The private mobile phone numbers of Australia’s MPs and Senators were available to download on the Australian Parliament’s website for three months without anyone realising, due to a failure by contractor Telco Management.
Even after the documents were taken down, Google’s caching of the documents containing the information, together with the publication of the story reporting the leak, led to even wider disclosure.
Ian McKenzie, acting chief information officer at the Department of Parliamentary Services, revealed new details in Senate Estimates on Monday, detailing how hundreds of phone expense PDF reports were first published in December.
“The programmer at the vendor’s site redacted - or tried to redact - the current set of reports by setting the text to white on a white background,” Mr McKenzie said.
"It wasn’t immediately visible to the naked eye, it required a manipulation to show up the information.
"But it was there - in white text on a white background.”
Fairfax media reported the original breach on March 20. By the time the story was published, the Department had been advised of the leak and had removed the documents from the Parliament website.
Between the time they were uploaded on December 22 and the time they were taken down, the documents had been downloaded 980 times.
When the story emerged however, the files were still available via the Google cache, which stores previous versions of internet documents.
"We know roughly the number of downloads that occurred from our website,” Mr McKenzie said.
"The complicating factor is that, as we have reported, the Google caching engine had cached the documents.
"Although we can tell the number of downloads from our own site, we are not able to tell the number of downloads that would have occurred from the Google cache engine."
The story - and phone numbers - quickly spread on social media following the reporting of the leak and close to 100 comments were posted on one Reddit thread alone.
The Department of Parliamentary Services confirmed some MPs have requested new phone numbers following the privacy breach, but the Department will continue to use Telco Management.
"We believe sufficient controls are in place to ensure the incident will not re-occur,” Mr McKenzie said.
Telco Management has been contacted for comment.
Watch: Insight - Privacy
Share
