news Malcolm Turnbull has advised the public not to assume that Government email services are more secure than private systems, in the wake of news that the new Prime Minister will continue to use non-Government email and instant messaging platforms for communication.
Last week, The Australian newspaper revealed that Turnbull and his wife, Lucy Turnbull, operated a private email server, which has been used for purposes including conducting government business. The server has been used during Turnbull’s time as Communications Minister and in his new role as Prime Minister.
In a press conference last week, Turnbull said the public “shouldn’t assume that Government email services are more secure than private ones.”
The Prime Minister defended his use of a private email server — which has been reported to be provided by hosting company Netregistry — through stating that it was not possible for classification information to be exchanged, other than through Government platforms.
Classified information can only be exchanged through government systems and obviously all members and senators and ministers use non-government forms of communication, most notably SMS, which I might say is probably the least secure of all forms of electronic communication for matters that are not classified, that are routine, non-sensitive, however you want to describe it.
“Classified information cannot be transmitted to, or transmitted from, anything other than a government system that is certified as appropriate for it,” the Prime Minister said. In terms of transmitting this information through private means, Turnbull added: “The answer is I can’t do it and I wouldn’t do it and I protect classified information very, very carefully.”
Critics of Turnbull’s approach have raised the issue that emails and messages sent through private systems may not be accessible through Freedom of Information legislation.
“If you have an FOI application that relates to a Minister’s text messages that’s not on a Government system … those text messages, subject to all sorts of exemptions and rules and so forth, can be accessed,” Turnbull said.
The Prime Minister acknowledged, however, that Wickr — which he described as “a very secure over the top application” — would not necessarily leave a message that could be captured under FOI — as messages sent through Wickr tend to self-destruct after they have been read.
In general, Turnbull said, he used a “variety of forms of messaging” — as, he pointed out, many members of the public dic.
“I am very careful about security. I use my private non-Government email is obviously one that I’ve had for many years and many people can reach me that way. But obviously any material that is classified or sensitive remains within the Government system,” he said.
“I am not — I don’t claim to be an expert in this area, but it is not an unknown area to me. I’m pretty familiar with the different forms of data security and the challenges. I stay very closely in touch with our experts such as the Australian Signals Directorate. I take care about this and I look forward to improving levels of Government security where ever we can. So I can assure you, security of telecommunications, security of Government data is a very high priority for me, as it is for all of our Ministers and Assistant Ministers.”
opinion/analysis
Is Turnbull right? Are Government email platforms not necessarily more secure than private email servers?
On a formal level, one would suspect that the Australian Signals Directorate — which is responsible for oversight of IT security within the Federal Government — would strongly disagree with Turnbull’s statement. This agency would, I suspect, strongly hold the view that Government email platforms are more secure than those provided by the private sector.
However, the evidence is that Turnbull is correct.
The Parliament’s email system, after all, has been very publicly hacked before — during the Gillard Prime Ministership. In addition, the Department of Parliamentary Services, which administers the email platform for Members of Parliament, is not known for being well-funded when it comes to IT services. In fact, the situation is precisely the opposite — reports about the Department’s IT services have found many problems.
Of course, when you examine the specifics of the situation, one would suspect that if Turnbull was serious about the security of his email, he could possibly pick a better option than Netregistry. Nothing against the company — but it is usually seen as a provider for consumers and small businesses, rather than one suitable for hosting really sensitive information. You would typically more look at a Government-certified body such as Macquarie Telecom for that kind of service.
Turnbull’s use of Netregistry as an email hosting platform — if indeed the reports are correct and it is Netregistry which is involved — will paint a red target on the platform. I am sure there are many nasty people out there who would like to break into Turnbull’s personal email. I suspect the Prime Minister should review his IT security arrangements as quickly as possible.
Image credit: Office of Malcolm Turnbull
It doesn’t matter on whether he is right or not.
