Peter A Clarke

It is becoming common practice for companies affected by the significant data breaches to seek injunctive relief. The Australian reports in Qantas goes to court over cyber attack in attempt to stop stolen data being released or used. that Qantas has obtained an interim injunction in the New South Wales Supreme Court. A copy of the orders has not been released but it is reported as intending “..to prevent the data being accessed, viewed, released, used, transmitted or published by anyone including by any third parties.” There is no identified respondent to the application.  It is also covered by 9 News and Reuters.  If the process follows the approach taken by the court in the HWL Ebsworth application for injunctive relief in 2024.

Interestingly the National Office of Cyber Security prepared a report on the HWL Ebsworth Cyber Security Incident titled “Lessons Learned Review”.  Under the hearing “What was interesting” the report says the following about the injunction HWL Ebsworth obtained from the Supreme Court of New South Wales.  

The granting of an injunction from the Supreme Court of New South Wales to HWL Ebsworth was a key point of interest during the management of the incident. The injunction was sought by HWL Ebsworth to restrain further access to or publication of information exposed during the incident, in an attempt to protect client data, and minimise ‘online rubbernecking’. Overwhelmingly, government entities viewed this enabled better support to impacted clients (including individuals) through minimising the likelihood that other actors may access and act on the published data, and was overall viewed as a sensible step in the firm’s response.

HWL Ebsworth’s intention when seeking the injunction was never to stop its clients from accessing their own data, as several clients were granted exemptions to ensure access for this purpose could continue. However, the injunction also prevented accidental unauthorised access which would have been inevitable in the circumstances where clients of the firm were seeking their own information but would, in the process, further compromise the privacy of other matters unintentionally.

There is quite a bit of supposition in that assessment.  It is not possible to know whether the injunction performed that role.  There has been no reported contempt of court proceedings for breaching the injunction.  It would also be quite difficult to determine whether there was a reduction in ‘online rubbernecking’ to start with and whether it was reduced.  How to monitor on line rubber necking is another issue.  If the data is stored on the dark web in a particular site removing the data, highly improbable, would be a better solution than working out who viewed it, even more difficult.  That said injunctive relief is now part of the response in large scale data breaches.  

It is clear from the assessment that the orders were almost certainly more involved and complicated than a blanket prohibition.  There is reference to exemptions.  That is an important issue when seeking such orders.  It is important to avoid putting those who are victims who discover their personal information and in viewing it may in a position where they may be in contempt of court.  Clearly not an intended consequence.

The Australian story Read the rest of this entry »

That data breaches cause damage is trite. The damage may be economic or psychological. It can also be life threatening as the Times story Revealed: Leak that risked lives of 100,000 Afghans — and £7bn cover-up makes clear. As does the BBC report Thousands of Afghans were moved to UK in secret scheme after data breach. A data breach by a British official at the Ministry of Defence in February 2022 resulted in the personal details of 19,000 people who applied to move to the UK after the Taliban took over were leaked. That prompted a resettlement scheme which has resulted in 4,500 Afghans moving to UK so far. So far, so bad.

What is very interesting to legal practitioners is that the Government sought and obtained a super injunction which involved a gag order relating to the data breach and its contents.  It was the first time the Government sought a super injunction and it was the longest ever granted.That was lifted yesterday in Ministry of Defence v Global Media and Entertainment Ltd & ors [2025] EWHC 1806.   

In reviewing and ultimately lifting the gag order teh court made the following points regarding the grant and Read the rest of this entry »

Implementing proper password protection is one of the foundation blocks of proper cyber security. It has been since the internet was established. But it remains a real problem with many organisations. Bleeping Computer with ‘123456′ password exposed chats for 64 million McDonald’s job chatbot applications reports on a spectacular fail with both log ins and passwords, both being 123456.

The Bleeping Computer article Read the rest of this entry »

The National Institute of Science and Technology (“NIST”) has publisheda guideline on High-Performance Computing (HPC) Security Overlay,

Recommendation for Key Management, Part 3: Application-Specific Key Management Guidance and

The announcement about the HPC provides:

High-performance computing (HPC) systems provide fundamental computing infrastructure for large-scale artificial intelligence (AI) and machine learning (ML) model training, big data analysis, and complex simulations at exceptional speeds. Securing HPC systems is essential for safeguarding AI models, protecting sensitive data, and realizing the full benefits of HPC capabilities.

