This Is Guernsey

By Nicci Martel

THE findings of an internal inquiry into how bank details of Maison Maritaine patients could be accessed online will be made public, the Treasury Minister promised yesterday.

Deputy Lyndon Trott said those responsible for the fault in the States internet security system would be found out. ‘There will be full inquiry to find the identification of those responsible, and I give my word those details will be made public – whatever it reveals.’

Treasury and Resources denied Marcus Cicero’s claims that a vulnerability on gov.gg sites meant that anyone with basic computer competence could get control of the main server. But T&R admitted that personal information, including some bank details, of nearly 40 care home residents, some deceased, had been accessible, but only to someone with extensive computer knowledge.

Jane Wonnacott, director of ICT for the States, said it was not known why that information was even on the system but that was being investigated, as was Mr Cicero’s assertion that he had contacted the States four years ago to report the fault.

She did not know why staff had not discovered it earlier.

‘We cannot say why the vulnerability was not spotted, but in our view this was a determined effort to access the States system and could only have been achieved with expert knowledge and specialist software.’

But a local IT expert, who asked to remain anonymous, supported Mr Cicero’s claims that this was a low-grade hack. He said the custom plug-in used by Mr Cicero, which detected the vulnerability, was a common tool used on the internet.

Mr Cicero denied he had set out to access the system.

Chief Minister Mike Torode said: ‘If we put it in perspective, people break into sites worldwide and this is fairly insignificant in real terms – think about the Ministry of Defence in Whitehall – but for someone to go in and look at data belonging to the elderly and infirm residents of the island, it is a despicable act.’

Article posted on 18th March, 2008 - 2.29pm