Showing posts with label data retention. Show all posts
Showing posts with label data retention. Show all posts

Wednesday 4 April 2018

Are those nasty digital chickens coming home to roost for Mark Zuckerberg and Facebook?


In 2014 rumours began to spread about the about Strategic Communication Laboratries (SLC) Cambridge Analytica.

By 12 December 2015, after contacting Facebook's public relations representatives in London, The Guardian (UK) was reporting that:

"A little-known data company, now embedded within Cruz’s campaign and indirectly financed by his primary billionaire benefactor, paid researchers at Cambridge University to gather detailed psychological profiles about the US electorate using a massive pool of mainly unwitting US Facebook users built with an online survey.
As part of an aggressive new voter-targeting operation, Cambridge Analytica – financially supported by reclusive hedge fund magnate and leading Republican donor Robert Mercer – is now using so-called “psychographic profiles” of US citizens in order to help win Cruz votes, despite earlier concerns and red flags from potential survey-takers.

Documents seen by the Guardian have uncovered longstanding ethical and privacy issues about the way academics hoovered up personal data by accessing a vast set of US Facebook profiles, in order to build sophisticated models of users’ personalities.

By 6 January 2016 The Guardian was reporting on what was likely to turn up in Facebook feeds by way of political advertising:

If you lived in north-east Iowa, the evangelical stronghold where the battle for the soul of conservative American politics will play out in person on Monday, and happened to have given Senator Ted Cruz’s campaign your email address sometime in the last few months, you might find something especially appealing this weekend in your Facebook feed.

Even the most obtuse member of Facebook Inc.'s board or senior management would have been aware that the company was fast becoming an active participant in the US presidential primaries campaign. 

Fast forward to now as the chickens come home to roost.......
Google Search, 3 April 2018

The Guardian, 26 March 2018:

In rejecting the media’s characterisation of this large-scale privacy violation as a “data breach”, Facebook claims “everyone involved” in the 2014 data-siphoning exercise had given their consent. “People knowingly provided their information,” the company claimed. As with its interpretation of the word “clear”, Facebook seems to have a skewed understanding of what “knowingly” really means.

Facebook’s senior executives may now be feeling apologetic, “outraged” even. But in January 2016, as Trump surged in the polls, Facebook’s COO, Sheryl Sandberg, told investors the 2016 election was “a big deal in terms of ad spend”. In other words, a major commercial opportunity. The ability to target voters, she said, was key: “Using Facebook and Instagram ads you can target by congressional district, you can target by interest, you can target by demographics or any combination of those,” she boasted. “And we’re seeing politicians at all levels really take advantage of that targeting.”

It’s perhaps worth remembering, then, that until recently Facebook was encouraging political operatives to take full advantage of its garden of surveillance. And while aspects of the Cambridge Analytica affair may be surprising, and offer a disturbing glimpse into the shadows, the routine exploitation of information about our lives – about who we are – is what’s powering Facebook. It’s the behemoth’s lifeblood.

This was a statement from the U.K. Parliament House of Commons Digital, Culture, Media and Sport Committee on 28 March 2018:

Christopher Wylie gave evidence to the Committee on Tuesday 27th March 2018 during which he referred to the evidence the Committee is publishing today. This session is available to watch. Please note the transcript will be published online shortly.

On Tuesday 20th March, the Committee Chair Damian Collins MP wrote to Mark Zuckerberg, CEO of Facebook, requesting oral evidence. Facebook have responded offering two senior executives. The Committee has accepted evidence from Chris Cox, Chief Product Officer, but has written today to Facebook to clarify whether  Mr. Zuckerberg will also appear himself, as requested. This matter was also raised with The UK Prime Minister Theresa May, in her evidence before the Liaison Committee on the evening of the 27th March. She said that Facebook should be taking the matter seriously.

On Thursday 22nd, the Committee wrote to Alexander Nix, the suspended CEO of Cambridge Analytica, recalling him to Parliament to give further evidence. Mr. Nix has agreed to come before the Committee again. You can watch the evidence session that took place on 27th February 2018 where Mr. Nix gave evidence on Parliamentlive.tv and read the transcript.


Monday 26 March 2018

A brief scrutiny of the byzantium maze that is Cambridge Analytica


Attempting to make sense of a group of corporate actors who obviously delighted in establishing a veritable labyrinth of companies and to create a reference to follow any future revelations.........

