PO Box 7820, Canberra BC ACT 2610
13 January 2025
Our reference: LEX 82937
Only by email: xxxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxx.xxx.xx
Dear Nosey Rosey
Your Freedom of Information Request
I refer to your request received by Services Australia (the Agency) on 14 December 2024 for
access under the
Freedom of Information Act 1982 (the FOI Act) to the following documents:
I am seeking access to records held by Services Australia concerning a security
vulnerability identified within the MyService platform between 1 October 2024 and the
date your office processes this request. This vulnerability reportedly allowed
unauthorized access to veterans’ personal and sensitive information by altering
certain parameters in MyService’s web addresses. As Services Australia provides
information and communications technology support for the Department of Veterans’
Affairs, including the MyService platform, I request any documents you hold that
pertain to the discovery, investigation, and remediation of this vulnerability, as well as
the decisions made regarding notifications to affected individuals and the Office of the
Australian Information Commissioner (OAIC).
More specifically, I seek documents that record when and how Services Australia
became aware of the vulnerability, including any correspondence between Services
Australia staff and Department of Veterans’ Affairs personnel, or any other agencies
or service providers, where the existence or nature of this vulnerability was
discussed. I request any technical assessments, investigation reports, internal
briefings, risk assessments, or incident response records that detail the causes of the
vulnerability, the scope of information potentially exposed, the corrective steps taken
to address it, and any security or code changes applied to prevent similar incidents.
I also seek documents that discuss Services Australia’s role in advising the
Department of Veterans’ Affairs on whether this incident constituted an “eligible data
breach” under the Privacy Act 1988 (Cth). If you hold any records in which Services
Australia considered, commented on, or recommended particular actions regarding
notifying the OAIC or veterans whose data may have been exposed, I request access
to those as well. This includes any internal deliberations, guidance notes, or
communications with external parties about meeting the DVA’s or Services Australia’s
responsibilities under the Notifiable Data Breaches scheme.
PAGE 1 OF 6
PO Box 7820, Canberra BC ACT 2610
If Services Australia maintains policies, guidelines, or standard operating procedures
that were consulted or applied in handling this vulnerability or determining the
appropriate response, I request copies of these documents. I also seek any records
that reflect final decisions, conclusions, or lessons learned, such as after-action
reviews or improvement plans relating to cybersecurity and privacy controls following
this incident.
Currently your request in its current terms is potentially voluminous and would capture a high
volume of material, making it too large for the Agency to process. The Agency is formally
consulting with you under section 24AB of the FOI Act.
This letter is giving you an opportunity to revise your request and give us more specific
details about the documents you are seeking. Providing this information will assist the
Agency in processing your request.
If you decide not to provide further information or revise your request, I will have to refuse
your request as a ‘practical refusal reason’ exists. For a more detailed explanation of what
this means, and suggestions on what to consider when revising your request, please see
Attachment A.
How to send us a 'revised request'
Before we make a final decision on your request, you can submit a revised request.
Within the next 14 days (consultation period) you must do one of the following, in writing:
• withdraw the request
• make a revised request, or
• tell us you do not want to revise your request.
The consultation period begins the day after you receive this notice. Accordingly, your
response is expected by
27 January 2025.
If you do not contact us during the consultation period, your request will be taken as
withdrawn by operation of the FOI Act. See
Attachment A for relevant sections of the FOI
Act.
If you decide to make a revised request, you should be specific about the documents you are
seeking access to. This could help the Agency identify the documents in less time and
require fewer resources to process your request.
The Agency has 30 days to give you a decision about your request, however the time taken
to consult with you now is not included in this 30 day period.
Contact officer
I am the contact officer for your request. During the consultation period you are welcome to
ask for my help in revising your request. You can contact me:
• via email to arrange a phone call, by providing a contact number and advising of a
suitable time
• in writing to the address at the top of this letter, or
PAGE 2 OF 6
PO Box 7820, Canberra BC ACT 2610
• via email to xxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxxxxx.xxx.xx
Note: When you contact us please quote the reference number
FOI LEX 82937.
Further assistance
If you have any questions, please email xxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxxxxx.xxx.xx
Yours sincerely
Hannah
Authorised FOI Decision Maker
Freedom of Information Team
FOI and Reviews Branch | Legal Services Division
Services Australia
PAGE 3 OF 6
PO Box 7820, Canberra BC ACT 2610
Attachment A
What I took into account
You requested access under the FOI Act to the following documents:
I am seeking access to records held by Services Australia concerning a security
vulnerability identified within the MyService platform between 1 October 2024 and the
date your office processes this request. This vulnerability reportedly allowed
unauthorized access to veterans’ personal and sensitive information by altering
certain parameters in MyService’s web addresses. As Services Australia provides
information and communications technology support for the Department of Veterans’
Affairs, including the MyService platform, I request any documents you hold that
pertain to the discovery, investigation, and remediation of this vulnerability, as well as
the decisions made regarding notifications to affected individuals and the Office of the
Australian Information Commissioner (OAIC).
