Public trust compromised

“INACCURATE and misleading reports can misinform and potentially damage public trust and also harm our company,” said the Telecommunications Services of TT (TSTT) on Friday in a media release – its second in a week – in relation to the issues raised after an October 9 incursion into its systems by cyber attackers.

But the damage to public trust had already been done. And TSTT played no small role in that.

It was TSTT that initially told the country, in a media release dated October 30, that “there was no loss or compromise of customer data.” That media release referred, repeatedly, to an “attempted” breach.

If the ordinary or natural meanings of those words were not meant to fend off the impression that something had gone amiss, Minister of Public Utilities Marvin Gonzales removed any doubt when, on the same day, and reportedly based on representations made to him by TSTT, he boldly declared to this newspaper of the attack: “It was not true.”

It was true.

Incredibly, by last Friday TSTT was splitting hairs, telling the country it had determined only “identifying” customer data was breached. The information accessed contained, it seems, names, e-mail addresses, home addresses, ID scans, as well as account information and mobile numbers.

Troublingly, TSTT added that it had come to this determination as it worked with international cyber-security experts to examine data published on the dark web “during the past seven days.” This timeline suggests that as it confidently assured the country days before that “there was no loss or compromise of customer data,” it was actively checking to see whether precisely the opposite had occurred.

Worse is the fact that the incursion took place reportedly on October 9, but the company’s first statement was issued about three weeks after.

Either TSTT was slow to understand the full nature of what occurred – which is a worrying possibility for the nation’s leading full-service telecommunications provider – or worse. TSTT’s admission in its initial statement that “the company has not corroborated data currently in the public domain” would appear to admit the possibility that it was aware that its bold assurances to the public were unsound.

Mr Gonzales has now ordered TSTT to arrange an independent enquiry into what has occurred.

But the position of the TSTT board appears increasingly untenable in that regard. It is hard to imagine the commissioning of a truly independent probe under current company leadership.

Meanwhile, the seriousness with which these developments have been viewed by the regulator, the Telecommunications Authority of Trinidad and Tobago (TATT), is also a sign of what is at stake here.

TATT may well be the best and only agency capable of presenting the public with the facts in this matter. We deserve those facts.