So what does the British-US company Cambridge Analytica which; 
(i) has been accused of rat f**king the 2015 Nigerian presidential election and the 2013 & 2017 Kenyan elections
(ii) allegedly influenced the 2016 UK Brexit referendum vote by assisting the Leave.EU campaign
(iii) was known to have purchased data from Global Science Research Ltd who harvested personal details from an est. 50 million Facebook user accounts and, 
(iv) later sold a breakdown of user data first to a number of GOP candidates during 2014 midterms, as well as to Ted Cruz during the US primaries and then to Donald Trump during the 2016 US presidential campaign,
actually look like on paper?

This appears to be the company whose business name is included in so many media reports at the moment:

Cambridge Analytica LLC incorporated in Delaware USA on 31 December 2013 offering data mining, analysis, and behavioral communication solutions according to Bloomberg.com and, now considered a subsidiary of SCL Group Limited.

“The genesis of Cambridge Analytica was to address the vacuum in the US Republican political market that became evident after [Mitt] Romney’s defeat in 2012” [Alexander Nix, CEO Cambridge Analytics].

Executives

Alexander James Ashburner Nix  Chief Executive Officer
Julian David Wheatland Chief Financial Officer
Mark Turnbull Managing Director of CA Political Global
Thomas Finkle Global Head of Client Services

It shares its name with a UK Company CAMBRIDGE ANALYTICA (UK) LIMITED - formerly SCL USA Limited incorporated 6 January 2015. 

Directors

NIX, Alexander James Ashburner Appointed founding sole director 6 January 2015. Only shareholder - in his own name and through another company solely owned by him,  SCL Elections Limited (incorporated 17 October 2012). 

SCL Elections Limited is described by Cambridge Analylitica as "an affiliate of Cambridge Analytica" and also the "genisis" of Cambridge Analytica. It is now being blamed for receiving harvested Facebook data and Cambridge Analytica is hypocritically trying to distance itself in a company media release on 23 March 2018.

The Cambridge Analytica website states it has offices in London, New York, Washington DC, Brazil and Malaysia. Until 20 March 2018 Alexander Nix was listed as its CEO. Acting CEO is now Chief Data Scientist at SCL Group Limited Dr. Alexander Tayler.

How do two firms on opposite sides of the world - one of which has only one director/owner and no indentifiable board members - suddenly become this company with reputed influence and tentacles everywhere?

Perhaps the answer lies in the est. US$15 million in indirect funding Cambridge Analytica has allegedly received from right-wing American billionaire Robert Mercer & his daughter Rebekah through one or all five affiliated US 'front' companies including Cambridge Analytica LLC and in its relationship with another UK corporation with which it shares information/data/personnel.

The remaining US 'front' companies are:

Cambridge Analytica Holdings LLC (Delaware (US), 9 May 2014- )
Cambridge Analytica Commercial LLC (Delaware (US), 21 Jan 2015- )
Cambridge Analytica Political LLC (Delaware (US), 21 Jan 2015- )

That other UK company is SCL Group Limited formerly Strategic Communication Laboratories Limited incorporated on 20 July 2005 by STG Secretaries Limited on behalf of an unidentified person/s, with an opening share capital of £100,000.

Directors

NIX, Alexander James Ashburner Appointed co-founding director along with Alexander Waddinton Oakes on 20 July 2005, resigned on 7 December 2012 and reappointed on 28 January 2016. Shareholder. Owner of Cambridge Analytica (UK) Limited.
OAKES, Nigel John Appointed on 3 October 2005. Shareholder.
GABB, Roger Michael Appointed on 10 November 2005. Shareholder. Ownership of shares – more than 25% but not more than 50%. Ownership of voting rights - more than 25% but not more than 50%
WHEATLAND, Julian David Appointed on 20 December 2007. Shareholder.

Barclays Bank PLC current lender to the company It seems this bank assisted in restructuring SCL Group Limited's finances.

