If not delivered return to PO Box 7820 Canberra BC ACT 2610
14 January 2025
Our reference: LEX 82937
Nosey Rosey (Right to Know)
Only by email: xxxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxx.xxx.xx
Dear Nosey Rosey
Decision on your Freedom of Information Request
I refer to your request, received by Services Australia (the Agency) on 14 December 2024 for
access under the
Freedom of Information Act 1982 (the FOI Act) to the following documents:
I am seeking access to records held by Services Australia concerning a security
vulnerability identified within the MyService platform between 1 October 2024 and the
date your office processes this request. This vulnerability reportedly allowed
unauthorized access to veterans’ personal and sensitive information by altering
certain parameters in MyService’s web addresses. As Services Australia provides
information and communications technology support for the Department of Veterans’
Affairs, including the MyService platform, I request any documents you hold that
pertain to the discovery, investigation, and remediation of this vulnerability, as well as
the decisions made regarding notifications to affected individuals and the Of ice of the
Australian Information Commissioner (OAIC).
More specifically, I seek documents that record when and how Services Australia
became aware of the vulnerability, including any correspondence between Services
Australia staff and Department of Veterans’ Affairs personnel, or any other agencies
or service providers, where the existence or nature of this vulnerability was
discussed. I request any technical assessments, investigation reports, internal
briefings, risk assessments, or incident response records that detail the causes of the
vulnerability, the scope of information potentially exposed, the corrective steps taken
to address it, and any security or code changes applied to prevent similar incidents.
I also seek documents that discuss Services Australia’s role in advising the
Department of Veterans’ Affairs on whether this incident constituted an “eligible data
breach” under the Privacy Act 1988 (Cth). If you hold any records in which Services
Australia considered, commented on, or recommended particular actions regarding
notifying the OAIC or veterans whose data may have been exposed, I request access
to those as well. This includes any internal deliberations, guidance notes, or
communications with external parties about meeting the DVA’s or Services Australia’s
responsibilities under the Notifiable Data Breaches scheme.
If Services Australia maintains policies, guidelines, or standard operating procedures
that were consulted or applied in handling this vulnerability or determining the
appropriate response, I request copies of these documents. I also seek any records
that reflect final decisions, conclusions, or lessons learned, such as after-action
reviews or improvement plans relating to cybersecurity and privacy controls following
this incident.
PAGE 1 OF 7
My decision
I have decided to refuse your request under section 24(1) of the FOI Act because a 'practical
refusal reason' stil exists under section 24AA of the FOI Act. I am satisfied that the work
involved in processing your request would substantially and unreasonably divert the
resources of the Agency from its other operations as specified in section 24AA(1)(a)(i) of the
FOI Act.
The reasons for my decision, including the relevant sections of the FOI Act, are set out in
Attachment A.
You can ask for a review of our decision
If you disagree with the decision you can ask for a review. There are two ways you can do
this. You can ask for an internal review from within the agency, or an external review by the
Office of the Australian Information Commissioner. See
Attachment B for more information
about how to request a review.
Further assistance
If you have any questions, please email xxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxxxxx.xxx.xx.
Yours sincerely
Cherie
Authorised FOI Decision Maker
Freedom of Information Team
FOI and Reviews Branch | Legal Services Division
Services Australia
PAGE 2 OF 7
If not delivered return to PO Box 7820 Canberra BC ACT 2610
Attachment A
REASONS FOR DECISION
What you requested
I am seeking access to records held by Services Australia concerning a security
vulnerability identified within the MyService platform between 1 October 2024 and the
date your office processes this request. This vulnerability reportedly allowed
unauthorized access to veterans’ personal and sensitive information by altering
certain parameters in MyService’s web addresses. As Services Australia provides
information and communications technology support for the Department of Veterans’
Affairs, including the MyService platform, I request any documents you hold that
pertain to the discovery, investigation, and remediation of this vulnerability, as well as
the decisions made regarding notifications to affected individuals and the Of ice of the
Australian Information Commissioner (OAIC).
More specifically, I seek documents that record when and how Services Australia
became aware of the vulnerability, including any correspondence between Services
Australia staff and Department of Veterans’ Affairs personnel, or any other agencies
or service providers, where the existence or nature of this vulnerability was
discussed. I request any technical assessments, investigation reports, internal
briefings, risk assessments, or incident response records that detail the causes of the
vulnerability, the scope of information potentially exposed, the corrective steps taken
to address it, and any security or code changes applied to prevent similar incidents.
