Vodafone Australia has admitted an employee hacked a journalist’s phone records in an attempt to uncover her sources for stories, but the telecommunications company denies any “improper behaviour”, despite internal emails suggesting it deliberately misled authorities about systemic privacy breaches.
In 2011, after a series of stories by Fairfax journalist Natalie O’Brien detailing grave security lapses in Vodafone’s Siebel data system, a Vodafone employee accessed her phone call and text message records in an attempt to uncover company whistleblowers.
O’Brien – herself a Vodafone customer – reported that Vodafone’s Siebel data system was vulnerable to hacking, and that the data of millions of customers was available online and easily accessible through generic passwords that were being shared around the company and publicly.
Customers’ home addresses, driver’s licences and credit card details were all available online, O’Brien wrote, and criminal groups were paying for customers’ private information.
The day after the story broke, a Vodafone employee accessed O’Brien phone records and trawled through the data in order to find out who might have been leaking her information.
Writing in the Sun-Herald, O’Brien said she had been devastated by the invasion of privacy.
“It’s a creepy nauseating experience to know that someone has been trawling through your mobile phone account looking at all your call records and private text messages.
“The invasion of privacy is devasting. It plays with your mind. What was in those texts? Who were they to? What did they see? What did they do with the information?”
She said the stories she wrote were “in the public interest”, and the vulnerability in Vodafone’s system serious enough that both the Information and Privacy Commissioner and the AustralianCOMMUNICATIONS and Media Authority launched independent investigations.
“The shock and anger is only compounded knowing it was because I was doing my job that I was targeted and it was my own telco that was doing it to me. Since when did telling the truth become the wrong thing to do?”
An internal Vodafone email, reported by the Australian, shows the company was aware of the extent of the security breaches and the potential legal and reputation damage of hacking a journalist’s phone.
The head of fraud management and investigations for Vodafone Group, Colin Yates, wrote to then global corporate security director Richard Knowlton that there was a “huge risk” to the company if the hacking of O’Brien’s phone “gets into the public domain”.
“If the issue relating to breaching the reporter’s privacy by searching her private call records and text messages gets into the public domain, this could have serious consequences given it is a breach of the Australian Telecommunications Act,” Yates wrote.
“And would certainly destroy all of the work done by VHA [Vodafone Hutchison Australia] over the past months to try and restore their reputation.”
The Yates email also suggests the company covered up the extent of the Siebel security breaches from the public and industry regulators.
Following the series of stories, Vodafone executives allegedly “told the press, the NSW Privacy Commissioner and other high-profile Australian agencies that the breach was a one-off incident”, Yates wrote to Knowlton.
“As you know this is in fact not the case and VHA has been suffering these breaches since Siebel went live and did nothing or very little to close off the weaknesses that allowed them to occur.”
In a statement issued Saturday, a Vodafone spokeswoman said the company “strongly denies any allegations of improper behaviour. VHA takes its legal and corporate responsibilities very seriously”.
“Over the past four years, VHA has invested heavily in the security of its IT systems. The company has very strict controls and processes around the privacy of customer information, and has appointed a dedicated privacy officer. The privacy of our customers and protection of their information is our highest priority and we take this responsibility very seriously.”
The spokeswoman said Vodafone cooperated fully with the Privacy Commissioner’s investigation. “We deny that Vodafone Hutchison Australia made any incorrect statements to the Privacy Commissioner or any other authorities.”
Vodafone said it became aware of the hacking of O’Brien’s phone in June 2012.
“Vodafone Hutchison Australia immediately commissioned an investigation by one of Australia’s top accounting firms. The investigation found there was no evidence VHA management had instructed the employee to access the messages and that VHA staff were fully aware of their legal obligations in relation to customer information.”