Company Positions Identified by LinkedIn

United Kingdom
Web / Software Developer at Cambridge Analytica / SCL Group
Twickenham, United Kingdom
Current: Web Developer at SCL Group
Data Engineer presso Cambridge Analytica
London, United Kingdom
Current: Data Engineer at Cambridge Analytica & SCL Group
Account Director at Cambridge Analytica
London, United Kingdom
Current: Senior Project Manager at SCL Group
Chairman at SCL Group Chief Executive at Hatton International
London, United Kingdom
Current: Chairman at SCL Group
CEO, SCL Group - Behavioural Influence
London, United Kingdom
Current: CEO at SCL Group - Strategic Communication Laboratories
Financial Crime Investigations & Security Intelligence
London, United Kingdom
Current: Head - Fraud Surveillance, Corruption, Investigations at SCL Group
Head of Elections
London, United Kingdom
Current: Head of Elections at SCL Group
Lead Data Scientist at SCL Group
London, United Kingdom
Director of Operations (SCL) / Consultant (BDI)
London, United Kingdom
Current: Director of Operations (from 2011), Head of Infrastructures (2009-2011) at The SCL Group
DevOps Engineer at SCL Group
London, United Kingdom
Current: Development Operations Engineer at SCL Group
Senior Planning Engineer at SCL Group
Birmingham, United Kingdom
Community manager chez SCL Group
London, United Kingdom
Current: Community manager at SCL Group
Financial Controller at SCL Group
London, United Kingdom
Management Accountant at SCL Group
London, United Kingdom
Account Coordinator at SCL Group
United Kingdom
Paralegal
London, United Kingdom
Current: Paralegal at SCL Group
IT Support Analyst at SCL Group
Slough, United Kingdom

United States
Director, Business Development at SCL Group
Washington D.C. Metro Area
Senior Data Scientist at SCL Group
Washington D.C. Metro Area

Canada
Technical Manager at SCL Group
Alberta, Canada

Russia
Менеджер по закупкам - SCL Group [purchasing manager]
Russian Federation
Current: Менеджер по закупкам at SCL Group

Macedonia
Head of SCL Balkans at SCL Group
Macedonia

Germany
Project Manager bei SCL Group
Hannover Area, Germany
Current: Project Manager at SCL Group

Netherlands
Behavioural & Legal Research Scientist // BDI Consultant
Breda Area, Netherlands

Australia
Project Portfolio Manager at SCL Group Australia
Sydney, Australia
Current: Project Portfolio Manager at SCL Group

New Zealand
SCL Products Manager at SCL Group
Auckland, New Zealand

Malaysia
Head, CA Political/Commercial Southeast Asia
Putra Jaya, Malaysia
Current: Director of SCL Southeast Asia at SCL Group

India
Research Analyst at SCL Group
New Delhi Area, India
Director Business Development at SCL Group
New Delhi Area, India

China
CUSTOMER SERVICE at SCL Group
China

Open Corporates' Company Grouping for Cambridge Analytica

 SCL GROUP LIMITED (United Kingdom, 20 Jul 2005- ) directors
 SCL INSIGHT LIMITED (United Kingdom, 13 Sep 2016- ) directors
 SCL ELECTIONS LIMITED (United Kingdom, 17 Oct 2012- ) director
 SCL ANALYTICS LIMITED (United Kingdom, 23 Oct 2015- ) directors
 CAMBRIDGE ANALYTICA(UK) LIMITED (United Kingdom, 6 Jan 2015- ) director
 SCL COMMERCIAL LIMITED (United Kingdom, 10 Jan 2014- ) director
SCL SOCIAL LIMITED (United Kingdom, 19 Feb 2013- ) director
 inactive SCL SOVEREIGN LIMITED (United Kingdom, 6 Jan 2015-28 Jun 2016) director Voluntarily dissolved June 2016
 inactive BOLDNOTE LIMITED (United Kingdom, 27 Oct 2004- 8 Jan 2013) directors Voluntarily dissolved January 2013
inactive SCL DIGITAL LIMITED (United Kingdom, 6 Jan 2015-28 Jun 2016) director Voluntarily dissolved January 2015
CAMBRIDGE ANALYTICA LLC (Delaware (US), 31 Dec 2013- ) 
 inactive branch SCL USA INC. (Virginia (US), 25 May 2016-31 Jul 2017) 
 SCL USA INC. (Delaware (US), 22 Apr 2014- ) details
 branch SCL USA INC. (New York (US), 10 May 2016- )
 branch SCL USA Inc. (District of Columbia (US), 22 Apr 2014- ) 
 inactive Strategic Communication Laboratories LLC (Virginia (US), 7 Mar 2011-30 Jun 2013) 
 STRATEGIC COMMUNICATION LABORATORIES, INC. (Delaware (US), 23 Aug 2006- )
 CAMBRIDGE ANALYTICA COMMERCIAL LLC (Delaware (US), 21 Jan 2015- ) 
 CAMBRIDGE ANALYTICA POLITICAL LLC (Delaware (US), 21 Jan 2015- ) 


