government needs to inform people who’ve had their health information compromised · 360 with Katie Woolf

• 0:00
  Speaker 1: Well, last week we know that the ABC had broke
• 0:02
  Speaker 1: news that more than fifty thousand patients had their health
• 0:06
  Speaker 1: files sent between two Northern Territory government departments. It happened
• 0:10
  Speaker 1: back in twenty eighteen and twenty nineteen was part of
• 0:14
  Speaker 1: a software system upgrade which was never made public by
• 0:17
  Speaker 1: the Health minister at the time. It's understood that more
• 0:20
  Speaker 1: than three thousand identifiable records were actually transferred to global
• 0:25
  Speaker 1: software vendor InterSystems, which has offices in about twenty seven countries.
• 0:30
  Speaker 1: The ABC says that some patient items were classed as
• 0:34
  Speaker 1: having high clinical risk, such as psychology reports and psychiatric
• 0:38
  Speaker 1: facility visits, as well as termination of pregnancy or still
• 0:41
  Speaker 1: birth records, as well as electric shock therapy records. Now,
• 0:47
  Speaker 1: I think that the report of this and the concerns
• 0:50
  Speaker 1: have maybe made quite a few of you think to yourself, well,
• 0:52
  Speaker 1: hang on, just how far can our details be shared?
• 0:56
  Speaker 1: And you know, what do we do if our information
• 1:00
  Speaker 1: is actually shared to a third party. Now joining me
• 1:03
  Speaker 1: on the line to talk a little bit more about
• 1:05
  Speaker 1: this is Anti Academic Center for Cybersecurity and Innovation Director
• 1:10
  Speaker 1: Marmon ala Zab. Good morning to you, professor.
• 1:14
  Speaker 2: Good morning and thank you for having me.
• 1:16
  Speaker 1: Yeah, thank you so much for your time. Now, what
• 1:18
  Speaker 1: are your thoughts on how this data breach was handled
• 1:23
  Speaker 1: right when?
• 1:24
  Speaker 2: First of all, I want to start by saying that
• 1:27
  Speaker 2: faber security is indeed the risk that organizations need to
• 1:32
  Speaker 2: actively manage with. Of course, the increasing reliance and technologies
• 1:36
  Speaker 2: and interconnectedness of system and potential risk and a threat
• 1:41
  Speaker 2: to fybersecurity have grown significantly. It's very important for organizations
• 1:46
  Speaker 2: to have a very active faber security measures in a
• 1:50
  Speaker 2: place to protect their systems, data and sensitive information from
• 1:54
  Speaker 2: unauthorized access, even sometimes from mistakes and errors. So I
• 2:01
  Speaker 2: think the practice that's happened in this particular case that
• 2:05
  Speaker 2: number number of issues here to start with. Here the
• 2:09
  Speaker 2: government should reach down so people impacted at the time. Yeah,
• 2:13
  Speaker 2: in my view, hiding the hack sometimes is more damaging
• 2:17
  Speaker 2: the hand than the heck itself. And this instance, hiding
• 2:21
  Speaker 2: the bridge is damaged. It can be damaging more than
• 2:23
  Speaker 2: the bridge itself. Reaching out to these victims who their
• 2:28
  Speaker 2: sensitive data is being identified, it can be a serious
• 2:33
  Speaker 2: issues more. Second thing is also public should have been
• 2:39
  Speaker 2: notified about the data incident. I think public needs to
• 2:43
  Speaker 2: know how the data has been their data is being
• 2:47
  Speaker 2: handled and has been also, if there is any particular
• 2:51
  Speaker 2: mechanism in a place.
• 2:52
  Speaker 1: Yeah, I think it's a. I think they're really good
• 2:55
  Speaker 1: points that you make, you know, A Fundamentally people want
• 2:57
  Speaker 1: that openness and transparency. I want to know if their
• 3:01
  Speaker 1: information has gone further than what they thought it had.
