news National mobile operator Vodafone yesterday revealed it would finally refer to law enforcement authorities an incident which it became aware of three years ago where one of its staff members had accessed the call records of a journalist who was dealing with a whistleblower within its operations.
In 2011, Fairfax journalist Natalie O’Brien — a Vodafone customer at the time — published a series of stories relating particularly to one of Vodafone’s customer records platforms — a Siebel-based system which the journalist had written was leaking data publicly.
In response to a story in The Australian newspaper on Saturday, over the weekend Vodafone issued a statement (PDF) confirming that at the time, one of its employees had accessed the phone and text records of a customer believed to be O’Brien, in what appears to be an attempt to ascertain O’Brien’s source.
Vodafone has previously called in an outside accounting firm to do an audit of the situation and had dismissed several staff as a result. It has previously denied any allegations of improper behaviour.
However, yesterday the telco issued a new statement (PDF) noting that it had taken further action.
“The [Vodafone Hutchison Australia] CEO [Inaki Berroeta] has today contacted Ms O’Brien to apologise in relation to the unacceptable and potentially criminal behaviour of a former employee,” the company said. “Current VHA management is taking this matter extremely seriously and is reporting it to NSW Police and Australian Federal Police.”
“We have also updated the Privacy Commissioner and the Australian Communications and Media Authority about the matter. VHA will fully cooperate with their investigations.”
Separately, this week, current NBN company chief executive Bill Morrow faced questions in Senate Select NBN Committee hearings on the issue relating to his tenure leading Vodafone from March 2012.
The executive said he was “not aware” of the specific details of the case, noting that he relied on executives such as Vodafone’s general counsel of the time to take the proper steps. “I reported nothing to the police, Senator,” he told Shadow Defence Minister Stephen Conroy in the Committee, “because I was not aware of any of the details that are being currently reported in the news. I had no specific discussions with anybody about any criminal activity outside of Vodafone.”
I believe Vodafone should have reported this to police three years ago. It has only done so this week because of the extraordinary media spotlight that has been put on the company. This should teach us something about corporate ethics — often companies will not get involved with law enforcement if they can possibly avoid it.
And in general, my comments on Monday about thie story still stand:
I am not surprised by this story.
I’ve been a journalist reporting on Australia’s telecommunications sector for a long time. In that time, there have been many stories of great import reported about Australia’s major telcos. I would be extremely surprised if there have not been a number of occasions when a journalists’ data had been accessed. The data is there, after all — the temptation to access it would have been irresistible from a telco employee’s perspective.
Nor am I surprised by the instant reaction which Vodafone appears to have taken internally. The company’s move to bring in an external auditor to examine the situation exhaustively is a very solid one. The company’s management would have been aware that pulling the call and text records of a journalist is a highly controversial act.
None of this is a huge surprise, although obviously Vodafone’s action is outrageous.
However, I do hope there will be further legal follow-up on this issue. Former Communications Minister Stephen Conroy questioned the NBN company’s chief executive Bill Morrow — who was Vodafone chief executive from March 2012 — on the issue in the NBN Senate Select Committee this morning. The Senator made the point that it was illegal to access such data.
Will this matter be referred to police for investigation? I certainly hope so. The recently passed Data Retention legislation means that telcos such as Vodafone will be keeping vastly more data than they previously were. Accordingly, the penalties against companies who illegally access journalists’ data for the purpose of tracking down whistleblowers must be strictly enforced, to dissuade this kind of behaviour from happening again.