NDIS - Personal Devices (BYOD) usage, control, protection and public accountability
Dear National Disability Insurance Agency,
How many personal devices (mobile phones, tablets, etc) are used at the NDIS for the conduct of government and NDIA business? What I mean is, how many contractors, public servants and people that work at or for the NDIS use their own devices for government 'work'?
What has been the total of personal devices used within the NDIS for the past 5 years? (if any)
If personal devices (and email) have been used, have they all been inspected, monitored and certified to Australian Government cybersecurity standards and requirements? Please provide specific proof, such as a report or official statement.
If personal devices (and email) have been used (this includes adding personal email profiles and ID's to MS teams environments, calls, schedules and communications), has all data, communications and information been captured and retained by the NDIS, in accordance with the National Archives Act, any public information record keeping requirements and therefore accessible via FOI, if requested?
How many of the NDIA executive population (SES, EL1, EL2, etc) have, do or did use a personal device for NDIA/NDIS business and government administration this year and over the past 5 years? If any.
Have any of these personal devices/profiles (if any) been affected by the Optus hack? If so, how many?
In other countries and industries, the use of personal devices (BYOD), outside the control and capture of public record keeping has been a major issue, resulting in criminal charges and considerable fines, I hear. Like this one:
SEC Charges 16 Wall Street Firms with Widespread Record-keeping Failures
Firms admit to wrongdoing and agree to pay penalties totalling more than $1.1 billion
https://www.sec.gov/news/press-release/2...
Yours faithfully,
Josh
Thank you for your email to the National Disability Insurance Agency
(NDIA) Freedom of Information (FOI) team.
If your email relates to an FOI application made under the Commonwealth
Freedom of Information Act 1982 (FOI Act), the Agency will respond to you
as soon as practicable.
This email address is for applications under the FOI Act only. The Agency
is unable to respond to non-FOI related enquiries sent to this email
address. Any correspondence received that is not an information access
request will not be responded to or forwarded.
If you are seeking to access your personal documents, please consider
submitting your request through our [1]Participant Information Access
(PIA) web-form, which will allow the matter to be processed
administratively.
Should you have a query unrelated to FOI, please contact us by emailing at
[2][email address] or via webchat at [3]NDIA Web Chat (ndis.gov.au).
Alternatively you can also contact us by phoning 1800 800 110.
If you have any questions about making an FOI request, or to enquire about
a current FOI request, please email us with your phone number and a
preferred time for us to call you, and an FOI Decision Maker will call you
back.
Kind regards
Freedom of Information team
Parliamentary, Ministerial & FOI Branch
Government
National Disability Insurance Agency
Email: [4][NDIA request email]
References
Visible links
1. https://aus01.safelinks.protection.outlo...
2. mailto:[email address]
3. https://aus01.safelinks.protection.outlo...
4. mailto:[NDIA request email]
Dear Josh
Freedom of Information Request: Acknowledgement
Thank you for your request of 1 October 2022, made under the Freedom of
Information Act 1982 (FOI Act), for copies of documents held by the
National Disability Insurance Agency (NDIA).
Scope of your request
You have requested access to the following documents:
“How many personal devices (mobile phones, tablets, etc) are used at the
NDIS for the conduct of government and NDIA business? What I mean is, how
many contractors, public servants and people that work at or for the NDIS
use their own devices for government 'work'?
What has been the total of personal devices used within the NDIS for the
past 5 years? (if any)
If personal devices (and email) have been used, have they all been
inspected, monitored and certified to Australian Government cybersecurity
standards and requirements? Please provide specific proof, such as a
report or official statement.
If personal devices (and email) have been used (this includes adding
personal email profiles and ID's to MS teams environments, calls,
schedules and communications), has all data, communications and
information been captured and retained by the NDIS, in accordance with the
National Archives Act, any public information record keeping requirements
and therefore accessible via FOI, if requested?
How many of the NDIA executive population (SES, EL1, EL2, etc) have, do or
did use a personal device for NDIA/NDIS business and government
administration this year and over the past 5 years? If any.
