CONFIRMATION that Guernsey police are investigating a suspected breach of the Bailiwick’s Computer Misuse Law in relation to disclosures that the States of Guernsey website was leaking personal data is an interesting development in this unfolding tale.
Looking to prosecute the man responsible for drawing attention to this major security breach seems harsh given what he drew to the attention of the authorities and which led to expressions of deep regret and a public apology.
The relevant legislation, introduced in 1991, seeks to prohibit the securing of unauthorised access to data on a computer so, on the face of it, the whistleblower may have put himself at risk.
Yet since the breaches were demonstrated to Treasury and Resources’ officials by agreement, such access had at least tacit approval.
And if there is more to what led up to that, then coming to Guernsey to show what he had been up to is hardly indicative of criminal intent.
But then the department’s response to this whole matter also has an odd feel to it.
Only an expert with specialist software could have penetrated the system, it claims, yet industry sources independent from the whistleblower have told the Guernsey Press that this was ‘kiddie script’, bedroom PC level stuff of no great sophistication.
Similarly, Treasury proclaims that those responsible for the faults will be found out and that there will be full public disclosure.
But this is an internal inquiry. So unless the department has it conducted by independent people, those with responsibility for States internet security will be policing themselves and reporting back to their political masters.
It hardly smacks of transparency.
And since these matters are exceptionally technical, the absence of any bias in what decision makers – and islanders – are told is critical.
It may be one reason why a demonstration of vulnerability with an aged laptop becomes ‘a determined effort to access the States system’ by the time it emerges in a department press release.
A very odd inquiry
CONFIRMATION that Guernsey police are investigating a suspected breach of the Bailiwick’s Computer Misuse Law in relation to disclosures that the States of Guernsey website was leaking personal data is an interesting development in this unfolding tale.
Looking to prosecute the man responsible for drawing attention to this major security breach seems harsh given what he drew to the attention of the authorities and which led to expressions of deep regret and a public apology.
The relevant legislation, introduced in 1991, seeks to prohibit the securing of unauthorised access to data on a computer so, on the face of it, the whistleblower may have put himself at risk.
Yet since the breaches were demonstrated to Treasury and Resources’ officials by agreement, such access had at least tacit approval.
And if there is more to what led up to that, then coming to Guernsey to show what he had been up to is hardly indicative of criminal intent.
But then the department’s response to this whole matter also has an odd feel to it.
Only an expert with specialist software could have penetrated the system, it claims, yet industry sources independent from the whistleblower have told the Guernsey Press that this was ‘kiddie script’, bedroom PC level stuff of no great sophistication.
Similarly, Treasury proclaims that those responsible for the faults will be found out and that there will be full public disclosure.
But this is an internal inquiry. So unless the department has it conducted by independent people, those with responsibility for States internet security will be policing themselves and reporting back to their political masters.
It hardly smacks of transparency.
And since these matters are exceptionally technical, the absence of any bias in what decision makers – and islanders – are told is critical.
It may be one reason why a demonstration of vulnerability with an aged laptop becomes ‘a determined effort to access the States system’ by the time it emerges in a department press release.
Share this article:
What are these?