A “culmination of human errors” caused the prime minister’s department to throw out filing cabinets containing classified documents that eventually reached the ABC, according to the Australian Federal Police investigation into the affair.
Releasing on Friday the findings of the police investigation, which concluded in March, and a report on security in the department, the secretary of Prime Minister and Cabinet (PM&C), Martin Parkinson, said the AFP had found “the breach was not a deliberate act motivated by criminal or malicious intent”.
The two locked cabinets – with no keys – were bought cheap at a Canberra second-hand auction house. When the purchaser eventually prised them open and discovered the documents, he approached the ABC, which publicised some of the material before handing it over to ASIO.
The police some months ago indicated no charges would be laid. Parkinson said he had “personally dealt with and sanctioned a number of officers for their roles in this security breach”. But he was not revealing the nature of the sanctions. Nor did he release the police report, saying it was standard practice not to do so.
The human errors were in the record keeping, movement, clearance and disposal of the document storage containers in February 2016, Parkinson said.
He said his department was implementing the recommendations from the report by Ric Smith, a former defence department secretary, into its security.
A team had been set up to strengthen PM&C’s protective security practices, procedures and culture. A digital tracking system had been put in place to handle secure cabinets, and there were “new security training packages” for staff.
“We are driving a program of cultural change, supported by a dedicated communications strategy, to embed a strong protective security culture in PM&C,” Parkinson said.
“I have given strong direction to all PM&C officers on their responsibilities to manage and report potential sources of security failures.”
Parkinson said it was important the public service as a whole heeded the lesson of the incident. Each departmental secretary had reviewed their department’s security.
The Attorney-General’s department would collate and disseminate lessons from system success and failure across the public service and work with agencies to support best practice. The Australians Signals Directorate would facilitate further exchanges of information on cyber security.
“I am deeply concerned that such an extraordinary lapse of security could occur”, Parkinson said.
The Smith report said the classified documents originated from the section of the department responsible for responding to freedom of information and other access requests, located within the cabinet division of PM&C at its Barton, Canberra offices. The material comprised about 300 documents largely collated between mid-2013 and mid-2014.
“While half of the documents were classified protected or below, there was a small amount of national security classified material,” the Smith report said.
“The AFP investigation established that the documents are likely to have left the control of PM&C between January and March 2016, following a Cabinet Division accommodation reshuffle in January 2016 when eight secure containers were identified and surplus and returned to Corporate Division.
"PM&C has concluded that the secure containers were not checked to ensure they no longer held any documents. PM&C email records indicate that two secure containers in Cabinet Division – formerly used by the officer, or officers, who collated the documents – were missing keys at the time they were being prepared for disposal. There is no record that the containers were opened and checked prior to disposal.”