This NIST Special Publication introduces an HPC security overlay that is designed to address the unique characteristics and requirements of HPC systems. Built upon the moderate baseline defined in SP 800-53B, the overlay tailors 60 security controls with supplemental guidance and/or discussions to enhance their applicability in HPC contexts. This overlay aims to provide practical, performance-conscious security guidance that can be readily adopted. For many organizations, it offers a robust foundation for securing HPC environments while also allowing for further customization to meet specific operational or mission needs.

The recommendations for best practices for key management organisations, part 2 provides:

NIST Special Publication (SP) 800-57 provides cryptographic key management guidance. It consists of three parts. Part 1 provides general guidance and best practices for the management of cryptographic keying material. Part 2 provides guidance on policy and security planning requirements. Finally, Part 3 provides guidance when using the cryptographic features of current systems. Part 2 (this document) 1) identifies the concepts, functions and elements common to effective systems for the management of symmetric and asymmetric keys; 2) identifies the security planning requirements and documentation necessary for effective institutional key management; 3) describes Key Management Specification requirements; 4) describes cryptographic Key Management Policy documentation that is needed by organizations that use cryptography; and 5) describes Key Management Practice Statement requirements. Appendices provide examples of some key management infrastructures and supplemental documentation and planning materials.

The recommendations for Key Management part 3;  Application-Specific Key Management Guidance provides:

IST Special Publication 800-57 provides cryptographic key management guidance. It consists of three parts. Part 1 provides general guidance and best practices for the management of cryptographic keying material. Part 2 provides guidance on policy and security planning requirements for U.S. government agencies. Finally, Part 3 provides guidance when using the cryptographic features of current systems.

Read the rest of this entry »

The New South Wales Audit Office has published its report, titled Cyber Security insights 2025, on state agencies cyber health and preparedness against a cyber attack. it is a mixed report, which is a concern given the fact that the state collects and holds a vast amount of information of people of New South Wales and encourages, if not requires, people to do business with the state on line. The Report is quite critical about aspects of preparedness.

The ABC has done a story on the report with NSW audit finds gaps in state, local government cyber protections which provides:

The highlights of the report Read the rest of this entry »

Cameras placed in toilets or showers has been a feature of privacy intrusive behaviour for almost as long as there have been working photographic equipment. In May the ABC reported in Women filmed in bathroom without their consent, former housemate to be sentenced over violation as did the Guardian in Every time I took a shower I thought: is he watching me?’ – the terrifying rise of secret cameras. Yesterday the ABC reports in Junior doctor charged after camera found in staff bathroom at Melbourne hospital that a trainee surgeon has been charged with stalking and using an optical device after a camera was found in a staff toilet at the Austin Hospital in Melbourne.    

In Australia the common law has not responded to privacy protections and only tentatively in equity.  The preference of legislatures was to criminalise such intrusive behaviour but shy away from providing civil remedies. That was an inadequate response.  That significant gap in the law has been filled by the enactment of a statutory tort of serious invasion of privacy on 10 December 2024, taking effect on 10 June 2025. Behaviour as described in the ABC articles would provide a strong basis for issuing proceedings allegation a serious invasion of privacy.

The earlier ABC article provides:

When Sarah* moved into her first Sydney share house, the Canadian expat thought it was a “completely safe, normal environment”.

Months after moving out, she would find out it was the backdrop of a horrific violation of privacy and trust, perpetrated by her former male housemate. Read the rest of this entry »

The Qantas data breach saga is following a predictable trajectory largely due to a poor initial response to the data breach. The coverage has moved, having begun that transition yesterday, from the data breach itself to the impact on the customers, continuing problems with communication and possible compensation. As the story has developed victims or just upset customers coming forward to provide colour and put Qantas in an even poorer light.   The stories are widespread including the Australian’s Qantas cyber incident: frequent flyers, customers await update on stolen data with the SMH’s Qantas hack will haunt affected customers for a long time, experts warn and Qantas hack victims could get compensation, say experts and ABC’s Qantas data breach: questions remain. And as with data breaches where there are internal issues, and a poorly management data breach response, the leaks come thick and fast. As Crikey demonstrates with ‘This isn’t a one-off glitch’: Qantas pilots blast airline over data hack of 6 million customers. 

The coverage demonstrates how important it is for companies to move quickly and transparently to respond to a data breach.   It also highlights the poor understanding of privacy law based on some of th claims made. The Qantas data breach saga is a lesson in how not to respond to a data breach.

