Eliana Willis

The health services industry has continued to be the sector responsible for the highest number of reported data breaches in Australia, accounting for 85 of the 446 total breaches notified to the Office of the Australian Information Commissioner (OAIC) in the six months to 30 June 2021.The 446 total is down 16% when compared to the previous six month’s figure of 530 notifications. For the 2020-21 financial year, 976 notifications were received under the Notifiable Data Breaches (NDB) scheme.March saw the highest number of notifications with 102.In the reporting period, 81% of breaches were identified by the entity within 30 days of it occurring, but in 4% of occasions, it took the entity longer than 365 days.”For data breaches caused by malicious or criminal attack or human error, more than 80% of entities identified the incident within 30 days of it occurring,” the OAIC wrote. “Where entities experienced a data breach resulting from a system fault, only 61% identified the incident within 30 days, and 30% did not become aware of the incident for over a year.”In the reporting period, 72% of entities notified the OAIC within 30 days of becoming aware of an incident that was subsequently assessed to be an eligible data breach. 27 entities took longer than 120 days from when they became aware of an incident to notify the OAIC.  71% of Australian government agencies reporting an incident found it within 30 days. 9%, however, took over a year to find. 3% took over a year to notify the OAIC.

Since the mandate, health has been the most affected sector. Coming in second to health this half was the finance sector, which accounted for 57 notifications, followed by legal and accounting with 35, and the Australian government and insurance sectors each with 34. The Australian government entered the top five sectors in the first half of FY21. All agencies and organisations in Australia that are covered by the Privacy Act 1988 are required to notify individuals whose personal information is involved in a data breach that is likely to result in “serious harm”, as soon as practicable after becoming aware of a breach. The Privacy Act covers most Australian government agencies; it does not cover a number of intelligence and national security agencies, nor does it cover state and local government agencies, public hospitals, and public schools.In its latest six-month report [PDF] capturing notifications made under the NDB scheme, the OAIC said most data breaches involved the personal information of 5,000 individuals or fewer.Three notifications affected over 1 million individuals, with one affecting over 10 million individuals.Contact information, identity information, and financial details continue to be the most common types of personal information involved in data breaches. 407 — or 91% — of breaches notified under the scheme involved contact information, such as an individual’s name, home address, phone number, or email address.247 instances saw the breach of identity information, 193 exposed financial information, 136 health information, tax file numbers were exposed in 102 breaches, and other sensitive information was compromised in 75 of the occasions. Malicious or criminal attacks were the largest source of data breaches notified to the OAIC, accounting for 289 breaches. 192 breaches were caused by “cyber incidents”, 35 of them resulted from social engineering or impersonation, on 28 occasions the actions taken by a rogue employee or insider threat was the cause, and theft of paperwork or storage devices was responsible for 34 notifications.The report says human error also remained a major source of breaches, accounting for 134 notifications, while system faults accounted for the remaining 23 breaches.Human error breaches include sending personal information to the wrong recipient via email, unintended release or publication of personal information, and failure to use the blind carbon copy function when sending group emails.Unauthorised disclosure/unintended release or publication occurred in 31 notifications. This alone affected 523,998 individuals. The Australian government did not report any incidents pertaining to system faults, but reported 25 as human error, and nine as a malicious or criminal attack. The Australian government also reported one incident as “hacking”.The top sources of cyber incidents during the reporting period were phishing, compromised or stolen credentials, and ransomware. “More than half of cyber incidents (62%) during the reporting period involved malicious actors gaining access to accounts using compromised or stolen credentials,” OAIC said. “The most common method used by malicious actors to obtain compromised credentials was email-based phishing (58 notifications).”Ransomware incidents increased by 24% in the second half of the year, up from 37 in the first half to 46.Data breach notifications under the NDB scheme since inception
Image: OAIC
Need to disclose a breach? Read this: Notifiable Data Breaches scheme: Getting ready to disclose a data breach in AustraliaRELATED COVERAGE More

The United Kingdom competition authority said it has uncovered competition concerns with Nvidia’s proposed acquisition of the intellectual property business of UK-based Arm, following an initial investigation that was sparked by national security concerns.In delivering its report to the Secretary of State for Digital, Culture, Media and Sports (DCMS), the Competition and Markets Authority (CMA) outlined that the merged business would have the ability and incentive to harm the competitiveness of Nvidia’s rivals by restricting access to Arm’s intellectual property (IP). Currently, Arm’s IP is used by companies to produce semiconductor chips and related products that rival products produced by Nvidia. These companies include Intel, Qualcomm, AMD, and Xilinx, which recently expressed outrage over the deal. The CMA noted that if the proposed merger were to go ahead, it would result in “foreclosure in the supply of CPUs, interconnect products, GPUs, and SoCs across several global markets, spanning the datacentre, internet-of-things, automotive, and gaming console applications”.In addition, the report said while Nvidia offered a set of “behavioural remedies” to address the CMA’s concern, the competition authority found the suggestions would only result in “considerable specification, circumvention, and monitoring and enforcement risks”, and not alleviate any of its concerns. “We’re concerned that Nvidia controlling Arm could create real problems for Nvidia’s rivals by limiting their access to key technologies, and ultimately stifling innovation across a number of important and growing markets. This could end up with consumers missing out on new products, or prices going up,” CMA boss Andrea Coscelli said. “The chip technology industry is worth billions and is vital to products that businesses and consumers rely on every day. This includes the critical data processing and datacentre technology that supports digital businesses across the economy, and the future development of artificial intelligence technologies that will be important to growth industries like robotics and self-driving cars.”

