Justice John Dixon has provided a very valuable judgment in Agustin-Bunch v Smith (No 2) [2022] VSC 290 providing a very useful and detailed analysis of how to plead, and more particualrly how not to plead defences.  It ended up being a bad day at the office for the defendants.

FACTS

The plaintiffs by writ seeks:

• damages,
• a permanent injunction restraining the defendants from publishing certain material, and
• a mandatory injunction for the removal of certain publications from the internet that they allege are defamatory [1].

The second plaintiff seeks damages pursuant to s 236 of the Australian Consumer Law (‘ACL’), contending that the defendants had engaged in misleading or deceptive conduct in contravention of s 18 of the ACL [1].

On 12 April 2021,  the court refused the plaintiffs’ application for an interlocutory injunction restraining the defendants from publishing or causing to be published in any form, or maintaining online for download, or uploading so as to make available for publication online:

(a) 15 specific videos;
(b) hyperlinks to a Facebook group described by the plaintiffs as the ‘Dr Farrah Hate Page’;
(c) certain Facebook and Instagram posts;
(d) the imputations and representations set out in nominated paragraphs of the plaintiffs’ statement of claim; and
(e) any matter of and concerning the plaintiffs to the same purport or effect as any of the publications referred to.

The relevant publications alleged to convey defamatory imputations are videos [6] where Dr Smith speaks partly in Tagalog and partly in English to a Filipino audience [7].

The defendants pleaded the defences of:

• truth,
• contextual truth,
• honest opinion, and
• qualified privilege both at common law and relying on the relevant statutory provisions [8]

The plaintiffs allege about 70 imputations and the defendants plead a truth defence to approximately 60 imputations [10].The defences have been Read the rest of this entry »

The National Institute of Standards and Technology (“NIST”) has announced a review on FIPS 180-4, Secure Hash Standard (SHS). 

In its media release the NIST states Read the rest of this entry »

Cyber attacks have grown from organisations to cities and even countries.  In May Greenland was hit by a cyber attack which crippled its health services.  Earlier this week the entire Italian City of Palermo shut down all systems to fend off a cyber attack. 

The story is reported Read the rest of this entry »

Verizon has just released its 2022 Data Breach Investigation Report which shows that Ransomware has grown 13% year on year in 2022.   The report is valuable because it records trends in ransomware attacks.

The report states:

• the four means of accessing an organisations online site is via:
  • misuse of credentials,
  • Phishing,
  • Exploiting vulnerabilities, and
  • Botnets.
• Error continues to be a dominant trend, and is heavily influenced by misconfigured cloud storage.
• The human element continues to drive breaches. Whether it is the use of stolen credentials, phishing or simply an error, people continue to play a large part in incidents and breaches alike.
•  data compromises are considerably more likely to result from external attacks than from any other source.
• 80% of breaches are caused by individuals external to the organization

Read the rest of this entry »

The National Institute of Standards and Technology (“NIST”) has issued a guideline Blockchain for Access Control Systems.   

The abstract provides:

The rapid development and wide application of distributed network systems have made network security – especially access control and data privacy – ever more important. Blockchain technology offers features such as decentralization, high confidence, and tamper-resistance, which are advantages to solving auditability, resource consumption, scalability, central authority, and trust issues – all of which are challenges for network access control by traditional mechanisms. This document presents general information for blockchain access control systems from the views of blockchain system properties, components, functions, and supports for access control policy models. Considerations for implementing blockchain access control systems are also included.

Blockchain systems provide an alternative (or complimentary) system for reliability, security, accountability, and scalability for AC systems. Blockchain characteristics – such as transparency, distributed computing/storage, and a tamper-evident/tamper-resistant design – help to prevent AC data from being accessed or modified by malicious users. Access logs are also recorded in blocks that allow for the detection of malicious activities. Blockchain system components and their advantages for AC systems are Read the rest of this entry »

The health sector is a regular target of cyber criminals.  It is also a sector which is notorious for having poor cyber security practices.  That is a terrible confluence.

Data breach today reports that 3 recent health data breaches have affected 1.4 million individuals. The three entities were:

• East Tennessee Children’s Hospital (“ETCH”)
• Partnership HealthPlan of California (“PHC”), and
• Acuity International’s Comprehensive Health Services .

ETCH and PHC were attacked in in March, involving various IT system disruptions, suggesting possible ransomware attacks. ETCH’s reportto Maine’s attorney general claimed the attack  affected nearly 423,000 individuals.  PHC reported its breach affected nearly 855,000 individuals. Acuity International’s breach affected nearly 123,000 individuals

The ETCH breach affected data may include name, contact information, date of birth, medical record number, medical history information and Social Security number.  The PHC breach involve unauthorized access to names, Social Security number, date of birth, driver’s license number, tribal ID number, medical record number, health insurance information, member portal username and password, email address, and medical information including treatment, diagnosis and prescriptions.

