Police computer trap ‘probably illegal now’

Press, 2 August 1977, Page 11

Police computer trap ‘probably illegal now’

PA Wellington Police planting of false material in the Wanganui computer to trap an employee suspected of breaching security could be illegal under the Wanganui Computer Centre Act, according to the Privacy Commissioner (Mr G. R. Laking). In a report tabled in Parliament. Mr Laking said the retrieval of information from the centre in January took place during the transitional period when the State Services Commission took over responsibility for the centre from the contractors. At the time the act had been passed, but was not in force. Mr Laking noted that in order to provide such information which the employee could extract and supply to an under-

cover policeman, the police inserted data tn the system which was fictitious. “This could not at the time be regarded as constituting an offence under the act. which was not then in force, but I believe that there is considerable doubt as to whether the insertion of fictitious material for such a purpose is now legally authorised and does not give rise to criminal liability," Mr Laking said. At the time of the twe breaches admitted by th computer operator. the lines of responsibility were not clrarly drawn, and, as the act uas not in force, the machinery provided for ensuring the security of data being ted into the centre had not begun to function. “In spite of this situation, the incidents of improper retrieval and use of information from the centre which have so far come under notice were quickly detected. “The fact that ihe incidents occurred has served to focus attention on the need for constant vigilance in matters of security." Mr Laking said. Mr Laking noted that in fairness to the State Services Commission, some of the weakness* > in security during the “handover" period “would almost certainly have been identified and eliminated a: the commission assumed effective control." The commissioner’s report pointed to some “obscurities and deficiencies” in the Wanganui Computer Centre Act relating to investigations by the Privacy Commissioner. “There is, for instance, no power for the commissioner to require the production of information, to take evidence on oath, or to pay the expenses of witnesses.

“Had not all the persons whom I wished to interview readily made themselves and relevant material available to me, the conduct of my investigation would have been seriously impeded." Mr Laking said questions also arose about the use of information for training, testing, and security purposes by user departments and the State Sendees Commission, and the adequacy of the existing provisions for offences and penalties.

The leaks from the computer centre were exposed when the police searched the operator’s flat looking for drugs. During the search they found papers, one of which the employee admitted contained information he had retrieved from the computer.

“It was clear from my inquiries that the employee was not observed on the occasions when he made the unauthorised retrievals,” Mr Laking said. The information was obtained from master terminals situated

in a room which was not only unlocked, but unoccupied for lous periods, es pecially during the night shifts. The terminals had nowbeen relocated and were locked. Mr Laking observed it was clear that in January no arrangements existed to enable the record of all transactions between all terminals in the computer centre and the computer system to be systematically checked. “I have been informed that these records are now made available to the manager for his perusal each day." Mr Laking said he had asked whether the manager could be certain that the records were both accurate and complete, and also how he would know whether the information recorded as having been gained was gained m an authorised fashion. “I was told that unless a retrieval corresponded to a request from outside the centre it would be suspect and that it was considered impossible to devise a fictitious request fpr information from within the centre unless a complete programme was prepared and that this would probably require the co-operation of one of the programming staff. “I was also informed that it was regarded as impossible to tamoer with the record of transactions within the system other than by physically destroying the recording tape, erasing the messages on the tape, or placing a misleading label on the tape which would cause it to be misfiled. “I was, however, assured that it was regarded as impractical and virtually impossible to devise a foolproof system for identifying the person operating the termainal,” Mr Laking said. The commissioner said he was satisfied the employee was acting alone when he retrieved information illegally. But Mr Laking said a "curious feature” attracted his attention during the inquiry, which revealed two or three attempts had been made to extract information before January 4. The information related to “the friend of the employee’s friend," but Mr Laking said the employee had vehemently denied he had obtained, or attempted to obtain, this information before January 4. Mr Laking concluded that these attempts, which did not bring out all the information about the same person named in the retrieval of January 4, were probably the responsibility of the employee. During his inquiry. Mr Laking interviewed the Commissioner of Police, the police involved in the investigation, and members and officers of the State Services Commission, as well as the computer operator.