The CMA also advised the DCMS that further investigation into the planned merger was warranted. “The majority of customers and competitors that responded to the CMA’s investigation in relation to general-purpose personal computers also raised vertical foreclosure concerns … the CMA has not been able to investigate this area sufficiently … the CMA believes that this is an area which may warrant further examination in any phase 2 investigation,” it said in its report.The US chipmaker giant announced it was going to purchase Arm from Softbank, in a controversial deal worth $40 billion, last September. At the time, Nvidia founder and CEO Jensen Huang told journalists that the companies were “completely complementary”.”Nvidia doesn’t design CPUs, we have no CPU instruction set, Nvidia doesn’t license IP to semiconductor companies, so, and in that way, we’re not competitors. We have every intention to add more IP tools and also unlike Arm, Nvidia does not participate in the cell phone market,” he said.”Our intention is to combine the engineering and the tech — the R&D capacity of both companies so that we can accelerate the development of technology for Arm’s vast ecosystem, and one of the areas … that we very interested in, is to accelerate the development of server CPUs.”Arm’s president of IP Products Group Rene Haas has also previously assured there would be a “firewall” between the two companies and added that they would not give any early access to Nvidia. But Haas later admitted that Arm would have to share certain information with Nvidia, like if large customers move to RISC-V, an open-source competitor to Arm.Related Coverage More

Image: Shutterstock
The Digital Transformation Agency (DTA) has added three further providers to its list of certified players to store sensitive data locally.Added this week is NextDC, which joins recently added Equinix and Fujitsu.NextDC has its Perth 1 and 2, Sydney 1 and 2, Melbourne 1 and 2, Brisbane 1 and 2, and Canberra 1 facilities classed as certified against the requirements defined in the Hosting Certification Framework.Equinix Australia has its CA1, SY3, SY4, SY5, SY6, SY7, PE2, and ME4 faciltiies certified, while Fujitsu Australia’s Western Sydney and Homebush facilities have been accepted by the DTA.The DTA is the government’s certifying authority for the Hosting Certification Framework.The framework aims to operationalise the principles outlined in the whole-of-government hosting strategy, and to support the secure management of government systems and data.”The framework will assist agencies to mitigate against supply chain and data centre ownership risks, and enable them to identify and source appropriate hosting and related services,” the DTA claims.

In June, the DTA certified Australian Data Centres, Canberra Data Centres, and Macquarie Telecom’s Canberra Campus as the initial three providers to store sensitive government data.The Australian Signals Directorate (ASD) shuttered the government’s cloud certification program in July 2020, after an independent review recommended for the system be reworked. ASD cloud services certifications, and consequently all services listed on the Certified Cloud Services List, became void. In its place is the Cloud Security Guidance, which aims to guide organisations including government, cloud service providers, and Information Security Registered Assessors Program assessors on how to perform a “comprehensive assessment of a cloud service provider and its cloud services so a risk-informed decision can be made about its suitability to handle an organisation’s data”.
LATEST FROM CANBERRA More

The Australian Securities Exchange (ASX) experienced “software issues” when it went live with the refresh of its trade equity platform in November last year, causing the exchange to pause trade.At the time, the exchange said its technology provider Nasdaq, as well as customers and independent specialist third parties, conducted extensive testing for over a year on the ASX Trade system, including four dress rehearsals, in preparation for sending it out in the wild. The tech used, it said, was the latest generation of a Nasdaq-developed trading system used around the world.Following the outage, the Reserve Bank of Australia (RBA) and the Australian Securities and Investments Commission (ASIC) requested an independent review, and the ASX saw fit to hand this responsibility to IBM.Never forget: IBM lambasted by ABS for failing to handle Census DDoSOn Monday, IBM served the ASX with 17 recommendations and found a number of shortcomings in the project, such as noting the trade platform was not ready for go-live.”Factors that suggested the ASX Trade system was not ready to go-live considering ASX’s near zero appetite for service disruption. This was the case even though the formal implementation readiness processes were completed and verified by multiple parties without objection to go-live,” IBM found.

