Bennett repeated that claim to Parliament in Question Time today when asked (in a Supplementary to Q5) about the comment on this thread by someone other than Keith or Ira about also having accessed the network through the kiosk flaw.

As long as someone in your management chain or the organisation's Security group is included, you're covered. Especially in these days of email journalling and…

I thought they just had no evidence of it. It's on the public if they can't tell the difference between "No evidence of x" and "Evidence of no x". Ironically, since the term "conspiracy theory" came into existence, there's been…

But they're still quite certain there's been no privacy breach.

This is a hugely sick joke and scandal what is going on. So 4 junior staff members are to blame for it all, for supposed "sloppiness"? How many did warn them (MSD) over the last 2 years, and who was in charge? How…

Ass-covering CCing never goes out of fashion. In fact, I imagine lawyers for the four people under the gun…

Those file names were from the case files server logs. The case file server itself was inaccessible. Most of my grabs were from the invoice server, which was unsorted and unnamed.

The pile of legal doo-doo would be roughly the same as the pile involved in taking the documents that actually were sensitive, by the thousands. If they were…

What if "they" aren't as incompetent as you suspect, and they do indeed detect that you have more data than you admitted...

Then you could be in a pile of legal doo-doo...

Sure, although from a personal ethical point of view, you'd know:
1) The data was harmless
2) You had already seen it
3) You did not intend to use it, because of 1) and 2), for any other purpose than establishing whether incompetence was followed by cover…

except oneself, grasshopper

Yup, technically. Practically, no one would ever know. If you decided to let them know, you could tell them that you only kept MD5s of the data for proof of existence purposes. You could even do exactly that, if you were a stickler.

Which is what I was trying to say. They have to backup anything vaguely classified as records, and they have to backup systems. Since logs…

rather different ethical/legal implications

Next time (:-)) keep a hold-off set of unimportant/irrelevant data that you don't tell them you ever got. Then you can check whether they are lying about being able to detect what you took. Two scoops for the price of one.

A report on the breach released today blames staff at the ministry, and says they should have told senior managers.

But senior management would have known about the security check.
Why would the senior manager NOT ask, hey what did the security report say.
Systems seemed…

In practice, do all departments keep all network log files…

Orly? From the original post:

And then there were file server logs. Normally, they aren’t that exciting. Except that WINZ name their files quite well. For example:

s:SharedDatawi_witesWaikatoHAMFraud Investigations[Name of investigator][Name of WINZ client] 23 Jun 2011 Case 640026-10.WMA

That looks pretty damned…

Can't. They were scanned PDFs with no metadata and sequential file names. It is impossible to look for anything. Scouring for personal information…

Yes (I think).

But if you are trying to find low-level scapegoats for sacking, then I'm sure they would argue that the existence of a document with a statement that "non-separation of networks was an urgent issue" circulated to appropriate levels of management equates to communication. Management would…

– The Logs – How far back in time do the logs go? The reviewer used the logs to find out what information was accessed from the…

Word.

Never attribute to cost/benefit analysis that which is adequately explained by stupidity.

Did they identify your downloads? And from that, which files you accessed? If not, then they know precisely nothing about what anyone else may or may not have done.

I'd expect any review to have looked at the paper trail about this. Some person or group has made a decision about the cost/benefit of acting on concerns raised.

My understanding is that all the computers were connected on a single, national,…

My understanding is that there's no audit trail to determine *who* accessed information, but that…

My bet is that it's a lot more than Keith or Ira did, and they actually found and reported the bloody problem.

No you're right, at least in Windows 7. Go to print, click find printer, up pops an explorer window, right click on your computer and map away. Not very intuitive however, if…

I love how "no evidence of other breaches" can be used in this context to actually appear as a positive. There's no evidence because there is no possible way to…

you clearly haven't met their reservations mainframe. :)

I think your take is correct.…

The financiers (whether government or private owners) don't want to spend money. The management don't want to understand "techy…

Am I correct in assuming that this statement only addresses the specific breach by Keith and Ira, and…

It's true. Not a conspiracy though – I just don't know what the story is. With the invoices, I can tell you…

exactly as intended. #spin

The MSD network was wide open for months and to assume that other people (domestic and foreign) did not gather material or…

It is a failure of management if the staff below do not feel it is possible or appropriate to pass information of this kind upwards.

It is simply poor leadership.