— 2 —
Decision
I have identified 17 documents containing information within the scope of your access
application. These are outlined in the attached Schedule of documents.
I have decided to:
grant ful access to two documents
grant part access to 10 documents
refuse access to five documents.
Under section 35(1)(c) of the FOI Act, I have refused access to some of the information
that you have requested. In some cases this is because it is contrary to the public interest
information. The specific reasons are outlined in the attached Reasons for decision.
Copies of ful y and partially released documents are attached. In accordance with section
50 of the FOI Act, redactions have been applied to information that is contrary to the
public interest to disclose.
Online publishing – Disclosure Log
Under section 28 of the Act, Elections ACT maintains an online record of access
applications cal ed a disclosure log. Your original access application and my decision wil
be published on our disclosure log at
www.elections.act.gov.au/about us/freedom of information
Your personal details wil not be published.
Review of decision
Decisions on access requests are reviewable decisions as identified in schedule 3 of the
Act. You have the right to seek Ombudsman review of this outcome under section 73 of
the Act within 20 working days from the day that a decision is provided to you, or a
longer period allowed by the Ombudsman.
For more information and the application form for Ombudsman review, please visit:
www.ombudsman.act.gov.au/accountability-and-oversight/freedom-of-information/foi-
complaints-and-reviews
Alternatively, you may write to the Ombudsman at:
The ACT Ombudsman
GPO Box 442
CANBERRA ACT 2601
Via email:
xxxxxx@xxxxxxxxx.xxx.xx
Under section 84 of the Act, if a decision is made under section 82(1) on an Ombudsman
review, you may apply to the ACT Civil and Administrative Tribunal (ACAT) for review of
the Ombudsman decision.
— 3 —
Further information may be obtained from the ACAT at:
ACT Civil and Administrative Tribunal
GPO Box 370
CANBERRA CITY ACT 2601
Telephone: (02) 6207 1740
www.acat.act.gov.au/
Further information
If you have any queries concerning our processing of your request, or would like further
information, please contact
xxxxxxxxx@xxx.xxx.xx or cal (02) 6205 0033.
Yours sincerely
Ro Spence
Information Officer
Deputy Electoral Commissioner
ACT Electoral Commission
— 4 —
Reasons for decision
What you requested
“…documents held by the Commission relating to the requirements, design,
implementation, and security of electronic voting for the 2024 legislative assembly
election.
I ask that the documents be supplied to me in electronic form by reply email to this
address.
If identical documents were already supplied in 2020 or 2021, there is no need to supply
them again.”
Summary of my decision
I have decided to:
grant you ful access to two documents
grant you part access to 10 documents
refuse access to five documents
What I took into account
In reaching my decision, I took into account:
your access application dated 9 May 2024
the documents containing the information that falls within the scope of your access
application
consultation with a third party about information concerning them
your arguments for disclosure in the public interest:
o in maintaining election integrity and confidence in the results of elections
o in maintaining confidence in the security of Australian government information
systems, and
o the specific interest of the computer security research community in security
vulnerabilities in electronic voting systems.
the FOI Act, specifically sections 7, 16, 17 and Schedules 1 and 2
the ACT Ombudsman FOI Guidelines.
Reasons for my decision
I am authorised to make decisions under section 18 of the FOI Act. As a decision maker, I
am required to determine whether the information within scope is in the public interest to
release. To make this decision, I am required to:
— 5 —
assess whether the information would be contrary to public interest to disclose as per
Schedule 1 of the Act
perform the public interest test as set out in section 17 of the Act by balancing the
factors favouring disclosure and factors favouring non-disclosure in Schedule 2 of the
Act.
I have decided that some documents and parts of documents that contain the information
you requested contain information that is taken to be contrary to the public interest to
disclose under Schedule 1 of the FOI Act, or would be contrary to the public interest to
disclose under the test set out in section 17 of the FOI Act. My findings of fact and
reasons are discussed below.
Schedule 1
I have decided that some documents and parts of documents contain information that is
contrary to the public interest to disclose under Schedule 1 of the FOI Act.
Schedule 1, 1.13(1) – Information the disclosure of which would, or could reasonably
be expected to damage the security of the Commonwealth, the Territory or a State.