BACKGROUND

The Sydney Morning Herald, 23 March 2018:

Wylie, a Canadian citizen, moved to London in 2010 and started to work in 2013 for SCL Group, which he said conducted "information operations" around the world and also worked in campaigns, especially in African nations.

As research director, Wylie helped that company give birth to Cambridge Analytica as "an American brand" that would focus on US politics with at least $US10 million from billionaire hedge fund manager Robert Mercer. The Cambridge Analytica office was in the posh Mayfair neighbourhood of London, and the dozens of young workers - many of them contractors, a number of whom were from Eastern Europe - buzzed about with Apple laptops.

At the helm, said Wylie, was Mercer's daughter Rebekah, who was president, and conservative strategist Steve Bannon, who was vice president. Running day-to-day operations was a smooth-talking upper-crust Briton, Alexander Nix……

Wylie said that it was under Nix's direction - but with the knowledge of Bannon and Rebekah Mercer - that Cambridge Analytica began an ambitious data-gathering program that included tapping into the Facebook profiles of 50 million users through the use of a personality-testing app. The company did that with the help of a Russian American psychologist at Cambridge University, Aleksandr Kogan, who also made regular visits back to Russia, according to Wylie.

Wylie said he and others at Cambridge Analytica were initially skeptical of the power of this tactic for gathering data. But when the company approved $US1000 for Kogan to experiment with his app, he produced data on 1000 people who downloaded it and roughly 160,000 of their friends - all in a matter of hours.

Cambridge Analytica next approved $US10,000 for a second round of testing and was rewarded with nearly a million records, including names, home towns, dates of birth, religious affiliations, work and educational histories, and preferences, as expressed using the popular Facebook "like" button on many social media updates, news stories and other online posts.

They soon married that data with voter lists and commercial data broker information and discovered they had a remarkably precise portrait of a large swath of the American electorate.

Kogan's app, called "thisisyourdigitallife" and portrayed as being for research purposes, gathered data on the 270,000 people who downloaded it and tens of millions of their Facebook friends. It was this data and others that Wylie later worried might have ended up in Russian hands.

"I'm not saying that we put it on a drive and posted it to Vladimir Putin on Number 1 Red Square," Wylie said, referring to the Russian president's official residence. But he said that he and others affiliated with Cambridge Analytica briefed Lukoil, a Russian oil company, on its research into American voters. 


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The Guardian, 14 May 2017:

What was not known, until February, was the relationship between all these figures and the Leave campaign. That was when Andy Wigmore, Leave.EU’s communications director, revealed to this paper that Farage was a close friend of both Bannon and Mercer. He said that the Leave campaign was a “petri dish” for the Trump campaign. “We shared a lot of information because what they were trying to do and what we were trying to do had massive parallels.”

Wigmore also said that Mercer had been “happy to help” and Cambridge Analytica had given its services to the campaign for free. It was the general secretary of Ukip, a British lawyer called Matthew Richardson, who effected Leave.eu’s introduction to Cambridge Analytica, Wigmore said. “We had a guy called Matthew Richardson who’d known Nigel for a long time and he’s always looked after the Mercers. The Mercers hadsaid that here’s this company that we think might be useful.”

He said that Mercer, Farage and co had all met at a conference in Washington. “The best dinner we ever went to. Around that table were all the rejects of the political world. And the rejects of the political world are now effectively in the White House. It’s extraordinary. Jeff Sessions. [Former national security adviser Michael] Flynn, the whole lot of them. They were all there.”

When the Observer revealed Mercer’s “help” in February, a “gift” of services, it triggered two investigations. One by the Information Commissioner’s Office about possible illegal use of data. And another by the Electoral Commission. Cambridge Analytica is a US company and Mercer is a US citizen and British law, designed to protect its electoral system from outside influence, expressly forbids donations from foreign – or impermissible – donors. The commission is also looking into the “help” that Gunster gave the campaign. It was not declared in Leave.EU’s spending returns and if donated, it would also be impermissible. Gavin Millar QC, an expert in electoral law, says it raises questions of the utmost importance about the influence of an American citizen in a UK election.