Have any of these personal devices/profiles (if any) been affected by the
Optus hack? If so, how many?
In other countries and industries, the use of personal devices (BYOD),
outside the control and capture of public record keeping has been a major
issue, resulting in criminal charges and considerable fines, I hear. Like
this one:
SEC Charges 16 Wall Street Firms with Widespread Record-keeping Failures
Firms admit to wrongdoing and agree to pay penalties totalling more than
$1.1 billion [link]”
Unless you advise otherwise, we will take it that you agree to the names
and contact details of NDIA staff being excluded from the scope of your
request (that is, the information will be treated as irrelevant).
Processing timeframes
A 30-day statutory period for processing your request commenced from 2
October 2022, in accordance with section 15(2A)(c) of the FOI Act. You
should, therefore, expect a decision from us by 31 October 2022.
This period may be extended if we need to consult with third parties or
for other reasons. We will advise you if this happens.
Charges
We may apply a processing charge to your request and will advise you as
soon as practicable if a charge is payable.
Disclosure Log
Information released under the FOI Act may be published on the NDIA’s
disclosure log located on our website, subject to certain exceptions.
If you have any concerns about the publication of information you have
requested, please contact us.
Further help
Please contact us at [1][NDIA request email] if you have any questions or need
help.
We will contact you using the email address you provided. Please advise if
you would prefer us to use an alternative means of contact.
Kind regards
Freedom of Information Officer
Parliamentary, Ministerial and FOI Branch
Government Division
National Disability Insurance Agency
E: [2][NDIA request email]
[3]Title: NDIS delivered by the National Disability Insurance Agency
[4]LGBTIQA+ rainbow graphic
The NDIA acknowledges the Traditional Custodians of Country throughout
Australia and their continuing connection to land, sea and community. We
pay our respects to them and their cultures and to Elders past, present
and emerging.
[5]Aboriginal and Torres Strait Islander flags graphic
References
Visible links
1. mailto:[NDIA request email]
2. mailto:[NDIA request email]
4. https://intranet.ndiastaff.ndia.gov.au/h...
Dear Josh
Thank you for your request for information.
We’re sorry to let you know that it’s taken us longer than expected to
process your request. This is because we require additional time to
complete internal consultations in order to identify all of the documents
falling within the scope of your request.
We are therefore writing to seek your agreement to a 30-day extension of
time to process your request for information under section 15AA of the FOI
Act. If you agree to this extension, the new due date will be 30 November
2022.
Please let us know whether you agree by COB 31 October 2022.
If you don’t agree, we may seek an extension from the Office of Australian
Information Commissioner.
We’re sorry that it’s taken us longer than expected and we appreciate your
patience.
Please contact us at [1][NDIA request email] if you have any questions or
require help.
Kind regards
Freedom of Information Officer
Parliamentary, Ministerial and FOI Branch
Government Division
National Disability Insurance Agency
E: [2][NDIA request email]
[3]Title: NDIS delivered by the National Disability Insurance Agency
[4]LGBTIQA+ rainbow graphic
The NDIA acknowledges the Traditional Custodians of Country throughout
Australia and their continuing connection to land, sea and community. We
pay our respects to them and their cultures and to Elders past, present
and emerging.
[5]Aboriginal and Torres Strait Islander flags graphic
References
Visible links
1. mailto:[NDIA request email]
2. mailto:[NDIA request email]
4. https://intranet.ndiastaff.ndia.gov.au/h...
Thank you for your email to the National Disability Insurance Agency
(NDIA) Freedom of Information (FOI) team.
If your email relates to an FOI application made under the Commonwealth
Freedom of Information Act 1982 (FOI Act), we will respond to you as soon
as practicable.
This email address is for applications under the FOI Act only. Our team is
unable to respond to non-FOI related enquiries sent to this email address.
Any correspondence received that is not related to an FOI request will not
be responded to or forwarded.
Please be aware: due to a high volume of requests, our ability to respond
to you in a timely manner has been affected. However, we will action your
request as soon as possible.
Information about how to make an FOI request can be found on our website:
[1]Freedom of Information | NDIS.
