Lands Leak: No apology from Minister on massive personal data breach

Minister Ian Borg, responsible for the Lands Authority, this evening in Parliament refused to apologise to citizens for the massive breach of personal data ongoing since April 2017 and leading to the identity cards and passports of thousands of people being available on Google.

The massive breach of data by the Lands Authority, exposed on Friday following an investigation by The Shift News and The Times of Malta, showed that more than 10 GB of data, amounting to some 15,000 documents, submitted by citizens to the Authority through its website were made available on Google from day one of the launch of the new web site in April 2017.

In Parliament, Nationalist Party MP Jason Azzopardi asked the Minister twice on action being taken by the government to address the breach.

Azzopardi asked if Borg would apologise, whether he knew that the data was being hosted on a private server, and he challenged the Minister on the Authority’s justification that transferred responsibility to the citizen by saying each individual had ticked the box allowing “public inspection” of their application.

The Minister said the Data Protection Commissioner was conducting an investigation and he did not want to prejudice the process. The Minister made no apology.

Instead, he engaged in whataboutism after Prime Minister Joseph Muscat whispered in the Minister’s ear, and Borg addressed Azzopardi saying, “citizens would have wished there were public inspections” of land transfer deals under the previous administration (they were investigated by the National Audit Office that found no wrong doing).

Minister Borg also stressed the Lands Authority was conducting an internal investigation – led by the Authority’s “independent chief auditor” who is actually the Labour mayor of Mqabba, a former reporter for the Labour Party’s TV channel who was appointed to the role at the Lands Authority at the start of the year at the ripe age of 29 with no particular experience in audit.

The Nationalist Party has not uttered a word on the scandal so far, prior to Azzopardi’s intervention in Parliament today. He was also the only MP asking questions in Parliament on the matter.

Lawyers and data specialists who spoke to The Shift News threw cold water on statements by the Lands Authority arguing that individuals who submitted forms to the Authority had consented to “public inspection”. They said the argument was “irrelevant” and that the consent given was not for the leak of their personal data on such a massive scale.

Around a third of the documents are identity cards and passports that were openly accessible to anyone who bothered to look. All that was required was a browser and Google. Security experts consulted by The Shift News described this as “massive” and the result of either “crass ignorance or gross negligence”.

The Lands Authority has not yet committed to informing those affected – some 5,000 people – as required by law in case of high risk breaches. Every individual affected can sue the Authority for damages.