I also seek documents that discuss Services Australia’s role in advising the
Department of Veterans’ Affairs on whether this incident constituted an “eligible data
breach” under the Privacy Act 1988 (Cth). If you hold any records in which Services
Australia considered, commented on, or recommended particular actions regarding
notifying the OAIC or veterans whose data may have been exposed, I request access
to those as well. This includes any internal deliberations, guidance notes, or
communications with external parties about meeting the DVA’s or Services Australia’s
responsibilities under the Notifiable Data Breaches scheme.
If Services Australia maintains policies, guidelines, or standard operating procedures
that were consulted or applied in handling this vulnerability or determining the
appropriate response, I request copies of these documents. I also seek any records
that reflect final decisions, conclusions, or lessons learned, such as after-action
reviews or improvement plans relating to cybersecurity and privacy controls following
this incident.
Request consultation process
On 13 January 2025, we wrote to you providing a notice of intention to refuse your request
under section 24AB(2) of the FOI Act as your request was too big to process. I gave you an
opportunity to consult with the Agency to revise your request so as to remove the practical
refusal reason.
We advised that preliminary searches undertaken by the relevant business area of the
Agency identified more than 217 documents totalling over 2,201 pages. Noting, the majority
of these documents are emails.
We explained that it would take more than 118 hours to process the documents.
PAGE 3 OF 7
To assist you in clarifying the scope of your request (and with the view of removing the
potentially voluminous practical refusal reason), we asked that you consider the following:
• Limiting your request to documents of a certain type or format, such as
o reports, including reports to relevant external organisations, such as DVA
and/or the OAIC
o technical assessments, investigation reports, internal briefings, risk
assessments, or incident response records.
• Requesting documents of most importance first, noting you may lodge a new request
for further documents (if required) once the initial matter is processed.
On the same day (13 January 2025), you advised that you did not wish to revise your
request.
What I took into account
In reaching my decision I took into account:
• your request dated 14 December 2024
• your response to the consultation notice received on 13 January 2025
• the information requested and documents that fall within the scope of your request
• consultations with Agency officers about:
o the nature of the documents
o the Agency's operating environment and functions
• guidelines issued by the Australian Information Commissioner under section 93A of
the FOI Act (the Guidelines), and
• the FOI Act.
Reasons for my decisions
I am authorised to make decisions under section 23(1) of the FOI Act.
Following the request consultation process outlined above, in accordance with section 24AB
of the FOI Act, I am satisfied that a practical refusal reason stil exists in that the work
involved in processing your request would substantially and unreasonably divert the
resources of the Agency from its other operations. The reasons for my decision, including
consideration of the factors I am required to take into account in section 24AA(2), are
outlined below.
Practical refusal reason
Section 24AA of the FOI Act provides that a practical refusal reason exists in relation to a
request for a document if the work involved in processing the request would:
'substantially and unreasonably divert the resources of the agency from its other
operations'.
The word 'substantial' has previously been interpreted to mean severe, of some gravity, large
or weighty or of considerable amount, real or of substance and not insubstantial or of
PAGE 4 OF 7
nominal consequence. The use of the word 'unreasonable' has been interpreted to mean
that a weighing of all relevant considerations is needed, including the extent of the resources
needed to meet the request.
In determining whether processing the request would substantially and unreasonably divert
the Agency's resources, section 24AA(2) requires me to have regard to the resources that
would have to be used for the following:
• identifying, locating or col ating the documents within the filing system of the Agency
• deciding whether to grant, refuse or defer access to a document including resources
used for examining the document and consulting with any person or body in relation
to the request
• making a copy or an edited copy of the document, and
• notifying of any decision on the request.
In accordance with section 24AA(3), I did not consider your reasons for requesting access to
the documents.
Why your request is substantial
In making my decision I estimate that your request would require more than 118 hours of
processing time. This includes approximately 8 hours for search and retrieval of the
documents, time taken to save documents into the required format, and over 110 hours to
review each page line by line to determine if any material requires redaction - that is the
possible deletion of material, for example, any private information about a third-party individual,
or sensitive operational material. This is a conservative calculation based on 3 minutes to
review each page, which does not include the time for any further internal or external
consultations that may be required, and decision-making.