The FOI Act sets out the criteria that must be met for a request to be
considered. The request you send us must:
* be in writing
* state that the request is an application for the purposes of the FOI
Act
* provide enough information to allow us to identify the documents you
are requesting
* provide an address for reply, either electronic or hard copy.
If you are seeking access to personal documents such as an NDIS Plan or
medical reports, please consider submitting your request through our
[2]Participant Information Access (PIA) web-form, This process will enable
you to receive applicable documents administratively, which is an easier
process than through the FOI Act.
If you have any questions about making an FOI request, or to enquire about
a current FOI request, please email us with your preferred contact method
and an FOI Decision Maker will contact you.
Should you have a query unrelated to FOI, please contact the Agency by
emailing at [3][email address] or via webchat at [4]NDIA Web Chat
(ndis.gov.au). Alternatively, you can also contact us by phoning 1800 800
110.
Kind regards
Freedom of Information Team
Parliamentary, Ministerial and FOI Branch
Government Division
National Disability Insurance Agency
E: [5][NDIA request email]
References
Visible links
1. https://www.ndis.gov.au/about-us/policie...
2. https://aus01.safelinks.protection.outlo...
3. mailto:[email address]
4. https://aus01.safelinks.protection.outlo...
5. mailto:[NDIA request email]
Dear Josh
Thank you for your request for information.
We are writing to advise you that we have lodged a request with the Office
of the Australian Information Commissioner (OAIC) for a 30-day extension
of time under section 15AB of the FOI Act. You will receive an outcome to
this request directly from the OAIC.
We’re sorry that it’s taken us longer than expected and we appreciate your
patience.
Please contact us at [1][NDIA request email] if you have any questions or
require help.
Kind regards
Freedom of Information Officer
Parliamentary, Ministerial and FOI Branch
Government Division
National Disability Insurance Agency
E: [2][NDIA request email]
[3]Title: NDIS delivered by the National Disability Insurance Agency
[4]LGBTIQA+ rainbow graphic
The NDIA acknowledges the Traditional Custodians of Country throughout
Australia and their continuing connection to land, sea and community. We
pay our respects to them and their cultures and to Elders past, present
and emerging.
[5]Aboriginal and Torres Strait Islander flags graphic
References
Visible links
1. mailto:[NDIA request email]
2. mailto:[NDIA request email]
4. https://intranet.ndiastaff.ndia.gov.au/h...
Our reference: RQ22/04377
Agency reference: FOI 22/23-0589
Josh
Sent by email: [1][FOI #9419 email]
Extension of time application by National Disability Insurance Agency
Dear Josh
I write to advise that on 29 November 2022 the Office of the Australian
Information Commissioner (OAIC) received an application from the National
Disability Insurance Agency (NDIA) for an extension of time, to process
your FOI request of 1 October 2022.
The NDIA has applied for an extension of time under s 15AB of the Freedom
of Information Act 1982 (Cth) because your request is considered to be
complex.
The NDIA has advised the OAIC that:
· The request is considered complex as its scope has multiple parts
requiring careful consideration. This has necessitated internal
consultations with four different line areas, which have been carried out
at different times.
· There has been delay in processing the request caused by staff
departures.
· Further time is required to carry out further internal
consultation to ensure that all documents within the scope of the request
are captured. Following this, a decision can be finalised.
The NDIA has requested an extension to 30 December 2022. I will take any
comments you may have to make into account when deciding the application.
Please respond to this email by close of business 15 December 2022. If I
do not hear from you by this date, the decision maker will make a decision
on the basis of the information provided to me by the NDIA.
You will be notified of the decision once the matter has been finalised.
Further information about extension of time requests may be found on our
website at [2]Extensions of time.
If you have any questions regarding this email please contact me via email
to [3][email address]. Please quote OAIC reference: RQ22/04377 in all
correspondence.