Other recent health related cyber incidents around the world include:

• Greenland’s health IT service has been crippled since 9 May by a cyber attack which has forced doctors to resort to using pen and paper;
• in Ottawa a regional health service has been attacked with Names, contact information, dates of birth, health card numbers, recent visits to the hospital and diagnosis among the information compromised in the breach.  Interestingly the data breached included data kept for over a decade.  That is an interesting practice.
• South African retail pharmacy company Dis – Chem was the subject of a cyber attack
• according to the British Medical Journal hundreds of organisations in Great Britain have breached patient data sharing agreements, including GlaxoSmithKline and Imperial College London. 

Given the breadth and depth of the attacks it is relevant to have regard to a very recent Joint Cybersecurity advisory prepared by cyber security authorities of the United States of America, Canada, New Zealand and the United Kingdom titled “Weak Security Controls and Practices Routinely Exploited for Initial Access”. 

The report sheets home much of the blame on Read the rest of this entry »

The Federal Court, per Halley J, set aside a statutory demand in CBS Commercial Canberra Pty Ltd v Axis Commercial (ACT) Pty Ltd, in the matter of CBS Commercial Canberra Pty Ltd [2022] FCA 544 in finding that an offsetting claim constitutes a genuine dispute. It is a very good decision setting out the complications of offsetting claims arising from building contracts relied upon in setting aside a statutory demand which is based on a certificate and judgment obtained under the Security of Payments Act.

FACTS

CBS engaged Axis as a sub-contractor to undertake work at a building site located in Gungahlin in the Australian Capital Territory [12].

The chronological events Read the rest of this entry »

The Federal Court, per Rolfe J, in Australian Securities and Investments Commission v RI Advice Group Pty Ltd [2022] FCA 496 made what has widely been described as a first occasion a corporation has been found to have breached its licence obligations in failing to have adequate risk management systems to manage its cyber security risks. The Court ordered declaratory relief requiring RI Advice to undertake work to improve its security under the supervision of an expert.  

The orders were made in terms agreed between the parties just before the trial was scheduled to commence.

I have followed this proceeding closely with posts ASIC commences action against RI Advice Group Pty Ltd for failing to have adequate cyber security in August 2020 and ASIC v RI Advice Group Pty Ltd cyber security civil penalty trial pushed off from a 29 November 2021 hearing date to a date in April 2022 in May 2021,

FACTS

The Court provided a factual background about stating that RI Advice :

• was:
  • a wholly-owned subsidiary of Australia and New Zealand Banking Group Limited (ANZ). RI Advice up to and including September 2018;
  • from 1 October 2018, along with two other ANZ financial licensees, part of the IOOF Holdings Limited (IOOF) group of companies [12]
• carries on a financial services business within the meaning of s 761A of the Corporations Act Act (“The Act”) under a third-party business owner model.
• authorises Under s 916A of the Act, RI Advice independently-owned corporate authorised representatives (“ARs”) and individual authorised representatives to provide financial services to retail clients on RI Advice’s behalf and pursuant to the Licence [13]

The AR Practices (practices of groups of one or more Authorised Representatives):

• electronically received, stored and accessed  confidential and sensitive personal information and documents in relation to their retail clients. The personal information included:

(a) personal details, including full names, addresses and dates of birth and in some instances health information;(b) contact information, including contact phone numbers and email addresses; and

(c) copies of documents such as driver’s licences, passports and other financial information [14].

• since 15 May 2018 provided financial services to at least 60,000 retail clients [15]
• had 9 cybersecurity incidents between June 2014 and May 2020, being:
  • in June 2014 an AR’s email account was hacked and five clients received a fraudulent email urging the transfer of funds, one of whommade transfers totalling some $50,000;
  • in June 2015 a third-party website provider engaged by an AR Practice was hacked, resulting in a fake home page being placed on the AR Practice’s website;
  • in September 2016 one client received a fraudulent email purporting to be an employee of an AR Practice asked for money. The AR Practice used an email platform where information was stored “in the Cloud”, with was no anti-virus software and only one password which everyone used.
  • in January 2017 an AR Practice’s main reception computer was subject to ransomware delivered by email, making certain files inaccessible;
  • in May 2017 an AR Practice’s server was hacked by brute force through a remote access port, resulting in file containing the personal information of some 220 clients being held for ransom and ultimately not recoverable;
  • between December 2017 and April 2018 (December 2017 Incident) an unknown malicious agent gained unauthorised access to an AR Practice’s server for several months  compromising the personal information of several thousand clients, some of whom reported unauthorised use of the personal information;
  • in May 2018 an unknown person gained unauthorised access to the email address of an AR and sent a fraudulent email to the AR’s bookkeeper requesting a bank transfer;
  • an unauthorised person used an AR Practice’s employee’s email address:
    • in August 2019 to send phishing emails to over 150 clients ; and
    • in April 2020 to send phishing emails to the AR Practice’s contacts [16].