It’s more a case of whether it’s appropriate, or even permitted to do so. Mail itself is a relatively unprotected transport medium, and it isn’t guaranteed. Government correspondence originating from private services is a pretty thorny issue.
However the difference between what is being used, and what the government does is likely non-trivial when it comes to auditing and oversight; and as much as a private solution isn’t going to be any worse (it’s probably a lot easier to access) it does raise the fairly basic question of whether such an activity is setting a particularly good example, when the government is knee deep in forcing metadata retention policy through.
It’s a pretty good advertisement to not follow government policy, when convenient. :)
Why would Govt systems be more secure?
Email servers and storage are exactly that, be it Windaz based or *nix based. The two most common used and dare I say it, are free and open source daemons, being postfix and dovecot, are both designed by people with code security backgrounds, its why most ISP systems use that combination, certainly far better than anything Microsoft have to offer which govts seem to suck up and fall for the MS hyperbol and use… like “oh but you pay MS tens/hundreds thousands of dollars for this like it must be better than something you download and use for free” *sigh* history proves otherwise – but that said, it all comes down to how good your system admins are as well.
There is nothing to say that ASD are any more gurus with mail servers than any other system admin whos job has been to run such, it borders on comedy to think people trot out the name ASD (formerly DSD) as some sort of eliteness – remember, these are the same bunnies who a few years ago blocked all of APH from accessing anything in the .info TLD *double sigh*
Given MT’s background, he probably knows more about mail servers than ASD (he must LOL – he doesn’t use Microsoft) The only drawback is, most host companies in Oz are cheapscapes and have mail and web on same shared servers, rather than having a dedicated separate and more secure mail system – like ISP’s do.
“Why would Govt systems be more secure?”
I can tell you’ve never worked for defense or needed a security clearance ;). Those systems just are more secure (its not security theatre etc).
Like Renai said the provider selected is geared for a smaller scale so there’s no way they’ve the employee resources to thoroughly lock a system down quite so tightly like say ASD and all the linked IT Dept’s they’ve got around the country. That’s where the govt’ bloat works for them they’ve the staff levels to manage it (even if some might not be the brightest).
If nothing else security starts with the users … trust me nobody wants to be that guy/gal that sent something classified somewhere that they shouldn’t have. I don’t doubt Politicians in parliament and classified info is any less like that (eg its a culture that is inbred from the minute you start, you see someone else screw up and what happens and don’t want to be them). If you think men in dark suits don’t come visiting well they do and its never a comfortable feeling (not quite MiB style mind ;) )!
Just because its exchange and MS software doesn’t mean is magically more vulnerable (I’m not the biggest fan of MS and its products mind you) they won’t be just using it out of the box either ;).
” its why most ISP systems use that combination,”
I reckon that is more down to cost than anything else. Like you said its not cheap to license on that scale.
No Simon, I’ve never ran anything for defence, but I’ve run some large mail systems, and I dare say APH is no more secure than any of them, and is no more secure than most the large ISP’s in Oz and elsewhere, so long as you have service separation.
Our decisions to use that combo was not based on cost, it was based on facts of proven secure track records, they are very light on resources, extremely fast, and extremely simple to configure/add/remove in large clusters. Performance and security are always the two first key factors I’ve had and my peers have had in over 20 years of running mail systems.
Also MS Exchange? gawd, you must be a youngin, because if you recall the hellish nightmares most admins have been through with that in years gone by you would never had said that :)
I didn’t say (or mean too) it was good software or easy to use/setup/config/Admin ;)
Just that the above issues didn’t/doesn’t make it less secure.
How many bad leaks have there been due to email systems leaking classified emails? As bad as the tools might be the end result is pretty good (or they’re really good at hiding the snafu’s).
Who’s to say Netregistry don’t use MS software anyway.
@Simon,
“Who’s to say Netregistry don’t use MS software anyway.”
I think they do offer an exchange service for colab now don’t they?