Kind regards
Noah Harris
[4][IMG] Intake and Early Resolution Team
Freedom of Information Regulatory Group
Office of the Australian Information
Commissioner
GPO Box 5218 Sydney NSW 2001 |
[5]oaic.gov.au
1300 363 992 [6][email address]
[7][IMG] | [8][IMG] | [9][IMG] | [10]Subscribe to OAICnet newsletter
Notice:
The information contained in this email message and any attached files may
be confidential information, and may also be the subject of legal
professional privilege. If you are not the intended recipient any use,
disclosure or copying of this email is unauthorised. If you received this
email in error, please notify the sender by contacting the department's
switchboard on 1300 488 064 during business hours (8:30am - 5pm Canberra
time) and delete all copies of this transmission together with any
attachments.
References
Visible links
1. mailto:[FOI #9419 email]
2. https://www.oaic.gov.au/freedom-of-infor...
3. mailto:[email address]
4. https://aus01.safelinks.protection.outlo...
5. https://aus01.safelinks.protection.outlo...
6. mailto:[email address]
7. https://aus01.safelinks.protection.outlo...
8. https://aus01.safelinks.protection.outlo...
9. https://aus01.safelinks.protection.outlo...
10. https://aus01.safelinks.protection.outlo...
Dear OAIC - FOI DR,
Thank you for the update and follow up. As seems typical with the NDIS, they are never able to respond within 30 days and have been using the excuse of COVID, staff departure, complexity and 'other' demands for failing to comply for years! As a Commonwealth entity, they seem to have no business continuity or risk management measures in place, which is extremely concerning. Given the security, cybersecurity and governance demands of a Commonwealth entity, a BYOD request should seem a very straightforward request, especially if the information is already consolidated and managed on a day-to-day basis. If not, stalling would seem logical, which poses considerable safety, security and risk concerns for participants, the government and Australian community.
All that being said, I seem to have little choice. Extension approved. However, 3 months to respond makes a mockery of the FOI legislation and government transparency, let alone on a highly concerning matter such as cybersecurity, data protection and controlled privacy of people's information. Which I would reasonably assume the OAIC would hold the NDIS more accountable for.
Further delays and requests for extensions should raise major red flags for the government, participants and Australian citizens.
Yours sincerely,
Josh
Our reference: RQ22/04377
Agency reference: FOI 22/23-0589
Josh
By email: [1][FOI #9419 email]
CC: [2][NDIA request email]
Extension of time under s 15AB
Dear Josh
Please find attached an FOI Extension of time decision relating to your
FOI Request with the NDIA. A copy of this decision has been provided to
the NDIA today.
Sincerely
Alistair B
[3][IMG] Intake and Early Resolution Team
Freedom of Information Regulatory Group
Office of the Australian Information
Commissioner
GPO Box 5288 Sydney NSW 2001 |
[4]oaic.gov.au
1300 363 992 | [5][email address]
[6][IMG] | [7][IMG] | [8][IMG] | [9]Subscribe to OAICnet newsletter
Notice:
The information contained in this email message and any attached files may
be confidential information, and may also be the subject of legal
professional privilege. If you are not the intended recipient any use,
disclosure or copying of this email is unauthorised. If you received this
email in error, please notify the sender by contacting the department's
switchboard on 1300 488 064 during business hours (8:30am - 5pm Canberra
time) and delete all copies of this transmission together with any
attachments.
References
Visible links
1. mailto:[FOI #9419 email]
2. mailto:[NDIA request email]
3. https://aus01.safelinks.protection.outlo...
4. https://aus01.safelinks.protection.outlo...
5. mailto:[email address]
6. https://aus01.safelinks.protection.outlo...
7. https://aus01.safelinks.protection.outlo...
8. https://aus01.safelinks.protection.outlo...
9. https://aus01.safelinks.protection.outlo...
Dear Josh
Thank you for your request for information.
We are writing to advise you that we have lodged a request with the Office
of the Australian Information Commissioner (OAIC) for a further 15-day
extension of time under section 15AB of the FOI Act. You will receive an
outcome to this request directly from the OAIC.
This is because the NDIA is entering a reduced activity period until 3
January 2023, which means that the FOI team will be unable to progress
your request further until that point.
We’re sorry that it’s taken us longer than expected and we appreciate your
patience.
Please contact us at [1][NDIA request email] if you have any questions or
require help.
