Government monitoring FOI requests?

[360 View]

So someone’s been snooping in the FOI system now have they? Are they that paranoid?

https://www.gov.im/news/2023/jun/15/low-level-foi-breach-addressed/

But it’s OK, we can rest easy - “The Office of Cyber Security and Information Assurance has confirmed that no personal information has been viewed by any individual outside of the public service or transferred outside of the Government network.” - that makes it perfectly acceptable then does it?

These people must live in a parallel universe. Can you imagine nosing around in a system out of idle curiosity being OK anywhere other than in IOMG? In the private sector you would be marched off the premises FFS. 

[Guest]

Democratic People's Republic of Mann

[The Voice of Reason]

10 hours ago, 360 View said:

Can you imagine nosing around in a system out of idle curiosity being OK anywhere other than in IOMG? 

Well the notice doesn’t say it’s OK to nose around. 

I can imagine  anyone working in the public service in any jurisdiction having a nose if the system allowed it. 
I’m sure these type of access rights ( until they were closed off) are not unique to the IOM.

I also would believe that public service people have a provision in their employment contracts regarding the confidentiality of information obtained in the course of their employment. This would apply whether or not there was a legitimate reason for them to access such information.

[english zloty]

The office of cybersecurity hasn’t heard of gossip then lmao. Anything juicy will be all round the houses now

[english zloty]

https://www.manxradio.com/news/isle-of-man-news/foi-data-breaches-prompt-investigation-into-cabinet-office/

ramped up a bit now. that's one hell of a bored worker - good job they're senior so a) setting an example b) using public funds wisely

sacking i hope (or secret pay off) whichever is the most likely

[Gladys]

3 minutes ago, english zloty said:

https://www.manxradio.com/news/isle-of-man-news/foi-data-breaches-prompt-investigation-into-cabinet-office/

ramped up a bit now. that's one hell of a bored worker - good job they're senior so a) setting an example b) using public funds wisely

sacking i hope (or secret pay off) whichever is the most likely

Unless it was thought to be legitimate within Cabinet Office to monitor FOI requests across government and the unintended consequence was a data breach because they misunderstood the rules.  But the IC will investigate, and from what I have seen, he pulls no punches. 

[Two-lane]

"accessed personal data in the system used to record and manage Freedom of Information requests."

My bold - and may be just journalistic phrasing.

"nor is it known why the breaches went undetected by the system administrator.  "

Hmmm.... It is not like me to jump to conclusions about people in the Cabinet Office.

[Two-lane]

4 minutes ago, Gladys said:

Unless it was thought to be legitimate within Cabinet Office to monitor FOI requests

The Cabinet Office can monitor FoI requests in the same way that you do, and that does not require any breach of any regulation

[Gladys]

1 minute ago, Two-lane said:

The Cabinet Office can monitor FoI requests in the same way that you do, and that does not require any breach of any regulation

Maybe, but perhaps that was not understood and that is not good or excusable.  Not excusing it, but just offering a possible reason other than personal nosiness. 

[TheTeapot]

They were just updating The List.

[Two-lane]

10 minutes ago, Gladys said:

Maybe, but perhaps that was not understood and that is not good or excusable.  Not excusing it, but just offering a possible reason other than personal nosiness. 

Bloody hell, Gladys. You are so even-handed you could probably see the good side of Atilla The Hun. 1,200 data accesses across 20 departments in one year is a great deal of nosiness in office time.

And, by the way, not knowing the rules is not an excuse - as the judiciary tends to say.

[Happier diner]

4 minutes ago, Two-lane said:

Bloody hell, Gladys. You are so even-handed you could probably see the good side of Atilla The Hun

That's a good thing I think. 

[Gladys]

Just now, Two-lane said:

Bloody hell, Gladys. You are so even-handed you could probably see the good side of Atilla The Hun. 1,200 data accesses across 20 departments in one year is a great deal of nosiness in office time.

And, by the way, not knowing the rules is not an excuse - as the judiciary tends to say.

Unless, as I say, they thought it was legitimate to monitor FOIs across the whole of government.  It is interesting that it was just one person, which makes me think that they thought it was part of their job, or they were asked to do it. 

Not knowing the rules is no excuse at all, which is exactly what I have said.  But to jump to the conclusion that it was pure nosiness, perhaps, isn't justified, yet, perhaps. 

[Roger Mexico]

It's quite astonishing behaviour.   The original press release was put out by the Office of Cyber Security and Information Assurance, which is part of Cabinet Office and was designed to reassure everyone that there was nothing to worry about.  The Information Commissioner is not impressed:

Whilst the news item published on 15 June 2023 would appear to be premature, presumptive and potentially prejudicial to the ongoing investigations, the Commissioner considers it is necessary to confirm that, between 1 April 2022 and 22 March 2023, the senior officer accessed the personal data contained in over 540 FOI requests, made to 20 separate public authorities, on more than 1200 occasions.

So one of the more clued-up public authorities noticed that their FoI Requests had effectively been hacked and reported it to the IC for investigation.  When this started the Cabinet Office decided to declare that it was all trivial and that we shouldn't be bothered that there had been "access by an individual from a public authority with administration rights to information requests submitted to other public authorities".  Who the IC now tells us was "a senior officer in Cabinet Office", oddly enough a fact omitted from the press release.  But that tells us that those who are worried can be reassured by contacting OCSIA.  Who are part of the Cabinet Office.  And it won't happen in future because the only people who will be able to access the data will be OCSIA

The numbers also tell us that this isn't just casual curiosity or people accidentally straying into the wrong part of a system.  This is systematic monitoring of personal data to which there shouldn't be access, by someone who clearly has it as part of their job.  The Cabinet Office clearly thinks it should monitoring those awkward customers who ask inconvenient questions.  More personal and confidential information may also be involved - not all FoI requests are published, especially those that relate to individuals.

[finlo]

2 minutes ago, Roger Mexico said:

It's quite astonishing behaviour.   The original press release was put out by the Office of Cyber Security and Information Assurance, which is part of Cabinet Office and was designed to reassure everyone that there was nothing to worry about.  The Information Commissioner is not impressed:

Whilst the news item published on 15 June 2023 would appear to be premature, presumptive and potentially prejudicial to the ongoing investigations, the Commissioner considers it is necessary to confirm that, between 1 April 2022 and 22 March 2023, the senior officer accessed the personal data contained in over 540 FOI requests, made to 20 separate public authorities, on more than 1200 occasions.

So one of the more clued-up public authorities noticed that their FoI Requests had effectively been hacked and reported it to the IC for investigation.  When this started the Cabinet Office decided to declare that it was all trivial and that we shouldn't be bothered that there had been "access by an individual from a public authority with administration rights to information requests submitted to other public authorities".  Who the IC now tells us was "a senior officer in Cabinet Office", oddly enough a fact omitted from the press release.  But that tells us that those who are worried can be reassured by contacting OCSIA.  Who are part of the Cabinet Office.  And it won't happen in future because the only people who will be able to access the data will be OCSIA

The numbers also tell us that this isn't just casual curiosity or people accidentally straying into the wrong part of a system.  This is systematic monitoring of personal data to which there shouldn't be access, by someone who clearly has it as part of their job.  The Cabinet Office clearly thinks it should monitoring those awkward customers who ask inconvenient questions.  More personal and confidential information may also be involved - not all FoI requests are published, especially those that relate to individuals.

Collating a 'hit list' so to speak.