NEWS | Wednesday, 19 November 2008

PRINT THIS ARTICLE

Gatt turns down MITTS board’s offer of resignation

MITTS board chooses to berate media over ‘denigrating comments’

Matthew Vella
Investments Minister Austin Gatt yesterday turned down the offer of resignation from the board of directors of the Malta IT and Training Services (MITTS), after presenting the findings of the external review team into the alleged hacking of some 20,000 government usernames and passwords.
The board, composed of chairman Claudio Grech, and directors Godwin Grima, John Aquilina, Juan Borg Manduca, and Joanna Genevose, said that although the findings of the external review team clearly indicate that the failures at MITTS were of “an operational nature, fiduciary responsibility and accountability compel us to take this decision.”
Over 20,000 usernames and passwords of all the MITTS users – from Members of Parliament to ministries, government agencies and departments – were believed to have been extracted illegally last September. But although MITTS technicians were alerted to problems on the government server on 4 September, it took them until 24 September to realise that a security breach could have transpired.
The board said no evidence of compromise or indications of irregular access was found, and no irregular access was detected from the Cairo embassy, from where all the other attacks had originated.
The board said there was “no doubt the organisation has not lived up to its clients’ expectations in this incident… although there was no malicious intent… the board expected management to be more pro-active.”
The board of directors said it was concerned that the technologies necessary to prevent the breach had not been adopted, although being available at MITTS; and that the operational problems were not made known to the board of directors. “It is baffling how such issues only emerge after a serious incident takes place,” the board said.
The external review team’s report states that although there is no evidence of wrongdoing, a number of deficiencies exists in the information security and risk management framework at MITTS.
In his letter to the board, Gatt declined their offer of resignation and asked them to continue to serve MITTS and the country “to the best of [their] abilities which have indeed proven worthwhile in this regrettable occasion.”
But he supported the board’s decision not to renew the contract of Chief Executive Alex Attard, which expires in December 2008; and the demotion of Mario Spiteri from manager of the Information and Security and Risk Management Department (the current most senior information security position), to his previous position.
The departmental manager of service management resigned his post since the occurrence of the incident, after it transpired he had given the CEO the wrong technical advice regarding the success of the breach.
But the board also declared that “denigrating comments” in the media were “uncalled for and intended only to demoralise the workforce and sensationalise a serious technical incident”.”
The board also pointed out there was no involvement of any MITTS employees in the breach. The employees who were suspended without pay will be paid their salaries back, and they will be placed on special paid leave until the completion of disciplinary hearings over breaches of internal procedures by the same employees, and other colleagues.

PRINT THIS ARTICLE

Any comments?
If you wish your comments to be published in our Letters pages please click button below.
Please write a contact number and a postal address where you may be contacted.