Why your request is unreasonable
For the purposes of deciding whether your request would unreasonably divert the resources
of the Agency from its other operations, I considered whether the substantial resource
burden would be unreasonable having regard to the following:
• one individual would be required to spend more than 118 hours processing your
request (this is a conservative estimate that excludes any external consultations that
may be required and decision-making time)
• the Agency receives more than 4,500 FOI requests per year, the majority of which
are requests from people seeking their own information. I am satisfied that the
processing of your request would divert Agency resources from the processing of
these other requests, as well as business-as-usual activities providing services to the
Australian public.
Conclusion
In summary I am satisfied that the work involved in processing your request would substantially
and unreasonably divert the resources of the Agency from its other operations, namely the
processing of other FOI requests and the delivery of social services to all Australians more
broadly. I have found that a practical refusal reason exists in relation to your request for access
to the documents. Accordingly, I have decided to refuse your request under section 24(1) of
the FOI Act.
PAGE 5 OF 7
If not delivered return to PO Box 7820 Canberra BC ACT 2610
Attachment B
INFORMATION ON RIGHTS OF REVIEW
FREEDOM OF INFORMATION ACT 1982
Asking for a ful explanation of a freedom of information (FOI) decision
Before you ask for a formal review of a FOI decision, you can contact us to discuss your
request. We wil explain the decision to you. This gives you a chance to correct
misunderstandings.
Asking for a formal review of an FOI decision
If you stil believe a decision is incorrect, the
Freedom of Information Act 1982 (FOI Act)
gives you the right to apply for a review of the decision. Under sections 54 and 54L of the
FOI Act, you can apply for a review of an FOI decision by:
1. an Internal Review Of icer in Services Australia (the Agency), and/or
2. the Australian Information Commissioner.
Applying for an internal review by an Internal Review Officer
If you apply for internal review, a dif erent decision maker to the Agency delegate who made
the original decision wil carry out the review. The Internal Review Of icer wil consider all
aspects of the original decision and decide whether it should change. An application for
internal review must be:
• made in writing
• made within 30 days of receiving this letter
• sent to the address at the top of the first page of this letter, or by email to
xxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxxxxx.xxx.xx
Note: You do not need to fil in a form. However, it is a good idea to set out any relevant
submissions you would like the Internal Review Officer to further consider, and your reasons
for disagreeing with the decision.
Applying for external review by the Australian Information Commissioner
If you do not agree with the original decision or the internal review decision, you can ask the
Australian Information Commissioner to review the decision.
If you do not receive a decision from an Internal Review Of icer in the Agency within 30 days
of applying, you can ask the Australian Information Commissioner for a review of the original
FOI decision.
You wil have 60 days to apply in writing for a review by the Australian Information
Commissioner.
PAGE 6 OF 7
You can lodge your application:
Online:
www.oaic.gov.au
Post:
Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Email:
xxxxx@xxxx.xxx.xx
Note: The Of ice of the Australian Information Commissioner generally prefers FOI
applicants to seek internal review before applying for external review by the Australian
Information Commissioner.
Important:
• If you are applying online, the application form the 'FOI Review Form' is available at
Information Commissioner Review Application form
• If you have one, you should include with your application a copy of the Agency's
decision on your FOI request
• Include your contact details
• Set out your reasons for objecting to the Agency's decision.
Complaints to the Australian Information Commissioner and Commonwealth
Ombudsman
Australian Information Commissioner
You may complain to the Australian Information Commissioner concerning action taken by
an agency in the exercise of powers or the performance of functions under the FOI Act,
There is no fee for making a complaint. A complaint to the Australian Information
Commissioner must be made in writing. The Australian Information Commissioner's contact
details are:
Telephone: 1300 363 992
Website: www.oaic.gov.au
Smart Form: FOI Complaint Form
Commonwealth Ombudsman
You may also complain to the Commonwealth Ombudsman concerning action taken by an
agency in the exercise of powers or the performance of functions under the FOI Act. There is
no fee for making a complaint. A complaint to the Commonwealth Ombudsman may be
made in person, by telephone or in writing. The Commonwealth Ombudsman's contact
details are:
Phone: 1300 362 072
Website: www.ombudsman.gov.au
The Commonwealth Ombudsman generally prefers applicants to seek review before
complaining about a decision.
PAGE 7 OF 7