“There were gaps in the rigour applied to the project delivery risk and issue management process expected for a project of this nature, and risk and issue management, project compliance to ASX practices, project requirements and the project test strategy/planning did not meet accepted industry practices. “It was not reasonable to expect the test plan used would meet the ASX’s near zero appetite for service disruption.”According to Big Blue, there were seven factors that suggested the platform was not ready for go-live, which included historical software product quality indicators, additional testing needs being noted, the quantity of open defects, gaps in end-to-end test coverage, proximity to year-end change freeze windows for participants, risk likelihood ratings, and a lack of evidence of challenges to the risk rating or to go-live.”Last November’s market outage fell short of ASX’s high standards,” ASX MD and CEO Dominic Stevens said on Monday. “We believed that the software was ready for go-live, as did our technology provider Nasdaq. Clearly there were issues, which was particularly disappointing given the significant progress we have made on resilience in recent years.”IBM also concluded the project could have benefited from additional and independent scrutiny.It determined there were gaps in the rigour applied to the project delivery risk and issue management process, such as opportunities to identify additional risks being missed, differences between project delivery risk templates and the enterprise delivery risk processes, the project not receiving risk resources with greater experience in technical projects that it would have benefitted from, and governance being shifted to a group that had a wide range of responsibilities. “The shift diluted attention given to the project,” IBM said.The review found some positives, however, with IBM saying the ASX met or exceeded leading industry practices in 58 out of 75 of the capabilities assessed.”We acknowledge the findings in the report. It’s pleasing that ASX met or exceeded leading industry practices in most areas. But the report does point to some important areas for improvement and we will address all of its recommendations,” Stevens added. “ASX is well advanced in developing a detailed response plan for execution over the next 12 to 18 months, and we’ll commission the independent expert to review our actions to meet its recommendations. Our delivery of this program of work will be under the oversight of ASIC and the RBA.”IBM said the project’s business case development and project change management exceeded accepted practices; that the project was provided with, and had access to, sufficient financial, time, people, and technological resources at all stages of delivery to meet its objectives; that communications with key stakeholders were appropriately managed by the ASX, and said incident management actions taken by the exchange were appropriate.The exchange in 2018 was asked to up its risk management practices following an “unprecedented” hardware failure in September 2016 that resulted in the outage of its equity market. According to ASIC, the actions taken by ASX during the 2020 incident were appropriate and reflected the lessons learned from the 2016 incident.”ASX takes the resilience and reliability of its markets extremely seriously. That’s why we immediately engaged with our regulators to commission this external review and will address all of its recommendations. It’s also why we’ve already taken action to change our project delivery practices,” Stevens continued. “The changes we’ve made to our management structure are aligned to these objectives. “Driving technological change is hard and creates transition risk. No market will operate without incidents or outages from time to time. Nevertheless, all outages are regrettable.”The regulators expect ASX to apply the insights from IBM’s findings across the exchange to ensure existing and proposed projects, including the CHESS replacement program, are managed and implemented appropriately.ASIC is also undertaking a separate investigation into the ASX Trade outage to determine whether ASX met its obligations under its Australian Market Licence.MORE FROM THE EXCHANGE More

Image: Apple
Apple clearly thought it was onto a winner with its child sexual abuse material (CSAM) detection system and, more than likely, it was expecting more of the usual gushing plaudits it is used to. It’s not hard to imagine Cupertino thinking it had solved the intractable problem of CSAM in a way that best suited itself and its users.Apple claims its system is more private because it doesn’t actively scan or monitor photos uploaded to its servers, unlike pretty much everyone else in the industry, but as the weeks go by, it looks increasingly like Apple has created a Rube Goldberg machine in order to differentiate itself. The consequences of this unilateral approach are far-reaching and will impact everyone, not just those in the Apple walled garden. Governments have been pushing for big tech to create decryption abilities for some time. One way to reach a compromise is to have an encrypted system but not allow the users to encrypt their own backups, thereby allowing some visibility into content, while another is to have a full end-to-end encrypted system and inspect content when it is decrypted on the user device for viewing. While the rest of the industry settled on the former, Apple has switched lanes onto the latter. This shift occurred just as Australia handed down its set of draft rules that will define how its Online Safety Act operates. “If the service uses encryption, the provider of the service will take reasonable steps to develop and implement processes to detect and address material or activity on the service that is or may be unlawful or harmful,” the draft states.

