As iTWire has reported, Dr Vanessa Teague, who runs the infosec outfit Thinking Cybersecurity, lodged an FOIA request on 16 June, seeking full information on data-sharing agreements signed by the ABC with third parties who have access to iview data, including Google, Facebook and customer data hub and enterprise tag management firm Tealium, and any other firm to whom the broadcaster has granted access.
Her request was knocked back and a request to review the decision was also rejected, the latter on 6 September. However, the ABC released one redacted document, the terms of service issued by the Digital Transformation Agency for the use of the Google Analytics 360 Suite.
According to this document, the service can be used for tracking website traffic and is free for sites that record up to 10 million hits a month. As a Federal Government property, the ABC has to subscribe to the service through the DTA which has a paid subscription.
One is unaware whether the DTA has informed the numerous ransomware operators — and other assorted threat actors around the world — that the ABC is not to be attacked, except on weekdays.
Issues that the DTA is unable to resolve will be dealt with by its unspecified sales partner and the DTA also reserves the right to refuse to provide additional support.
GOOGLE MOTTOS: A HISTORY— MGK Hockey 1234 (@mightygodking) 28 March 2018
1999: Don't Be Evil
2003: Try Your Hardest To Not Be Evil
2008: Make A Reasonable Effort To Avoid Being Evil
2013: What Is Evil, Really, When You Get Down To It, I Mean Really
2018: *just a series of high-pitched giggles*
And if the DTA calls on its sales partner to provide support, then the ABC has to throw its doors wide open to said sales partner.
The DTA document states that the ABC is responsible for setting user access controls. The DTA reserves the right to modify user access to the ABC's accounts, provided the ABC agrees to this or if the terms of service allow it.
The onus of ensuring user privacy is on the ABC which has to make sure that its officers (?), employees, agents and sub-contractors all comply with Australian privacy principles and all obligations under the Privacy Act 1988.
And then comes, what to me, is the single most point: "You should be aware that Google Analytics data is processed and stored in the United States of America."
At a time when every country worth its name is insisting on data sovereignty, for the DTA to join a service like this seems a bit, well, cavalier. But this is the same agency that gave Amazon Web Services, an American company that has links to a Chinese-owned data centre in Australia, the green light for hosting government data.
The ABC is forbidden from passing to Google information that the search giant can use or recognise as personally identifiable information.
The ABC is also not allowed to alert users that cookies are used to collect data, or to disclose the use of Google Analytics and how it collects and processes data.
But the DTA is allowed to disclose information collected by the ABC to the third parties for what it calls "government or parliamentary accountability purposes".
The use of the word "accountability" in connection with the words "government" and "parliament" at this time did make me laugh cynically, I must admit.
The DTA also advises that the Google Analytics terms of service allows the company — which has been found to be misusing user data on many occasions — to share the ABC's confidential information with third parties without the consent of the ABC "in particular circumstances".