Big security role on offer at ADHA - what could possibly go wrong?

itNews, 18 November 2016:

One of the highest-stakes cyber security jobs in the federal government is up for grabs as the Australian Digital Health Agency looks for an executive to take on responsibility for securing the national e-health records system.

The My Health Record platform is on the cusp of becoming a fully national data store as the government prepares to make registration opt-out in a move that will create accounts for most Australians.

It means the My Health Record system, which is operated by the ADHA, will very quickly turn into one of the largest and most sensitive databases in the country - and a big target for cyber criminals looking to capitalise on the risk.

The ADHA is looking to recruit an experienced security boss to lead its cyber security centre and take on accountability for the health data of millions of Australians.

 

Full job description here: http://allegisgroupapac.com/media/252348/pd%20-%20general%20manager,%20cyber%20security%20centre%20pd_updated.pdf

Australian Privacy Commissioner grants journalist access to his own metadata withheld by Telstra in 2013

The Australian Privacy Commissioner has determined that metadata produced by journalist Ben Grubb’s mobile phone activity is personal information and ordered Telstra to allow him access to this type of data.

Unfortunately, changes* to the Commonwealth Privacy Act 1988 may mean that this determination might not support futures challenges in cases where a telecommunications company refuses access to an individual’s own metadata.

Ben Grubb and Telstra Corporation Limited [2015] AICmr 35 (1 May 2015): Determination and reasons for determination of Privacy Commissioner, Timothy Pilgrim

Background

3. On 15 June 2013 the complainant claimed a right of access under the Privacy Act to ‘all the metadata information Telstra has stored’ about him in relation to his mobile phone service, including (but not limited to) cell tower logs, inbound call and text details, duration of data sessions and telephone calls and the URLs of websites visited……..

Summary

1. Telstra Corporation Limited (Telstra) interfered with the complainant’s privacy by failing to provide the complainant with access to his personal information held by Telstra in breach of National Privacy Principle (NPP) 6.1 of the Privacy Act 1988 (Cth) (the Privacy Act).

2. To redress this matter, Telstra shall:

* within 30 business days after the making of this declaration, provide the complainant with access to his personal information held by Telstra in accordance with his request dated 15 June 2013, save that Telstra is not obliged to provide access to inbound call numbers;

* provide the complainant with access to the above information free of charge…….

13. I note from the outset that because this matter relates to events that occurred prior to reforms to the Privacy Act which commenced on 12 March 2014, the complaint has been dealt with under the legislative regime as it applied when the events occurred. The National Privacy Principles (NPPs) not the Australian Privacy Principles² therefore apply in this instance to the question of whether or not Telstra has breached the Act. The NPPs outline the standards for handling personal information that legally bind organisations.

Full transcript of this determination can be found here.

* The Privacy Act 1988 defined personal information as:

personal information means information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.

* Under the Privacy Amendment (Enhancing Privacy Protection) Act 2012 which amended the Privacy Act 1988, personal information is now defined thus:

personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable:

                     (a)  whether the information or opinion is true or not; and

                     (b)  whether the information or opinion is recorded in a material form or not.

BACKGROUND

The Sydney Morning Herald 4 May 2015:

Monday marks 688 days since I first asked Telstra for the metadata generated by my mobile phone - the same information it routinely gives law-enforcement and intelligence agencies without a warrant when investigating crime.

Monday also marks the start of Privacy Awareness Week 2015, which usually goes by each year without too much fuss and, to be quite frank, is a little boring. But this year's Privacy Awareness Week is different.

You see, Monday also marks the day the Office of the Australian Information Commissioner hasmade public a landmark decision in relation to my battle with Telstra for access to my metadata.

You might remember how I detailed my tussle with the telco last year, in which I explained how spies, councils, the RSPCA and others could gain access to my phone's metadata but I couldn't, as Telstra was refusing me access.

