This is our email today to Queensland’s Police Minister, Mark Ryan MP.
Date: Fri, Jan 15, 2021 at 5:32 PM
Subject: Privacy breach: QPS identifies individual firearms licensees
To: Police <email@example.com>
Cc: Privacy[LD] <Privacy@police.qld.gov.au>, <firstname.lastname@example.org>, <Bust.DanielW@police.qld.gov.au>, Administration – OIC <email@example.com>
Dear Minister Ryan,
Queensland Police Service have heralded the new year with a privacy breach of unprecedented scale, circulating the identities of hundreds of individual firearms owners far and wide. The incident, and QPS’ response, was covered by various media outlets. QPS Superintendent John Hallam brushed off the ramifications when he stated:
“What was sent out was their email address and their email address only and it went to other licensed weapons holders.”
The Queensland Audit office recently recommended that thousands of license holders should have their licenses revoked. It is odd to suggest that the population of licensees contains many untrustworthy people and then circulate a list of them. That list enabled them to be identified.
Did you know the following people hold firearms licenses?
[Mr B, Mr B’s Home Address]
[Mr S, Mr S’s Home Address]
[Mr R, Mr R’s Home Address]
We haven’t communicated with these licensees, but their identity and physical address were ascertainable in 15 minutes using readily accessible public records. Our estimate is that most of the email addresses would be exploitable in this way. Entertainingly, the email advised licensees:
“Don’t make it public knowledge that you possess firearms.”
The brush-off by Superintendent Hallam is offensive to human intelligence and ought be withdrawn. It should be substituted with a genuine acknowledgement from QPS that it currently lacks the institutional capacity to execute a mass communication campaign like this in a safe way. It was readily foreseeable that asking dozens of constables across the State to manually copy and paste tens of thousands of email addresses into templates was going to be prone to errors of exactly this sort. We write to you to ask that QPS be immediately made to both:
1. try harder at recognising systemic faults, and
2. reform its institutional approach to handling our data.
The appropriate action is for the Privacy Commissioner to conduct a compliance review into the strategy, plan and process that generated such an egregious breach. The Privacy Commissioner is statutorily empowered to conduct such reviews. We note, in passing, that the Office of the Information Commissioner (in which the Privacy Commissioner sits) has a history of doing deals with QPS. So much so that Supreme Court Justice Martin Daubney remarked less than two years ago in open court:
“[The meeting is] starting to sound awfully like the police and the [Office of the Information Commissioner] sat down behind closed doors to set matters of policy. Can you just sit back and think about how this looks? If it were to be the subject of discussion, I don’t know, on the front page of a metropolitan daily, you know, how would that look? There’s this old-fashioned thing called the rules of natural justice and giving people the opportunity to be heard.”
Will you use your office to arrange meaningful action from the Office of the Information Commissioner on this issue?
The strategy behind the email campaign
The email campaign appears to be the very first task in the very first step of the QPS plan to address this finding of the Queensland Audit Office:
Most firearms licence holders are not inspected. More than 78 per cent of licences issued between 2015–2019 have never been inspected by QPS.
The QAO report, which we’ve discussed (click here) on our website, has led to the institutional craving inside QPS to be seen to be ‘doing something’ about Weapons Licensing. It also made a nice role for Deputy Commissioner Tracy Linford to be cast as the saviour of public safety, chairing a Firearms Oversight Committee that was ‘doing something’.
It would be great for Tracy’s career development if she could pull off a halfway competent QPS response to the QAO report. It’s the sort of credibility that would help her score a new appointment in 4-8 years’ time, such as Commissioner of the Australian Federal Police.
However, the golden rule of agency responses to external scrutineer reports is this: don’t make the situation worse. To hundreds of law-abiding shooters, this is worse, not better. To you, as Police Minister, this must look worse, not better.
If Tracy’s committee endorsed the plan for dozens of constables in Queensland police stations to manually email thousands of licensees with all the obvious risk that entails, and which risk has been realised in this case, then we respectfully suggest the Committee needs to be chaired by a different QPS member.
For Law Abiding Firearms Owners Inc