But the contents of this document raise even more significant and urgent questions. Coordination between campaigns destroys the “level playing field” on which UK electoral law is based. It creates an unfair advantage.

Millar said that one of the significant and revealing aspects of the arrangement was that it was hidden. “It’s the covert nature of the relationship between these two companies and campaigns that I find particularly revealing and alarming. If there is covert cooperation via offshore entities, [it] is about as serious a breach of the funding rules as one can imagine in the 21st century.”

Millar said that this case was without precedent. “To have a billionaire so directly buying influence in a British election is absolutely unheard of. This is completely out of the ordinary. And what’s clear is that our electoral laws are hopelessly inadequate. The only way we would be able to find the truth of what happened is through a public inquiry.”

The link between Cambridge Analytica and AggregateIQ was never supposed to come to light. And it is still uncertain how Vote Leave came to work with AggregateIQ.
There are several major Tory donors and pro-Brexit figures associated with Cambridge Analytica and SCL Elections, including Lord Marland, former treasurer of the Conservative party and head of the Commonwealth Enterprise and Investment Council. The pro-Brexit Tory donor Roger Gabb, the owner of South African wine company Kumala, is also a shareholder and was involved in one of the Leave campaigns. In a separate incident he was fined £1,000 by the Electoral Commission for failing to include “imprints” – or campaign branding – on newspaper ads.

The Observer revealed last week that two core members of the Vote Leave team used to work with both Cambridge Analytica and AggregateIQ. Cummings said that he found the company – on which he spent by far the biggest chunk of his campaign budget – “on the internet”.


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Digital, Culture, Media and Sport CommitteeOral evidence: Fake News, HC 363, Tuesday 27 February 2018, Ordered by the House of Commons to be published on 27 February 2018.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Cambridge Analytica is currently under investigation in the UK with the Information Commissioner's Office entering the company's London office under search warrant on 23 March 2018.

Monday 12 February 2018

AUSTRALIA CARD MARK II: no national digital ID number will mean no access to any Australian federal government services



“When signing up to the platform for the first time, users will be asked to provide their name, email address, and phone number, and verify their details via email or SMS. They will then be asked to provide information from three identity documents, which goes through the exchange to the identity provider for verification. The exchange receives encrypted details back which it passes on to the government service the user wants to reach, which then grants the user access.”  [IT News, 20 March 2015]

IT News, 8 February 2018:

The Department of Human Services looks set to become the federal government's exclusive manager of digital identities after being selected to build the identity provider solution that will be used for the Govpass platform.

The Govpass framework is a decentralised identity model that allows individuals to choose their identity provider - an organisation that issues identity documents, like Australia Post or the ATO - and access a range of public and private sector services through a single digital identity credential.

There is no limit on the number of identity providers outside of the Commonwealth that can be accredited for Govpass; Australia Post has already indicated it will seek to become the first non-government identity provider, using its Digital iD platform.
Several state and territory government agencies and private sector entities are also expected to become identity providers over time.

However, the federal government last year made the decision that only one identity provider would operate for the entire Commonwealth.

The Digital Transformation Agency revealed the decision following meetings with existing Commonwealth identity service providers, DHS and the ATO. Its rationale for the move was to focus security efforts in one place and avoid complex administrative structures.

iTnews revealed in October that the DTA was yet to make up its mind up on which of the two agencies would serve as the federal government’s sole identity provider for GovPass, even as testing of the new platform was taking place with the ATO’s new online tax file number application service.

Instead the DTA said it was working closely with the ATO and DHS on the “next steps” for the platform.

But in response to questions on notice from recent estimates hearings, DHS revealed it had been instructed to develop the federal government’s single identity provider platform, to be known as myGov IdP.

“The department was commissioned by the DTA to build the identity provider (IdP) for the whole-of-government,” it said.

“The myGov IdP will enable citizens to verify their identity online and use it to apply for government services.”

iTnews has made several attempts to clarify the statements with the DTA and DHS, but both refused to comment on the build and DHS’ apparent position as the single government identity provider.