• 3:04
  Speaker 2: Absolutely, absolutely, and really in this particular case, I mean
• 3:09
  Speaker 2: usually when it transferring health data is undertaken, is so
• 3:13
  Speaker 2: important that privacy and security impact assessment should really been
• 3:20
  Speaker 2: done at the time. So it's surprising that that was
• 3:24
  Speaker 2: not the case. And really data governance planned, it looks
• 3:29
  Speaker 2: like there was There is no data governance plan was
• 3:32
  Speaker 2: conducted by the Anti Health and or even data governance plan,
• 3:37
  Speaker 2: which is really our framework or a strategy that's our
• 3:39
  Speaker 2: client policies, procedures and guidelines and managing and protecting organizations.
• 3:47
  Speaker 1: As it professor, from your like, from your perspective, because
• 3:50
  Speaker 1: I know a lot of people are going to be
• 3:52
  Speaker 1: listening to this right now and going, oh goodness, mate,
• 3:54
  Speaker 1: this is the first I've heard of it. Is there
• 3:56
  Speaker 1: any chance that you know that my information has been
• 3:59
  Speaker 1: shared or sensitive information has been shared? So from your perspective,
• 4:04
  Speaker 1: is it a situation here where the department has has
• 4:08
  Speaker 1: shared that information with a software provider, but it hasn't
• 4:14
  Speaker 1: gone out sort of more broadly, what is your understanding, Well, well.
• 4:19
  Speaker 2: My understanding is the data has not been out in
• 4:22
  Speaker 2: the public, is within between the governments and the software provider.
• 4:29
  Speaker 2: So look, the consequences of the fiber security of the
• 4:32
  Speaker 2: database can be very very severe consequences, especially if it's
• 4:37
  Speaker 2: been data for a rental sale under the ground market.
• 4:42
  Speaker 2: But in this case, the risk I mean less damaging
• 4:49
  Speaker 2: is the data is just in between the company and
• 4:54
  Speaker 2: just within the company and the government. Yes, it hasn't
• 4:56
  Speaker 2: been reached to the public, so I guess it's at
• 5:00
  Speaker 2: less damaging.
• 5:01
  Speaker 1: Yeah, and thankfully so, because it does sound like it's
• 5:04
  Speaker 1: really quite sensitive data. I mean, do people have a
• 5:08
  Speaker 1: right to know if their sensitive information has been compromised
• 5:12
  Speaker 1: or sort of passed on?
• 5:13
  Speaker 2: Though? Well, I'll tell you. Under the under the Data
• 5:18
  Speaker 2: Notification Scheme, organizations or agencies that must comply with the
• 5:23
  Speaker 2: Australian Privacy Loan has to tell victims if a data
• 5:28
  Speaker 2: bridge is likely to cause them a serious harm and
• 5:31
  Speaker 2: they must not apply the victims. An example on this
• 5:34
  Speaker 2: really like for example, identityifs or financial loss or likely
• 5:40
  Speaker 2: risks or physical harm. So organizations or agency must tell
• 5:45
  Speaker 2: victims Unpatlick about the series of the data bridge. Yeah,
• 5:50
  Speaker 2: so I'm wondering if if the Department of the government
• 5:55
  Speaker 2: has reached out to these victims and they have been pro.
• 6:00
  Speaker 1: Active about it, you would really hope so, I mean,
• 6:03
  Speaker 1: particularly when you're talking about that sensitive information that has
• 6:07
  Speaker 1: apparently been passed on, you would hope that they have. Professor,
• 6:11
  Speaker 1: what safeguard should the government realistically adopt in an effort
• 6:14
  Speaker 1: to try to prevent something like this from actually happening again, Well.
