Late last year, a 16 year-old school boy on summer holidays found a simple security flaw in Public Transport Victoria’s (PTV) website. The flaw the high-schooler discovered is commonly known as a MySQL error, and it is ridiculously simple to fix. With teenage curiosity at play, Joshua Rogers managed to access the government server, using a process known as SQL injection. Due to the PTV’s security oversight, databases of personal information of over 600,000 users – including full names, emails, addresses, phone numbers, dates of birth and nine digits of their credit cards – were accessible online. And if the young wunderkind could access those databases, it meant that far more nefarious and potentially criminal types could illicitly access the databases as well. Legally, Joshua wasn’t required to inform PTV, but ethically he thought it was the right thing to do. So he kindly emailed PTV’s staff on 26 December to inform them of the flaw in their security. PTV’s response was less than adequate. Not a well-deserved “thank you” (although PTV did acknowledge Joshua’s initial email after a journalist came asking some pointy questions about the data breach), and not even a courtesy email to PTV customers to let them know their personal information had been breached and was potentially at risk of being fraudulently used. No, according to a statement PTV made to The Age, they referred the matter to Victoria Police. Victoria Police declined to comment on whether their investigation will specifically involve an examination of Joshuas amateur pen testing of PTV’s network. In a statement made to The Guardian, they stated that they’d received a report from Public Transport Victoria relating to the unauthorised access to their network. As the matter is currently under investigation, we are not in a position to comment. How is it that PTV’s potentially disastrous lack of basic online security cops nothing more than a well-deserved swipe from tech journos rather than a hefty fine for failing to notify customers, while a young infosec enthusiast doing the right thing may face an investigation? While 96% of Australians want mandatory data breach notification laws, Australian companies aren’t currently legally required to disclose data breaches to customers, even when people’s personal details are potentially compromised. The Privacy Amendment (Privacy Alerts) Bill 2013 lapsed in November after the federal election, despite support from the Office of the Australian Information Commissioner, the Australian Law Reform Commission, the Australian Privacy Commissioner and public interest groups including Electronic Frontiers Australia and the Australian Privacy Foundation. Despite this show of hand, Coalition senators Gary Humphries and Sue Boyce raised objections to the bill, claiming that “ stakeholders should be better scrutinised, understood and acted upon by the relevant government agencies as this new privacy regime is rolled out.” Those stakeholders, who kicked and screeched in horror at the legislation attempts to increase accountability and implement fines for failures to protect and notify customers of data breaches, included data-miners whose bread and butter has always been paid by sucking up personal information online, as well as telephone companies the previous government attorney-general Mark Dreyfus essentially took a stick to over prior data breaches. There is a problematic imbalance in the evolution of Australian policy and practice in response to data breaches: individuals who report critical security flaws face potential legal action, while corporations who fail to fix and report data breaches to paying customers go unpunished. Threatening to call the police on people who report security flaws has a chilling effect against encouraging good citizenship. Reporting a dangerous hole in a public road isn’t illegal, and similarly we shouldn’t threaten people who point out potential holes in infosec, particularly when breaches put sensitive information at risk. Today, a simple Google search for “inurl:.gov.au this document is confidential” raises approximately thousands of responses on Australian government websites with potentially confidential documents. In light of heavy-handed responses to innocent individuals who report security issues, who would be game to open the links to check and see if the documents are legitimately available to the public, or unwittingly released online? Who would be foolhardy enough to report critical breaches of confidentially, when pointing out security failures potentially garners the reward of a knock on the door from the police? inurl:.gov.au A search for inurl:.gov.au this document is confidential. It is vital that an amnesty is implemented against prosecution of individuals who report security flaws. Similarly, it is critical that legislative impetus enforcing mandatory data breach reporting is placed upon organisations and government agencies – and there needs to be ongoing pressure to engage legislative reforms to achieve this. Ensuring companies and governments let customers and clients know when their online security is breached is the minimum standard we should demand, especially when either incompetence or oversight puts personal information at risk.
Posted on: Wed, 29 Jan 2014 15:52:40 +0000
Trending Topics
Recently Viewed Topics
© 2015