Only time will tell what happens there. But they are a hosting company out to make money, doesnt make it sane, just like its not sane to have shared host servers hosting web and mail on same box, but its cheap way out of it so most webhosts do it that way, I hate places that put all your eggs in the one basket ;)
You really are a nobby if you think just because it is Microsoft it is less secure.
Lets just forget about the varies open SSL exploits or the fact the vast majority of compromised web servers are LAMP stacks. It has more to do with volume of deployment and the ability of the person using or setting up the system. In its current state I would say Linux systems are inherently less secure than current windows servers but that is only because now the required knowledge to get one of the varies Linux based server systems running is much lower than it used to be with default packages designed more for ease of setup and less with security in mind.
Apple has very poor security procedure its advantage was that it had a low install base and it’s a lot harder to mess with the initial generally secure setup. Their biggest pitfall is failure to acknowledge there might problems and very long reaction time to confirmed problems.
Linux suffer from some of the same problems as Windows without the same install base, it is very easy to change setting to make your system less(or more) secure. The major difference I’ve seen between the two have started pushing to a more secure base install where the rest of the microsoft server application works from this secure base. With Linux I’ve more of case with admittedly in experienced Admin not even starting from a secure base and then punching more holes in their security just to get the service working.
@ Matthews
“You really are a nobby if you think just because it is Microsoft it is less secure.”
Sorry kido, I have history on my side.
I will agree with this statement though:
“With Linux I’ve more of case with admittedly in experienced Admin not even starting from a secure base and then punching more holes in their security just to get the service working”
What is it they say, a little bit of knowledge in the wrong hands can be very dangerous….
(BTW most modern linux’s for over a decade have started secure (gentoo, slackware, and to a lesser extent RHEL – the problem lies with the ubuntus and fedoras of the world who typically open every service known to man and his dog)
The problem businesses have to realise is there is a big difference between someone playing with linux at home for fun and using it in the real world on critical services, also, most IT contractors are windows experienced, and when presented with a linux box have mostly only google to help them…. I’ve had to fix many many servers by such peoples.
In the old days there were unwritten laws, nix admins admin nix and win admins admin win, neither should ever cross over, these days, well, pay peanuts get monkies in many industries.
But we are supposed to trust them with our metadata…
@Glenn,
Nah, your supposed to trust ISP’s and Webhosts with it, if there’s any breakdown in security it’ll be there, and given some have made it clear they will ” cloud ” it, even offshore, then yes, we’re all XXXXed
This is utterly irrelevant, the point is government systems have to comply with auditing and accountability standards that dont apply to private systems! If MT et al are using a private mail system how are we supposed to hold them to account for FOI requests etc?
Well the emails are more secure from FoI requests so he is right.
This. This comment covers it all. Security of the infrastructure is absolutely irrelevant. It’s about procedure and protocol of paid public officials (elected or not). That this was not highlighted by Delimiter is a tad sad :\
Ummm. mmm. Email. Secure. Aaahhhh.
I know of only one encrypted email facility, which of course is no reason to think that others don’t exist. (W)ell, even Gmail might be encrypted for all I know.
But I DO know of only ONE email client which fully supports end-to-end encryption, and can be configured to fail with a warning if the other end does not support encryption. And it’s not Notes or whatever Outlook has been morphed into. Oh, and it’s not available on *nix, only Windoze.
So if Joe Blow is using his home computer, then infrastructure security does not exist, regardless of how much PGP etc is involved. Or maybe because PGP etc IS involved: there’s nothing like a bright neon sign proclaiming “Look at ME!!!!!” to ruin one’s privacy.
Having said all that, I notice that most Fed/State websites force the use of a supposedly secure form if you want to talk to somebody, email addresses are hard to find these days. But I wonder if those forms are as secure as some people think they are? We still have places and people who think that SSL is just another word for TLS!
Perhaps Malcolm has reason to avoid bureaucratic clunkiness?
Gordon.
Comments are closed.