FACT CHECK: The Electoral & Boundaries Commission’s Response

Today, March 1 2023, the Electoral & Boundaries Commission (EBC) published a farcical response to my concerns about the Government of Barbados’ overall handling of the privacy and security of its information systems and the personal data of Barbadians.

My comments were labelled as ‘allegations’ and ‘misinformation’ around the security of the Trident ID card, security of the registration information captured and stored by the Electoral and Boundaries Commission and data breaches regarding the electronic publication of the Register of Electors.

This post is designed to fact check the EBC’s response.

FACT CHECK #1

The EBC referred to me as a ‘social media commentator.’ I can assure you that I am much more than that, but please decide for yourself by reading my bio profile on the World Economic Forum’s website and this Nation News article on me.

FACT CHECK #2

It has been said that I referred to the release of the electoral list as a major data breach. I have at NO time in the past or the present referred to the release of the list as a ‘data breach.’ As a subject matter expert (SME), I am very careful with my words, and have always referred to the EBC’s major mistake as a ‘data leak.’ Simply put, a ‘data leak’ is when sensitive data is unknowingly or accidentally exposed to the public, and a ‘data breach’ is an event caused by a cyberattack. That being said, the definition of ‘personal data breach’ in the Data Protection Act is “a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.” From all accounts, the publishing of the electoral list to the Internet was accidental and a loss of control which led to unauthorised access to the personal data of Barbadians by persons who did not have a right to know or a right to access this data. Hence, it is technically still a data breach under the law.

FACT CHECK #3

The EBC claims that they are not at fault because they have followed the letter of the law, namely the Representation of the Peoples Act 2007. Laws are not perfect – especially many of the poorly drafted and outdated ones in Barbados – and must be reinterpreted and updated to remain compatible with progressive changes in technology, changing community awareness, changing community values, and changing expectations of the legal system. It must also be said that making a physical list publicly available in libraries across Barbados is fundamentally different in terms of reach and risk to making an online list publicly accessible to everyone on the Internet. The EBC doesn’t seem to understand this quite simple fact, and it’s the role of the Data Protection Commissioner to educate them (which she has unfortunately and repeatedly failed to do).

FACT CHECK #4

The Data Protection Act Part IV sets out requirements for the transfers of personal data outside of Barbados. Section 22 states the following:

Personal data shall not be transferred to a country or territory outside Barbados unless that country or territory provides for

(a) an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of their personal data; and

(b) appropriate safeguards on condition that the rights of the data subject are enforceable and there are available, effective legal remedies for data subjects.

By publishing the full electoral list to the public Internet, the EBC essentially transferred the data of Barbadians to 190+ countries across the world. More than 75 of these countries do not have data protection laws that offer adequate protection for the rights and freedoms of data subjects (citizens of Barbados). This also made the personal data of Barbadians available to what amounts to 4 billion Internet users over which the EBC has no control, including hackers, scammers, fraudsters, and other cyber criminals.

Appropriate safeguards must be provided when processing personal data. One of these safeguards is data minimisation, which means limiting the collection of personal information to what is directly relevant and necessary to accomplish a specified purpose. The EBC could have accomplished their specified purpose by only publishing the names and addresses of individuals. Instead, they published additional unnecessary information such as national registration number, date of birth, and gender. Countries with strong privacy laws, competent election authorities, and knowledgable Data Protection Commissioners have prohibited the publishing of excessive amounts of data in order to protect voters from fraud, harassment, victimisation, and other harms or violations of their rights. The failings of the EBC with regards to data minimisation, lack of data security, and transfers to inadequate jurisdictions opens them up to legal liability, possibly even a class action lawsuit, in the event that individual(s) experience significant harm or violations of their rights due to the EBC’s negligent actions.

FACT CHECK #5

The EBC and the Minister of Information and Smart Technology continue to pat themselves on the back for the security of the new Trident ID card, repeatedly comparing it to the previous laminated card. My biggest concerns are not and have never been about the security of the card itself, but with the security of the personal data of Barbadian citizens in the online systems used to store and present the bio information on the card (especially when you consider the 30+ government systems that have been hacked in recent years). Debit and credit cards have chip and pin security too, but they still get compromised and people’s cards and bank accounts get hacked every day. So help me to understand how the security of the Trident ID card and related IT systems is so perfect?

As someone who has implemented secure, complex systems in the banking, energy, retail, software, telecoms, and other industries across the world, I can tell you there are several activities that need to be performed. I sent the Minister of Information and Smart Technology and the Prime Minister an email asking them to have the Cyber Security Working Group (CSWG) conduct an assessment of the Trident ID card and present the findings to the general public. You can find a copy of the email HERE, which includes the detailed list of activities that are required to secure digital systems and personal data.

I can guarantee the citizens of Barbados that the government HAS NOT securely implemented the Trident ID card solution and associated systems, and that less than 20% of those activities in the list have been done. The Government of Barbados does not have the human, technological, and financial resources to secure basic to highly complex IT systems. If they could not secure the Barbados Police Service, Immigration Department, National Insurance Scheme, Queen Elizabeth Hospital, and many other government systems from hackers (a full list can be found HERE), how have they suddenly developed the capabilities to secure the Trident ID card systems? If they have done such a great job securing the Trident ID systems, then the CSWG can easily review the evidence and provide a public report in 2-3 weeks or less. I will even volunteer to lead them to make sure the job is done correctly.

FACT CHECK #6

The EBC has claimed to have “no reports, no knowledge and certainly no evidence of any theft of the identities of Barbadians. Furthermore, the Commission has no reports, knowledge and/or evidence of the theft of the identities of Barbadians due in any part to the previous publishing the Register of Electors.” They also claim that their “investigations show that there are no such reports before the Anti-fraud Committee of the Bankers Association of Barbados and no such reports before the Central Bank of Barbados.” I am more than certain that none of the above parties track the sale of personal data in Dark Web marketplaces, possess the know how to obtain electronic evidence (e-evidence) of cyber criminal activity from social media platforms and other online services, have access to open source threat intelligence from law enforcement and intelligence agencies, or are privy to advanced fraud intelligence. So how would they know when and where online fraud and cyber crime using the identities of Barbadians are occurring? I would also suggest that the EBC obtain detailed reports on the rise in identity-based fraud in Barbados or targeting Bajans in the last year. I’ll wait…