The ACT Ombudsman FOI Guidelines state that this should be interpreted to include
intangible damage. The Guidelines also state that release of information relating to the
Territory government’s information security arrangements could reasonably be expected
to facilitate cyber threats (see
FOI Guidelines Volume 4 – Considering the public interest).
The ACT Electoral Commission (the Commission) values the transparency of its electoral
ICT systems; acknowledging and supporting the view that transparency contributes to the
public’s confidence in the integrity of the ACT’s democratic systems and processes. This
has been a long-held view evidenced through the provision of the source code for the
Electronic Voting and Counting System (eVACS®) since the system’s inception in 2001.
However, the Commission also understands the importance of withholding critical design
and infrastructure elements so as to limit access to important information that could be
used by malicious actors to infiltrate the system. The Commission holds the view that a
suitable balance is required to deliver both a secure and trusted system.
I acknowledge that you seek disclosure of the information in the “… general public
interest in maintaining election integrity and confidence in the results of elections…[and]
the general public interest in maintaining confidence in the security of Australian
government information systems in light of increasing domestic and foreign cybersecurity
threats…”
Documents relevant to your application contain information that defines how the
Commission identifies and mitigates security risks. I am of the view that disclosure of this
information could, by the very act of disclosure, weaken the election integrity and security
that this application is seeking to assure. On this basis, I am satisfied disclosure of some
information contained in these documents could reasonably be expected to damage the
security of the Territory and has accordingly been withheld.
Schedule 2
I have decided that some documents and parts of documents that contain the information
you requested contain information that would, on balance, be contrary to the public
interest to disclose under the test set out in section 17 of the FOI Act. I have identified
— 6 —
that the fol owing factors are relevant to determine if release of the information contained
within these documents is within the public interest.
Factors favouring disclosure under Schedule 2 of the Act
Schedule 2, 2.1(a)(i) – promote open discussion of public affairs and enhance the
government’s accountability;
Schedule 2, 2.1(a)(i ) – contribute to positive and informed debate on important
issues or matters of public interest;
Schedule 2, 2.1(a)(xvi) – contribute to innovation and the facilitation of research.
Factors favouring nondisclosure under Schedule 2 of the Act
Schedule 2, 2.2(a)(xi) – prejudice trade secrets, business affairs or research of an
agency or person.
The ACT Ombudsman FOI Guidelines state that the FOI Act should not be used to obtain
commercial information about competitors, and that third parties should not be adversely
affected by the operation of the Act (see
FOI Guidelines Volume 4 – Considering the
public interest).
Documents relevant to your application contain information that could reasonably be
expected to impact the commercial interests of the company who developed the business
system on behalf of Elections ACT. The information includes trade secrets, proprietary
methodology, proprietary software, and internal business and commercial matters. It
includes information which is central to the functioning of the proprietary software used in
the Elections ACT business system.
In accordance with the FOI ACT and the Ombudsman Guidelines, I have considered
potential negative implications for the third party if this information were disclosed. This
includes reputational damage, increased competitive pressures, and diminished
commercial value of the information. I am satisfied the disclosure of some information
contained in these documents could reasonably be expected to prejudice trade secrets or
business affairs of an agency.
The public interest test set out in section 17 of the FOI Act involves a process of
balancing public interest factors favouring disclosure against public interest factors
favouring nondisclosure to decide whether, on balance, disclosure would be contrary to
the public interest. When weighing up the public interest for and against disclosure under
Schedule 2 of the FOI Act, I have taken into account relevant factors in favour of
disclosure, including your arguments in favour of the general public interest and the
specific interest of the computer security research community.
Based on the above, I have decided that the public interest in disclosing this information
is outweighed by the factors against disclosure. I am satisfied disclosure could reasonably
be expected to prejudice the trade secrets, business affairs or research of an agency or
person.
Having applied the test outlined in section 17 of the Act and deciding that release of
commercial and business information contained in the documents is not in the public
interest to release, I have chosen to redact this specific information in accordance with
section 50(2). Noting the pro-disclosure intent of the Act, I am satisfied that redacting
— 7 —
only the information that I believe is not in the public interest to release wil ensure that
the intent of the Act is met.
