From:
To:
Dann, Nicole
Subject:
RE: FOI release [DLM=Sensitive]
Date:
Tuesday, 2 February 2016 3:17:28 PM
Hi Nicole,
I left a voice message.
I would not be at all comfortable letting the file out with all those database names. The other
document shows a methodology that I would have thought should have been protected –
protection of methodology/Public Interest Indemnity
Happy to chat about this, however the final authority id
in Information
Management however he would probably seek our advice on the content anyway.
I’m heading home shortly but can chat tomorrow.
Regards,
============================================
| Information Technology Security | EST
Australian Taxation Office
Phone
| Mobile:
| Digital Fax Gateway
ATO | Working for all Australians
From: Dann, Nicole
Sent: Tuesday, 2 February 2016 3:41 PM
To:
Subject: FOI release [DLM=Sensitive]
Hi
,
I left a message on your phone earlier today. I’m hoping you can help me answer a question.
We have received a couple of FOI requests, one is for sql queries, the other is for the data asset
register and data dictionaries. My question is, is there any risk in releasing sql queries or
internal database addresses? If an external hacker has access to these documents could they
gain access to our systems?
I have attached a copy of the sql queries. I have also attached a copy of one of the data
dictionaries (you will need to increase the size) which has a list of database locations listed.
Could you please have a look and let me know what you think?
Thank-you in anticipation
Nicole Dann
Legal Adviser, General Counsel, ATOC
Australian Taxation Office
P 07 3213 5345
F 07 3213 5005
Think digital before you print
From:
To:
Dann, Nicole
Cc:
Zhu, Katy; Galeotti, Julie;
Subject:
RE: FOI release [DLM=Sensitive]
Date:
Wednesday, 10 February 2016 8:53:20 AM
Attachments:
image001.png
image002.jpg
Hi Nicole
Further to our discussion, I can confirm that I have reviewed examples the data dictionaries
provided and reiterate that releasing these documents would provide identifiers, pointers
and references that would compromise the security and safety of ATO systems.
Thanks
, Security Services
Information Services, ATOC
Australian Taxation Office
P
M
From:
Sent: Friday, 5 February 2016 4:25 PM
To:
Dann, Nicole
Cc: Zhu, Katy; Galeotti, Julie;
Subject: RE: FOI release [DLM=Sensitive]
Hi all
Apologies for the delay, completely support the IT security advice below that providing this
information would have significant security implications for our systems and data
Happy to discuss further and work through the specific wording as required on Monday
Thanks
, Security Services
Information Services, ATOC
Australian Taxation Office
P
M
From:
Sent: Friday, 5 February 2016 3:13 PM
To:
; Dann, Nicole
Cc:
; Zhu, Katy; Galeotti, Julie;
Subject: RE: FOI release [DLM=Sensitive]
Absolutely agree,
In my experiences in Parliament and Human Services and in discussions with other
agencies security personnel we would never provide data dictionaries, data fields,
attributes and the like. As already explained by
this is essentially giving out a set
of keys to the safe to anybody who would like them.
I’m positive that that no experienced agency would provide this sort of system
information to an FOI, we just need to get the appropriate security wording around it.
Any FOI request should be about data itself and not the systems (or there attributes),
and how they are defined, stored, accessed etc... It is these types of requests which are
seemingly innocent, which are then used to construct malicious queries or exploits to
target our data illegally.
I cannot recall the specific wording, however at Parliament we regular stated
one the of the security controls that meant we could not release/provide such
information due it compromising or putting at risk the security of our systems and the
data they contain. There are many organisations who request these types of things on
a full time basis now, and yes they make some noise when they do not get it, such is
life.
BTW at the end of the day and as already called out
have the final call
on the request due to this being an InfoSec query.
Regards,
, IT Security
Australian Taxation Office
Phone:
| Mobile:
Reinventing the ATO – join the conversation
From:
Sent: Friday, 5 February 2016 11:58 AM
To: Dann, Nicole
Cc:
; Zhu, Katy; Galeotti, Julie;
Subject: FW: FOI release [DLM=Sensitive]
Hi Nicole,
I’ve added the IT Security
in this discussion and our manager as this would
appear to have far reaching impacts if this is released to this sort of organisation, especially if
they start to accumulate additional information from further FOI requests.
To expand on what the harm is in releasing the data dictionaries –
I would suggest 47E (a)(b)(c)(d) all apply.
, I’m okay with you taking over here if you want.
Regards,
============================================
| Information Technology Security | EST
Australian Taxation Office
Phone:
| Mobile:
| Digital Fax Gateway
ATO | Working for all Australians
From:
Sent: Friday, 5 February 2016 10:59 AM
To:
Cc:
; Zhu, Katy; Galeotti, Julie
Subject: RE: FOI release [DLM=Sensitive]
Hi
,
I thought it may be useful to give you a bit more background.