• 6:19
  Speaker 2: I think really the very first look is how they've
• 6:23
  Speaker 2: established data governance plan, and that is that include we
• 6:29
  Speaker 2: looking again at the having a proper framework and strategy
• 6:33
  Speaker 2: that outlined the policies, the procedures, the guideline of managing
• 6:37
  Speaker 2: and protecting the organization's data assets. And that is also
• 6:41
  Speaker 2: include the data security and privacy, which is outline the
• 6:44
  Speaker 2: measures to protect the data from an authorized access. It's
• 6:48
  Speaker 2: also include strategies of how you encrypt the data, access controlled,
• 6:53
  Speaker 2: the authorization of the users who can access the data,
• 6:56
  Speaker 2: data animalization, the compliance within the data protection regulations. I mean,
• 7:02
  Speaker 2: if we do have that in a place, I would
• 7:05
  Speaker 2: imagine even that this distabulation wouldn't even happen, because when
• 7:11
  Speaker 2: we're talking about privacy preserving, we're talking about how we
• 7:15
  Speaker 2: even share data with third party contracts even to get
• 7:20
  Speaker 2: them to do their job. Instead of giving them real
• 7:23
  Speaker 2: data of real victimission, we just we're just provided them
• 7:29
  Speaker 2: with dumid data or animalized data or the I the
• 7:34
  Speaker 2: identifiable data. So having a framework of strategy implemented at
• 7:39
  Speaker 2: the first place is very important.
• 7:42
  Speaker 1: Now tell me, professor, you know, what should people do
• 7:45
  Speaker 1: if they are listening this morning and they're concerned that
• 7:48
  Speaker 1: their information has potentially been compromised? What what advice would
• 7:53
  Speaker 1: you give you to.
• 7:53
  Speaker 2: That look like? Thank you very much. I think this
• 7:56
  Speaker 2: is a very good question. And and and and I
• 7:58
  Speaker 2: do have an issue with we always talking about what
• 8:01
  Speaker 2: the victims can do, what affected citizens can do. And
• 8:05
  Speaker 2: I think I would like really to question to rephrase
• 8:08
  Speaker 2: the question in a way, you know, and I think
• 8:11
  Speaker 2: this is where the faults and in our in our
• 8:14
  Speaker 2: law really the Australian UH notifiable data breager schemes already
• 8:19
  Speaker 2: hold victims of datablage responsibility for dealing with consequences we
• 8:24
  Speaker 2: often would say, oh what now can this impacted citizens
• 8:30
  Speaker 2: can be how they can deal with it, what they
• 8:32
  Speaker 2: need to do with it. So really, victim of distiblage
• 8:35
  Speaker 2: find it difficult to bring an action really in course
• 8:38
  Speaker 2: because no source of privacy is established in Australia. The
• 8:44
  Speaker 2: the Notifiable Data Breacher schemes should be understood in a
• 8:48
  Speaker 2: border context of Australian the privacy principles, And in my view,
• 8:53
  Speaker 2: I really think the the the the the NDB schemes
• 8:57
  Speaker 2: gives entities that should be responsible for data protections much
• 9:02
  Speaker 2: leeway while holding individuals only victims of data bridge responsible
• 9:07
  Speaker 2: of dealing with with the consequences. And I think this
• 9:10
  Speaker 2: is really a problematic. YEA, reddressing the grievance caused by
• 9:16
  Speaker 2: a data bridge is difficult in the Australian context. It
• 9:21
  Speaker 2: is really difficult in my view, for victim of a
• 9:25
  Speaker 2: breach of a privacy to bring an action in cause,
• 9:29
  Speaker 2: mainly because there is no real established thoughts of for
• 9:32
  Speaker 2: privacy in Australia.
• 9:33
  Speaker 1: So it sounds like we really have some work to
• 9:36
  Speaker 1: do in Australia in this space.
• 9:38
  Speaker 2: Absolutely absolutely, it's it's it's, it's it's it's everyone's responsibility
• 9:43
  Speaker 2: is everyone is part of it, is not just victims.
• 9:46
  Speaker 2: How now deal with it? I think it's an organization,
• 9:50
  Speaker 2: it's regulation, it's slow, it's everyone is part of it,
• 9:55
  Speaker 2: and they need to work together. And I think this
• 9:58
  Speaker 2: is a very much interconnected system must work together well.
• 10:05
  Speaker 1: Mamoon Alazab, the Anti Academic Center for Cybersecurity and Innovation Director,
• 10:11
  Speaker 1: I really appreciate your time this morning. Thanks so much
• 10:14
  Speaker 1: for having a chat with us.
• 10:15
  Speaker 2: Thank you for having me.
• 10:16
  Speaker 1: Thank you