The ATO similarly redirected questions about its involvement with Govpass, including whether it had also been asked by the DTA to build an identity provider solution, to the DTA.

Selecting DHS as the sole government identity provider would be an obvious choice for the DTA - the agency is the government’s current defacto whole-of-gov identity provider through the myGov digital services platform.

A private beta release of myGov IdP is currently planned for later this month.

Identity providers on Govpass will use the DTA-built identity exchange – and in turn the document verification service (DVS) and facial verification service (FVS) – to verify an individual’s credentials without revealing their identity to service providers.
[my yellow bolding]

NoteThe Face Identification Service (FIS) is a one-to-many, image-based identification service that can match a photo of an unknown person against multiple government records to help establish their identity. FIS is also available to police, security services, Dept. of Immigration and Dept. of Foreign Affairs. [Australian Attorney-General's Department, October 2017]

Thursday 11 January 2018

NSW Auditor-General not impressed by government agencies cyber security risk management


“Specific financial reporting, controls and service delivery comments are included in the individual 2017 cluster financial audit reports tabled in Parliament from October to December 2017.” [NSW Auditor-General, Report on Internal Controls and Governance 2017, December 2017]

On 20 December 2017 the NSW Auditor-General released the Report on Internal Controls and Governance 2017.

The Sydney Morning Herald reported on 28 December 2017:

Two-thirds of NSW government agencies are failing to properly safeguard their data, increasing the risk of improper access to confidential information about members of the public and identity fraud by cyber criminals.

The finding has emerged from an audit of dozens of government agencies, including those holding highly sensitive personal information collected from millions of citizens, such as NSW Health, the department of education, NSW Police Force, Roads and Maritime Services and the justice department.

While the report by auditor-general Margaret Crawford does not name the agencies failing to properly manage privileged access to their systems, it highlights the potential consequences.

"Personal information collected by public sector agencies about members of the public is of high value to cyber criminals, as it can be used to create false identities to commit other crimes," she says in the report.

"Despite these risks, we found that one agency had 37 privileged user accounts, including 33 that were dormant. The agency had no formal process to create, modify or deactivate privileged users."

Overall, Ms Crawford's report found 68 per cent of NSW government agencies "do not adequately manage privileged access to their systems".

In addition, she said, the audit determined that 61 per cent of agencies "do not regularly monitor the account activity of privileged users".

"This places those agencies at greater risk of not detecting compromised systems, data breaches and misuse," the report said.

The audit found 31 per cent of agencies "do not limit or restrict privileged access to appropriate personnel". Of those, just one-third monitor the account activity of privileged users.

It found that almost one-third of agencies breach their own security policies on user access.

The report warns that if agencies fail to implement proper controls "they may also breach NSW laws and policies and the international standards that they reference".

Read the full article here.

List of NSW Government Agencies Examined by NSW Auditor-General
Education
Department of Education
Family and Community Services
Department of Family and Community Services
New South Wales Land and Housing Corporation
Finance, Services and Innovation
Department of Finance, Services and Innovation * Specifically identified in report
Place Management NSW
Property NSW
Service NSW
Health
NSW Health
Industry
Department of Industry
Destination NSW
Forestry Corporation of New South Wales
Office of Sport
TAFE Commission
Water NSW
Justice
Department of Justice
Fire and Rescue NSW
Legal Aid Commission of New South Wales
NSW Police Force
Office of the NSW Rural Fire Service
Planning and Environment
Department of Planning and Environment
Essential Energy
Hunter Water Corporation
Landcom
Office of Environment and Heritage
Office of Local Government
Sydney Water Corporation
Premier and Cabinet
Department of Premier and Cabinet
Transport
NSW Trains
Rail Corporation New South Wales
Roads and Maritime Services
Sydney Trains
Transport for NSW
WCX M4 PTY Limited
WCX M5 PTY Limited
Treasury
Crown Finance Entity
Insurance and Care NSW
Lifetime Care and Support Authority
NSW Treasury Corporation
NSW Self Insurance Corporation


Some deficiencies were common across agencies

The most common internal control deficiencies were poor or absent IT controls related to:

user access management
password management
privileged access management
user acceptance testing.

The most common governance deficiencies related to:

management of cyber security risks
capital project governance
management of shared service arrangements
conflicts-of-interest management
gifts-and-benefits management
risk management maturity
ethical behaviour policies and statements.