Kind regards
Freedom of Information Officer
Parliamentary, Ministerial & FOI Branch
Government Division
National Disability Insurance Agency
E [2][NDIA request email]
[3]NDIA logo
[4]LGBTIQA+ rainbow graphic
The NDIA acknowledges the Traditional Custodians of Country throughout
Australia and their continuing connection to land, sea and community. We
pay our respects to them and their cultures and to Elders past, present
and emerging.
[5]Aboriginal and Torres Strait Islander flags graphic
References
Visible links
1. mailto:[NDIA request email]
2. mailto:[NDIA request email]
4. https://aus01.safelinks.protection.outlo...
Our reference: RQ22/05089
Agency reference: FOI 22/23-0589
Josh
Sent by email: [1][FOI #9419 email]
Extension of time application by National Disability Insurance Agency
Dear Josh
I write to advise that on 23 December 2022 the Office of the Australian
Information Commissioner (the OAIC) received an application from National
Disability Insurance Agency (NDIA) for an extension of time, to process
your FOI request of 1 October 2022.
The NDIA has applied for an extension of time under s 15AB of the Freedom
of Information Act 1982 (Cth) because your request is considered to be
voluminous and complex.
NDIA has advised the OAIC that:
The request is complex as its scope has multiple parts that have required
careful consideration to ensure that all documents relevant to the request
are being considered. Interpretation of the scope has required internal
consultation with four different line areas, as the statement of the scope
is quite broad, and interpretation of the scope relies on detailed
knowledge of the operation of the agency in multiple areas, even before
document searches can be undertaken.
The ongoing impact of reduced NDIA staff and resourcing has limited the
FOI team's ability to process requests in a timely manner.
NDIA has requested an extension to 14 January 2023. I will take any
comments you may have to make into account when deciding the application.
Please respond to this email by close of business 6 January 2023. If I
do not hear from you by this date, the decision maker will make a decision
on the basis of the information provided to me by the NDIA.
You will be notified of the decision once the matter has been finalised.
Further information about extension of time requests may be found on our
website at [2]Extensions of time.
Contact
If you have any questions regarding this email, please contact me via
email at [email address]. Please quote OAIC reference: RQ22/05089 in all
correspondence.
Sincerely
Alistair B
[3][IMG] Intake and Early Resolution Team
Freedom of Information Regulatory Group
Office of the Australian Information
Commissioner
GPO Box 5288 Sydney NSW 2001 |
[4]oaic.gov.au
1300 363 992 | [5][email address]
[6][IMG] | [7][IMG] | [8][IMG] | [9]Subscribe to OAICnet newsletter
Notice:
The information contained in this email message and any attached files may
be confidential information, and may also be the subject of legal
professional privilege. If you are not the intended recipient any use,
disclosure or copying of this email is unauthorised. If you received this
email in error, please notify the sender by contacting the department's
switchboard on 1300 488 064 during business hours (8:30am - 5pm Canberra
time) and delete all copies of this transmission together with any
attachments.
References
Visible links
1. mailto:[FOI #9419 email]
2. https://www.oaic.gov.au/freedom-of-infor...
3. https://aus01.safelinks.protection.outlo...
4. https://aus01.safelinks.protection.outlo...
5. mailto:[email address]
6. https://aus01.safelinks.protection.outlo...
7. https://aus01.safelinks.protection.outlo...
8. https://aus01.safelinks.protection.outlo...
9. https://aus01.safelinks.protection.outlo...
Dear OAIC - FOI DR,
Thank you for the update and information. I understand and like before, with little choice or agency, I look forward to receiving the requested information, nearly 4 months (120 days) after my request on 1 Oct 22.
Three questions:
1. Is it routine for the NDIA sneak around, negotiate extensions and delays with the OAIC, well before communicating with the applicant?