I wanted access to the data in light of the data retention laws, which recently passed parliament, so that I could show Australians exactly what metadata was, considering not even George Brandis could explain it. I wanted to put my metadata on a map like German politician Malte Spitz did after he successfully sued his telco in 2011 to show just how invasive having all of your metadata stored was in the wake of mandatory data retention in his country……

Once the Telecommunications (Interception and Access) Amendment (Data Retention) Bill 2014 becomes law

On 27 February 2015 the Parliamentary Joint Committee on Intelligence and Security recommended that the Telecommunications (Interception and Access) Amendment (Data Retention) Bill 2014 be passed by the Australian Parliament.

It appears that there is bipartisan political support for the passage of this bill.

The information that will be kept on each and every one of us is found in the Draft Data Set (30 October 2014), but there is no guarantee that information collected and stored will be limited to this particular data set.

Australian Government Data Retention Draft Data Set 30 October 2014

What could possibly go wrong when the Abbott Government is creating Fortress Australia to protect us all from a veritable host of 'terrors'?

When the Abbott Government’s wider surveillance powers were passed by the Senate, the Australian public was being assured by both major parties that the sweeping ‘anti-terrorism’ legislation had built-in safeguards which would protect us all from over reach by intelligence agencies and police.

The good citizens of Tacoma in Pierce County, Washington, United States probably thought they were protected too. After all, didn’t the police need to get a warrant from a Superior Court judge?

The News Tribune article of 15 November 2014 shows just how easily a mockery can be made of surveillance laws:

Pierce County judges didn’t know until recently that they’d been authorizing Tacoma police to use a device capable of tracking someone’s cellphone.

Now they do, and they’ve demanded that police change the way they get permission to use their so-called cell site simulator.

From 2009 to earlier this year, the county’s Superior Court judges unwittingly signed more than 170 orders that Tacoma police and other local law enforcement agencies say authorized them to use a device that allows investigators to track a suspect’s cellphone but also sweeps cellphone data from innocent people nearby.

In August, the assistant chief of the Tacoma Police Department told The News Tribune that investigators never deployed the device — a cell site simulator, commonly known as a Stingray — without court authorization.

The newspaper since learned police never mentioned they intended to use the device when detectives swore out affidavits seeking so-called “pen register, trap and trace” orders allowing them to gather information about a suspect’s cellphone use and location…..

Neither the pen register orders nor the affidavits filed by law enforcement mentioned that police had a Stingray or intended to use it.

Instead, detectives used language commonly associated with requesting an order that would force a cellphone company to turn over records for a particular phone, and, where possible, the real-time location of the phone…..

The News Tribune 17 November 2014:

The Tacoma Police Department, which owns the Stingray, did not want to reveal it to the public. The FBI, which provided it, was leaning on the city to keep the technology secret. As a result, the judiciary that monitors investigations for constitutional abuses wasn’t aware of the kind of surveillance it was authorizing. However noble the motives, this was subterfuge….

But a Stingray — which employs technology known as cell site simulation — is so much more intrusive than conventional surveillance that it demands extra scrutiny. It pulls in cellphone transmissions from all callers in a given area and identifies the unique signatures of each phone…..

This could get spooky in a hurry. The Pierce County Superior Court now has another safeguard in place: Police must sign affidavits that they will not store data on people who are not targets of the investigation…..

Think this example of over reach is too far removed from Australia to matter? Think again…..

The Sydney Morning Herald reported on what is already occurring in Australia on 7 July 2014:

Australian federal and state police are ordering phone providers to hand over personal information about thousands of mobile phone users, whether they are targets of an investigation or not.

Fairfax Media has confirmed Australian law-enforcement agencies are using a technique known as a "tower dump", which gives police data about the identity, activity and location of any phone that connects to targeted cell towers over a set span of time, generally an hour or two.

A typical dump covers multiple towers, and mobile providers, and can net information about thousands of mobile phones.

The dumps are usually used in circumstances when police have few leads and can be a useful, powerful tool in tracking down criminals. But privacy advocates say that while they may be helpful to police, they also target thousands of innocent people and don’t have any judicial oversight.

In addition to no warrant being required to request a tower dump containing the mobile phone data of thousands of people to track down one or more criminals involved in a crime, privacy advocates also question what is being done to the data collected once an investigation is complete….

Tony Abbott's Blue Screen Of Death