Liberals not convinced by Chiefly testimony. Is anyone else?

I’m not sure that the Chief Minister could have given much more information about the details of the potential conflict of interest without effectively identifying Jackson as the person under investigation.

One would hope that the “Director of Data Integrity” would be reporting directly to the Minister.

johnboy said :

If they actually wanted to identify who was at fault it wouldn’t be that hard to compare staff rostering to dates and times of record abuse. with thousands of records over three years it shouldn’t be hard to narrow the pool of potential suspects down to something some hard questioning would break down.

If the Government actually wanted to get answers of course.

Feasible but a large number of people at various levels have access to the software in question. At any given time, even weekends and after hours, quite a large number of people are actively using the software. (Most of them wouldn’t have anything to gain from altering data however.)

“staff at the hospital have to swipe passes in and out right?” A large number of those people do not have to swipe in and out. They work in the ED where access can be gained a number of ways including through the ambulance entrance where there is a numeric keypad entry and all staff use the same code.

johnboy said :

Systemic tailgating would show up though and should be a huge red flag.

I think you might be confusing Canberra Hospital with the new ASIO headquarters. From personal experience of working in a number of governmental and commercial buildings “systemic tailgating” is pretty much standard operating procedure: you all get out of the lift in a group and the first person opens the door and lets everyone in, you see someone coming the other way and hold the door open for them, you wave at the receptionist and they buzz you in, you go home down the fire escape (yeap my building has no alarms on the escape stairs) …. Most swipe card systems are just security theatre.

My main point is that when the system first went in it was probably designed to collect some operational data that was used to put some nice stats on p.300 of the annual report and not much else. Over the years more and more money and job status has been attached to them increasing greatly the incentive to tamper with the system but there has been no change in the corresponding security of the system.

Suss.

dtc said :

As far as I can tell, when the investigation started KG excused herself citing a personal conflict. Its not like KG herself was involved in any of the activities, and until the investigation was concluded I’m not quite sure what she was meant to do other than not be involved.

From the estimates hearing, Katy’s family member has the same access to the computers with generic logins as Kate Jackson.

You can watch the hearing here http://committees.parliament.act.gov.au/speeches

The links are crappy, so you can stream directly here:

rtsp://streaming.parliament.act.gov.au/COMMITTEE%2005-07-12%20#1.mov
rtsp://streaming.parliament.act.gov.au/COMMITTEE%2005-07-12%20#2.mov

While also noting the terms of use, which are as follows:

By using this site you accept the conditions of the ACT Legislative Assembly outlined below and agree to abide by them.

Copyright of the material broadcast belongs to the Australian Capital Territory and no unauthorised use may be made of that material. Persons or organisations who wish to broadcast or rebroadcast audio or visual material, including material available on the Assembly’s website must abide by the conditions of access set out below.

Broadcast material must not be used for:
* the purpose of satire or ridicule;
* advertising for or by political parties;
* electioneering; or
* commercial advertising or sponsorship.

The Legislative Assembly’s broadcasts are live and continuous and while in that complete and unaltered state may be protected by parliamentary privilege. Extracts or excerpts of the broadcast are protected if they constitute fair and accurate reports of proceedings. The ACT Legislative Assembly is not liable for any loss or damage arising from use of the material or from delays or interruptions to its publication.

johnboy said :

wristbands as used by your average pub to authenticate to the till?

Money is involved, the system was designed to resist attack.

johnboy said :

staff at the hospital have to swipe passes in and out right?

Yes. I, for one, have never tailgated another cardholder so I don’t have to find mine 😉

As far as I can tell, when the investigation started KG excused herself citing a personal conflict. Its not like KG herself was involved in any of the activities, and until the investigation was concluded I’m not quite sure what she was meant to do other than not be involved.

johnboy said :

If they actually wanted to identify who was at fault it wouldn’t be that hard to compare staff rostering to dates and times of record abuse.

Err, if I was cooking the books I’d be doing it when I wasn’t rostered on and using the “generic” login.

I think the problem is that the system was designed to collection operation statistics and not for collecting evidence. The system probably needs a redesign to build in some resistance to attack, things like: auditing, two-factor authentication, CCTV of the terminals, etc…..

Why do they want a Royal Commission? By the time you set one up the election will already have been and gone. As Sir Humphrey would say “never hold an inquiry unless you know what its outcomes will be”, imagine how much fun it’ll be for the new Liberal government when the Commission reports suggesting a lot of very expensive and difficult fixes.

I would have thought the best approach would be:

1. Send the case to the police for investigation.
2. Fix the IT system so it has real security.
3. Have the records audited on a regular basis. Perhaps the Commonwealth should be doing this this since they’ve chosen to tie funding to the stats.