We currently have 3 requests from the same applicant, the applicant is applying via the ‘right
to know’ organisation, right to know has a website and everything we provide to them is
published to their website for public access, it would also be published to the ATO’s disclosure
log. All three of the requests are around data, they are as follows;
1. A copy of the data asset register including the data dictionaries,
2. Documents which show 1) the SQL queries relevant to the 2012-2013 objection data
and was used for the purposes of the IGT’s 2014 review of the ATO’s administration of
penalty; and 2) the SQL queries relevant to the imposition of penalties for years 2009-
2012 and was used for the purposes of the IGT’s 2014 review of the ATO’s
administration of penalty,
3. Summary/aggregated statistics and data the ATO provided to the IGT, along with
corresponding emails sent from the ATO to the IGT for the purposes of the IGT’s 2014
review of the ATO’s administration of penalty.
I am dealing with the first request and Katy Zhu is dealing with requests 2 and 3.
– Thank-you for your email. Could you please expand a bit on what the harm is in
releasing the data dictionaries in general? The classification of a document has no bearing on
whether we can release it under FOI or not, however we do need to have regard to harm. I
have attached a few more data dictionaries for your consideration.
From what we have discussed so far it seems that some of this material may be covered by
section 47E of the FOI Act, which is;
47E Public interest conditional exemptions—certain operations of agencies
A document is conditionally exempt if its disclosure under this Act would, or could
reasonably be expected to, do any of the following:
(a) prejudice the effectiveness of procedures or methods for the conduct of tests,
examinations or audits by an agency;
(b) prejudice the attainment of the objects of particular tests, examinations or audits
conducted or to be conducted by an agency;
(c) have a substantial adverse effect on the management or assessment of
personnel by the Commonwealth, by Norfolk Island or by an agency;
(d) have a substantial adverse effect on the proper and efficient conduct of the
operations of an agency.
Note: Access must generally be given to a conditionally exempt document unless it would
be contrary to the public interest (see section 11A).
This is a conditional exemption and to be able to exempt documents under this exemption we
need to take the public interest into account and give weight to arguments for and against
release. Essentially we need to be able to show that the potential harm in releasing the
documents outweighs the public’s right to have access to the documents.
We are discussing these requests with the relevant business lines however we wanted to know
from an IT perspective if the release of this sort of data could in some way make our IT security
more vulnerable to someone with malicious intent.
Thank you both for your time on this.
I’m happy to answer any questions or provide any more documents you may need to consider
for request 1. If you have any questions or would like to see the documents for requests 2 or 3
please contact Katy.
Nicole Dann
Legal Adviser, General Counsel, ATOC
Australian Taxation Office
P 07 3213 5345
F 07 3213 5005
Think digital before you print
From:
Sent: Friday, 5 February 2016 8:44 AM
To: Dann, Nicole
Cc:
Subject: RE: FOI release [DLM=Sensitive]
Hi Nicole,
As discussed this should come from
area for the last approval or rejection
so I have CC’d
into the email if she has anything to add. From my perspective
this should not be released as it provides too many identifiers, pointers and references
that would compromise the security and safety of ATO systems. In addition where you
suggested that it was going to an individual that may share this information additional
alarms bells went off.
At the very least I would suggest we get an SQL expert to turn the SQL statements into
Pseudo-code (
Pseudocode is an informal high-level description of the operating
principle of a computer program or other algorithm. It uses the structural conventions
of a programming language, but is intended for human reading rather than machine
reading).
The data dictionary should never leave this organisation and I would suggest the
classification of such a document should be high enough to stop it leaving.
I’m happy to be overruled on this – please provide comment.
Regards,
============================================
| Information Technology Security | EST
Australian Taxation Office
Phone:
| Mobile:
| Digital Fax Gateway
ATO | Working for all Australians
From: Dann, Nicole
Sent: Tuesday, 2 February 2016 3:41 PM
To:
Subject: FOI release [DLM=Sensitive]
Hi
,
I left a message on your phone earlier today. I’m hoping you can help me answer a question.
We have received a couple of FOI requests, one is for sql queries, the other is for the data asset
register and data dictionaries. My question is, is there any risk in releasing sql queries or
internal database addresses? If an external hacker has access to these documents could they
gain access to our systems?
I have attached a copy of the sql queries. I have also attached a copy of one of the data
dictionaries (you will need to increase the size) which has a list of database locations listed.
Could you please have a look and let me know what you think?
Thank-you in anticipation
Nicole Dann
Legal Adviser, General Counsel, ATOC
Australian Taxation Office
P 07 3213 5345
F 07 3213 5005
Think digital before you print