2. With respect, the request is not complex. As a result, the NDIA seems intent on overstating the issue and requirement, for some reason(s). Respectfully, the NDIA either have a tally of how many personal devices (non government, non secure, ad-hoc/random devices) are or have been connected to the NDIA digital systems and public information, or they don't. If they don't, they would likely need to stall and delay while they hastily try to correct (or conceal) a major (10-year) cybersecurity, privacy and national security issue, impacting multiple Commonwealth entities. An issue I would imagine is of grave concern to the OAIC too. Most likely a concern for the NDIS Quality and Safeguards Commission too, if they are aware of the issue(s). Do you believe the continued delays (90 days and counting) are legitimate, or based on personal experience with this request, just continued, flagrant disregard of the law and FOI legislation?
3. What happens if/when the NDIA come up with yet another excuse and request a extension, or refuse (for whatever reason) 4 months after an exceptionally simple and straightforward request? Because only an ungoverned, insecure and poorly managed digital system wouldn't know or easily locate how many 'strangers' or personal devices are on their network and accessing private, privileged and restricted government data, information and content.
Apologies if I seem frustrated, taken aback and astounded, because I am. As would any other Australian Citizen and/or NDIS participant, provider or carer.
Yours sincerely,
Josh
Our reference: RQ22/05089
Agency reference: FOI 22/23-0589
Josh
By email: [1][FOI #9419 email]
CC: [2][NDIA request email]
Extension of time under s 15AB
Dear Josh
Please find attached an FOI Extension of time decision relating to your
FOI Request with the NDIA. The NDIA is copied in to this correspondence.
Sincerely
Alistair B
[3][IMG] Intake and Early Resolution Team
Freedom of Information Regulatory Group
Office of the Australian Information
Commissioner
GPO Box 5288 Sydney NSW 2001 |
[4]oaic.gov.au
1300 363 992 | [5][email address]
[6][IMG] | [7][IMG] | [8][IMG] | [9]Subscribe to OAICnet newsletter
Notice:
The information contained in this email message and any attached files may
be confidential information, and may also be the subject of legal
professional privilege. If you are not the intended recipient any use,
disclosure or copying of this email is unauthorised. If you received this
email in error, please notify the sender by contacting the department's
switchboard on 1300 488 064 during business hours (8:30am - 5pm Canberra
time) and delete all copies of this transmission together with any
attachments.
References
Visible links
1. mailto:[FOI #9419 email]
2. mailto:[NDIA request email]
3. https://aus01.safelinks.protection.outlo...
4. https://aus01.safelinks.protection.outlo...
5. mailto:[email address]
6. https://aus01.safelinks.protection.outlo...
7. https://aus01.safelinks.protection.outlo...
8. https://aus01.safelinks.protection.outlo...
9. https://aus01.safelinks.protection.outlo...
Dear Josh
Thank you for your request for information.
Please find attached correspondence in relation to your request. If you
require this in a different format, please let us know.
Please contact us at [1][NDIA request email] if you have any questions or
require help.
Thank you.
Kind regards
Freedom of Information Officer
Parliamentary, Ministerial and FOI Branch
Government Division
National Disability Insurance Agency
E: [2][NDIA request email]
[3]Title: NDIS delivered by the National Disability Insurance Agency
[4]LGBTIQA+ rainbow graphic
The NDIA acknowledges the Traditional Custodians of Country throughout
Australia and their continuing connection to land, sea and community. We
pay our respects to them and their cultures and to Elders past, present
and emerging.
[5]Aboriginal and Torres Strait Islander flags graphic
References
Visible links
1. mailto:[NDIA request email]
2. mailto:[NDIA request email]
4. https://intranet.ndiastaff.ndia.gov.au/h...
Josh left an annotation ()
NDIA chair under fire for using private office, email for NDIS matters
The chair of the National Disability Insurance Agency board, Helen Nugent, has conducted NDIA meetings out of a privately-leased office at Macquarie Group headquarters, and her personal email connected to the bank's email server has been used for NDIS matters, a Senate hearing has been told.
Government officials also confirmed to Thursday's hearing that Macquarie Group sits on a reference group advising the National Disability Insurance Scheme (NDIS) on the development of disability accommodation and that the investment banking company has indicated "they are going to enter [the disability housing] market".
24 Oct 19
https://www.smh.com.au/politics/federal/...