The Office of the Australian Information Commissioner just posted this:Â http://www.oaic.gov.au/news/media_releases/media_release_120629_telstra_breaches_privacy_act.html
This isn’t to do with what I’ve posted about here the past few days, but to do with an incident back in December 2011. The details of  734,000 customers were available publicly on the Internet.
Details exposed include:
- Name
- phone numbers
- Services held
- free text field (where information such as username, password, email or other information could be recorded)
The ACMA report says that up to 41,000 customers had their user names and passwords exposed.
So… who had access? I quote from the ACMA report:
Between 3 June 2011 and 8 December 2011, the Visibility Tool received 108 access requests per day from unrecognised IP addresses (IP addresses that cannot be conclusively identified as Telstra IP addresses). On the day of the media publication, this number increased to 20,498 access requests.
The information was available from 29th March 2011 through 9th December 2011 with from a date in October it being easier to access (via a google search).
Unfortunately this is yet another case of internal procedures failing and being inadequate and only when the issue was raised publicly (in Whirlpool and the media) was it swiftly fixed.
It can be hard for a person inside a company to speak up, continue to speak up and be an asshole on these issues. It’s just human nature and after all, annoying your boss isn’t what everybody wants to do all day at work. I hope that the improvements that Telstra has committed to as a result of this investigation make it easier for people to raise such problems and ensure they are resolved.
Achieving things inside large companies can be incredibly hard. I have sometimes felt I’ve had more success trying to convince a dead seal to go for a walk than to get a large company to fix something that’s obviously broken (and everybody knows it). Undoubtedly there were people inside Telstra who knew about the problem yet felt powerless to force a fix to happen. This kind of culture is poisonous and tricky to avoid in a large organisation.
Both ACMA (Australian Communications) and OAIC have full reports:
- ACMA Press release:Â http://www.acma.gov.au/WEB/STANDARD..PC/pc=PC_410412
- ACMA Report:Â http://www.acma.gov.au/webwr/_assets/main/lib410234/mr48-2012-telstra_report.pdf
- http://www.oaic.gov.au/publications/reports/own_motion_telstra_bundles_June_2012.html
If we are extrapolate out for the latest incident (NextG and Netsweeper) we could expect:
- Telstra Incident report in ~2 months
- If ACMA or OAIC take action, a report in ~6months