The SMH’s Qantas hack victims could get compensation ay experts highlights the sketch understanding of how civil penalty proceedings operate and what options are available for seeking compensation.  The story accurately sets out the maximum penalty the Federal Court could impose if a civil penalty action were brought under section 13H of the Privacy Act 1988.  But that does not equate to compensation to consumers.  It is a penalty.  Whether the Privacy Commissioner distributes whatever penalty imposed if unknowable.  Given that, Dr Srivastava’s quoted statement as to how the Privacy Commissioner operates is confusing.  A more likely route for compensation would be a class action alleging various common law causes of action and potentially statutory claims.  It is possible but difficult to consider using the new statutory tort of serious interference with privacy.  It would be necessary to show that Qantas’ conduct was reckless.  provides:

Read the rest of this entry »

Qantas has finally posted details of compromised personal information by way of an update today. Nine days after first detecting the intrusion. The stolen data related to 5.7 million customers.  Of that number:

• 4 million customer records are limited to name, email address and Qantas Frequent Flyer details. Of this:
  • 1.2 million customer records contained name and email address.
  • 2.8 million customer records contained name, email address and Qantas Frequent Flyer number. The majority of these also had tier included. A smaller subset of these had points balance and status credits included.
• Of the remaining 1.7 million customers, their records included a combination of some of the data fields above and one or more of the following:
  • Address – 1.3 million. This is a combination of residential addresses and business addresses including hotels for misplaced baggage delivery.
  • Date of birth – 1.1 million
  • Phone number (mobile, landline and/or business) – 900,000
  • Gender – 400,000. This is separate to other gender identifiers like name and salutation.
  • Meal preferences – 10,000

So the majority of the stolen records were limtied to names, email addresses and Frequent flying points.  Plenty to undertake some phishing and a good start for identity theft. Those 1.7 million customers whose residential addresses, data of birth and phone number are in a more vulnerable situation.  Those data points are very useful for a range of illegal activities, especially identity theft. 

Qantas has finally provided some advice and pointed to IDcare as providing assistance.  It is fairly rudimentary but better than the non responsiveness of earlier days.

This has prompted another round of media coverage with the Australian’s Qantas reveals extent of personal details stored on database that was subject to cyber attack and Major update after 5.7 million Qantas customers affected by widespread cyber attack. And some prognosticating with Qantas cyber hack highlights danger of storing huge banks of customer data, says legal expert. Of particular Read the rest of this entry »

The protection of children’s privacy on line is a key area of regulation and development worldwide. The US State of Nebraska has from 30 May 2025 implemented an age-appropriate design code law. The Code mandates online service providers prioritize children’s privacy and safety through proactive design principles. Effective January 1, 2026, the Code imposes stringent requirements on covered entities, including data minimisation, default privacy settings, and restrictions on targeted advertising to minors. Enforcement by the Nebraska Attorney General begins on July 1, 2026, with penalties up to $50,000 per violation.

There is an obligation for online services to have default settings which offer the highest level of privacy protection for minors including:

• limiting communication between minors and other users;
• preventing unauthorised access to minors’ personal data;
• restricting precise geolocation tracking;
• allowing the minor to control all design features unnecessary to operate the services requested by the minor;
• permitting the minor to control personalised recommendation systems by allowing opt-in to chronological feeds or prevent certain types of content from being recommended; and
• controlling the use of in-game purchases by allowing opt-outs or the option to limit such purchases.

These settings apply to ‘covered design features.’.

Under the Code there Read the rest of this entry »

The media report (in the Australian amongst others) that a/the cyber hacker has approached Qantas and it and the Australian Federal Police are determining whether the approach is by the cyber hacker. As per usual with Qantas has stated there has been an approach but said nothing else. It is consistent with approaches taken by many Australian companies affected by data breaches but not consistent with best practice in the United States where there is more candour which, usually, results in more sympathy. It is a different story when it comes to paying to remove ransomware. In that regard non disclosure is universal. Given that the Australian Federal Police are trying to determine whether the approach is from the hacker or just an opportunist there won’t be any payment of ransom.

There is some confusion about what to do regarding ransoms.  It is not illegal to pay a ransom.  It may be illegal not to report such a payment.  Whether such a payment is reportable depends on the circumstances and applying them to the legislation.  It can be quite a technical exercise.

Under Part 3 of the Cyber Security Act 2024 , which took effect on 30 May 2025, entities covered by the legislation must provide notification of ransom payments that have been made in certain circumstances. The legislation sets out the process in detail.  It is important to appreciate that some assessment is required to determine whether an entity is obliged to make a report or not.

Entities covered by the legislation are those:

1. responsible for critical infrastructure assets under Part 2B of the Security of Critical Infrastructure Act 2018 (Cth) ; or
2.  carrying on business in Australia with an annual turnover exceeding $3 million.  The coverage is set out in the Cyber Security (Ransomware Payment Reporting) Rules 2025.

An entity must Read the rest of this entry »