More specifically, I seek documents that record when and how Services Australia
became aware of the vulnerability, including any correspondence between Services
Australia staff and Department of Veterans’ Affairs personnel, or any other agencies
or service providers, where the existence or nature of this vulnerability was
discussed. I request any technical assessments, investigation reports, internal
briefings, risk assessments, or incident response records that detail the causes of the
vulnerability, the scope of information potentially exposed, the corrective steps taken
to address it, and any security or code changes applied to prevent similar incidents.
I also seek documents that discuss Services Australia’s role in advising the
Department of Veterans’ Affairs on whether this incident constituted an “eligible data
breach” under the Privacy Act 1988 (Cth). If you hold any records in which Services
Australia considered, commented on, or recommended particular actions regarding
notifying the OAIC or veterans whose data may have been exposed, I request access
to those as well. This includes any internal deliberations, guidance notes, or
communications with external parties about meeting the DVA’s or Services Australia’s
responsibilities under the Notifiable Data Breaches scheme.
If Services Australia maintains policies, guidelines, or standard operating procedures
that were consulted or applied in handling this vulnerability or determining the
appropriate response, I request copies of these documents. I also seek any records
that reflect final decisions, conclusions, or lessons learned, such as after-action
reviews or improvement plans relating to cybersecurity and privacy controls following
this incident.
Because of the amount of work involved for the Agency, under sections 24AA(1)(a)(i), 24 and
24AA(2) of the FOI Act, I intend to refuse your FOI request as it currently stands, as a
'practical refusal reason' exists. I am satisfied a practical refusal reasons exists on the basis
that processing your request 'would substantially and unreasonably divert the resources' of
the Agency.
As such, we are seeking you to consider revising your request. Please find below some
information that may assist you in your consideration.
PAGE 4 OF 6
PO Box 7820, Canberra BC ACT 2610
To process your request the Agency would have to undertake extensive searches to find and
process the documents you have requested. We have consulted with the relevant business
area to undertake preliminary searches for documents in scope of your request. These
searches have identified more than 217 documents totalling over 2,201 pages. The majority
of these documents are emails.
Based on my experience with the type and volume of documents, I estimate it would take
more than 118 hours to process the documents. This includes approximately 8 hours for
search and retrieval of the documents, time taken to save documents into the required
format, and over 110 hours to review each page line by line to determine if any material
requires redaction - that is the possible deletion of material, for example, any private
information about a third-party individual, or sensitive operational material. This is a
conservative calculation based on 3 minutes to review each page, which does not include the
time for any further internal or external consultations that may be required, and decision-
making.
Additionally, based on information provided by the relevant business area, I consider that a
courtesy consultation with the Department of Veteran’s Affairs (DVA) is likely required for the
documents in scope of your request. This is because the subject matter of your request
concerns matters relating to DVA.
The FOI Act provides that a document is conditionally exempt from release if its release
would have a substantial adverse effect on the proper and efficient conduct of the operations
of the Agency (section 47E(d)). Noting the subject of your request concerns a security
vulnerability, the Agency will need to consider any sensitivities and risks with release of any
cyber security material that may appear in documents in scope of your request.
Therefore, in addition to any other exemptions that may apply, I consider the section 47E(d)
exemption may apply to the documents, or parts thereof, that you have requested.
Processing a request of this size would require a diversion of resources across multiple
business areas to process. This would impact the Agency’s ability to conduct its business-as-
usual activities and provide services to the Australian public.
Assistance with your request
To assist you in clarifying the scope of your request (and with the view of removing the
potentially voluminous practical refusal reason), please consider the following:
• You may wish to consider limiting your request to documents of a certain type or
format, such as
o reports, including reports to relevant external organisations, such as DVA
and/or the OAIC
o technical assessments, investigation reports, internal briefings, risk
assessments, or incident response records
• Requesting documents of most importance first, noting you may lodge a new request
for further documents (if required) once the initial matter is processed.
PAGE 5 OF 6
PO Box 7820, Canberra BC ACT 2610
Relevant sections of the Freedom of Information Act 1982
Section 24AA(1)(a)(i) of the FOI Act provides a practical refusal reason exists in relation to a
FOI request if the work involved in processing the request would substantially and
unreasonably divert the resources of the Agency from its other operations.
Section 24AA(2) of the FOI Act sets out certain factors which the Agency must consider
when determining whether providing access in relation to a request would substantially and
unreasonably divert the Agency's resources. The Agency must specifically have regard to the
resources which would have to be used for:
• identifying, locating or collating the documents within Services Australia's filing
system
• deciding whether to grant, refuse or defer access to a document to which the request
relates, or to grant access to an edited copy of such a document, including resources
that would have to be used for examining the document or consulting in relation to the
request
• making a copy, or an edited copy, of the document, and
• notifying any interim or final decision on the request.
Section 24AB(6) of the FOI provides the applicant must, before the end of the consultation
period, do one of the following, by written notice to the Agency:
• withdraw the request,
• make a revised request, or
• indicate that the applicant does not wish to revise the request.
Section 24AB(7) of the FOI Act provides the request is taken to have been withdrawn at the
end of the consultation period if:
• the applicant does not consult the contact person during the consultation period in
accordance with the notice, or
• the applicant does not do one of the things mentioned in subsection (6) before the
end of the consultation period.
PAGE 6 OF 6