Inquiries and reports following the cybersecurity incidents revealed thatthere were a variety of issues in the respective ARs’ management of cybersecurity risk, including:

• computer systems not having up-to-date antivirus software installed and operating;
• no filtering or quarantining of emails;
• no backup systems in place, or backups not being performed; and
• poor password practices including:
  • sharing of passwords between employees,
  • use of default passwords,
  • passwords and other security details being held in easily accessible places or being known by third parties [17].

Regarding the incidents Read the rest of this entry »

Justice Riordan considered an appeal against an order for security for costs in In the matter of Credit Clear Limited [2022] VSC 206.  The appellants were unsuccessful across the board. 

FACTS

By originating process filed 15 July 2020, the plaintiffs made an application under:

(a) sections 175, 232, 233, 461(1)(k), 1041H(1), 1324(1) and 1325 of the Corporations Act 2001 (Cth) (‘the Act’);

(b) sections 12DA and 12GM of the Australian Securities and Investments Commission Act 2001(Cth) (‘the ASIC Act’);

(c) Sections 237 and 243 of the Australian Consumer Law, being Schedule 2 of the Competition and Consumer Act 2020 (Cth) (‘ACL’); and

(d) the inherent jurisdiction of the Court [2].

The plaintiffs sought the following substantive relief in their points of claim [4]:

(a) The first plaintiff (‘Mr McKendrick’) sought to be reinstated as a director of the first respondent (‘Credit Clear’).

(b) The appellant sought the following relief:

B. Declarations and or orders under s 1325 of the Act, alternatively s 233(1)(c) and or (j) of the Act, s 12GM of the ASIC Act and or ss 237 and 243 of the ACL, that the Separation Agreement dated 11 November 2016 and Intellectual Property Assignment Agreement dated 11 November 2016 (by which the plaintiffs were forced to give up their interests in the first defendant together with the intellectual property rights owned by the first plaintiff) are void on the grounds they were procured under duress, undue influence, unconscionable conduct and or misleading and deceptive conduct in contravention of 1041H(1) of the Act, s 12DA of the ASIC Act and or s 18 of the ACL;

C. A declaration that the second plaintiff is entitled to hold 20% of the issued ordinary shares in the first defendant;

D. Rectification of the share register of the first defendant pursuant to s 175 of the Act to reinstate the second plaintiff as a member and to record that it holds a number of fully paid ordinary shares representing 20% of issued shares in the first defendant alternatively that it holds 6,805,555 fully paid ordinary shares in the first defendant;

E. A declaration that the affairs of the first defendant are being conducted contrary to the interests of the members as a whole and or are oppressive to, or unfairly prejudicial to, or unfairly discriminatory against the second plaintiff, or in the interests of and to the benefit of the second to third defendants and not the first defendant or its members;

F. An order that the second and or third defendants purchase the second plaintiff’s shareholding in the first defendant at fair value; Read the rest of this entry »

In Bioaction Pty Ltd v Ogborne, in the matter of Bioaction Pty Ltd [2022] FCA 436 the Federal Court considered, for the first time by the courts, the deeming provisions of sections 105A and 105B of the Corporations Act regarding service applications to set aside a statutory demand within the 21 day time limit,.  

FACTS

By originating process filed on 3 February 2022, the plaintiff, Bioaction Pty Ltd, sought an order setting aside a statutory demand pursuant to s 459G of the Corporations Act dated 12 January 2022 served by the defendant, Gordon Ogborne (“Ogborne”) [5].

Bioaction  specialises in the design, manufacturing and installation of systems to eliminate or mitigate odorous, hazardous and corrosive gases & Ogborne was its Chief Financial Officer / Chief Operating Officer from December 2019 until November 2021, when he was made redundant [7].

Ogborne and Bioaction were in dispute as to his entitlements where Ogborne claimed he was entitled to any additional sum [8].

On 13 January 2022, Ogborne served the statutory demand on Bioaction seeking payment of $240,688.31 being unpaid:

• salary,
• superannuation,
• salary in lieu of termination,
• annual leave and
• redundancy

pursuant to an employment contract [9].

The statutory demand was Read the rest of this entry »