See also: Apple to tune CSAM system to keep one-in-a-trillion false positive deactivation thresholdCanada goes a step further in a similar draft. In its iteration, it is demanding proactive monitoring of content relating to CSAM, terrorism, violence-inciting, hate speech, and non-consensual image sharing, and creating a new Digital Safety Commissioner role to assess whether any AI used is sufficient, according to University of Ottawa law professor Dr Michael Geist. Should it become law, online communication services in Canada would also have 24 hours to make a decision on a piece of harmful content. How that potential law interacts with Apple’s decision to set a threshold of 30 CSAM images before injecting humans into the process and inspecting the content’s metadata will be something to watch in future. While the Canadian proposal has been deemed to be a collection of the worst ideas from around the world, the likes of India, the United Kingdom, and Germany are likewise pushing forward with internet regulation. Apple has said its CSAM system will start only with the United States when iOS 15, iPadOS 15, watchOS 8, and macOS Monterey arrive, meaning one might be able to argue Apple will be able to avoid the regulations of other western nations. But not so fast. Apple privacy chief Erik Neuenschwander said in a recent interview that the hash list used to identify CSAM will be built into the operating system.”We have one global operating system,” he said.  Even if Apple has consistently stated its policies aim to prevent overreach, use by corrupt regimes, or false suspensions, it’s not clear how Apple will answer one very important question: What happens when Apple is issued with a court order that goes against its policies?There’s no doubt non-US legislators will take a dim view if the sort of systems they want are available on Apple devices.  “We follow the law wherever we do business,” Tim Cook said in 2017 after the company pulled VPN apps from its Chinese app store.  Following the law: Citizen Lab finds Apple’s China censorship process bleeds into Hong Kong and Taiwan While there are plenty of worthy concerns and questions about Apple’s system itself, the consequences of the existence of such a system is cause for greater concern. For years, Apple has pushed back on demands from US authorities to help unlock phones of people alleged to be involved in mass shooting. When responding to FBI demands in 2016, Cook wrote a letter to customers that rebutted suggestions that unlocking one phone would be the end of the matter, and said the technique could be used over and over again.”In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession,” the CEO said. The key to Apple’s argument was the words between the emdashes, and now in August 2021, while that exact capability does not exist, an on-device capability is set to appear on all its devices, and that’s a good enough reason for concern. “Apple has unilaterally chosen to enrol its users in a global experiment of mass surveillance, seemingly underestimated the potential costs this could have on individuals who are not involved in the manufacture or storage of CSAM content, and externalised any such costs onto a user base of one billion-plus individuals around the world,” Citizen Lab senior research associate Christopher Parson wrote. “These are not the activities of a company that has meaningfully reflected on the weight of its actions but, instead, are reflective of a company that is willing to sacrifice its users without adequately balancing their privacy and security needs.” For the sake of argument, let’s give Apple a pass on all of its claims — perhaps the biggest of the tech giants can resist legislative pressure and the system remains fixated only on CSAM within the United States. However, this will take eternal vigilance from Apple and privacy advocates to ensure it follows through on this. The bigger problem is the rest of the industry. The slippery slope does exist, and Apple has taken the first step down. Maybe it has boots with ice grips and has tied itself to a tree to make sure it cannot descend any further, but few others do.Suddenly, on-device scanning has become a lot less repugnant because if a company as big as Apple can do it, and they promote themselves on the basis of privacy and continue to sell squillions of devices, it must therefore be acceptable to users. Building on that, shady businesses that want to upload data to their own servers now potentially have a nomenclature built out for them by Apple. It’s not the user’s data, it’s safety vouchers. What previously could have been deemed a form of exfiltration is now done to protect users, comply with government orders, and make the world a safer place.Those systems that follow in the wake of Apple are unlikely to have as much concern for user privacy, technical expertise and resources, ability to resist court orders, or just flat out good intentions that Cupertino appears to have. Even if Apple were to dump its plans tomorrow, it’s too late. The genie is now out of the bottle. Critics and those who want to pursue an on-device approach will simply say Apple has buckled to pressure from extreme sections of the privacy debate if it does decide to change its mind. Companies are going to compete over who can best poke around on devices, boast about how many of their users were arrested, and how that makes them safer than other choices. Missing in this will no doubt be the number of mistakes made, edge cases that are never properly considered, or anguish caused to some of those who pay for devices. It’s not going to be pretty. Apple doesn’t seem to grasp that it has turned its user’s relationship with its products from one of ownership into a potentially adversarial one. If your device is scanning content and uploading it somewhere, and you cannot turn it off, then who is the real owner? It’s a question we will need to answer soon, especially because client-side scanning is not going away. ZDNET’S MONDAY MORNING OPENER  The Monday Morning Opener is our opening salvo for the week in tech. Since we run a global site, this editorial publishes on Monday at 8:00am AEST in Sydney, Australia, which is 6:00pm Eastern Time on Sunday in the US. It is written by a member of ZDNet’s global editorial board, which is comprised of our lead editors across Asia, Australia, Europe, and North America.  PREVIOUSLY ON MONDAY MORNING OPENER: More