Ministers’ private email accounts in historical data breach

CCC chair Alan MacSporran said at the time the number of emails assessed were fewer than 20 and “didn’t excite our interests”.

But a search of breach notification service Have I Been Pwned shows that address was among an estimated 160 million exposed in the LinkedIn breach, including Mr Bailey’s [email protected] email account and the official email for the president of the Queensland Liberal National Party.

The data, comprising emails and encrypted passwords associated with accounts on the social media platform, had been hacked four years earlier but was only made public in 2016 when millions more of the passwords were offered for sale online.

The format in which the passwords were stored meant at least 86 per cent of account passwords were estimated to have been unencrypted in the days and weeks that followed. LinkedIn responded by forcing some users to change their passwords.

Troy Hunt, the founder of Have I Been Pwned, said anyone who used the social platform at the time should “work on the assumption that the bad guys know” what their password was and pointed to the fact many people also reuse passwords across other accounts.

Loading

“They might be elected officials but they are normal humans. They are going to be reusing passwords, that’s just what happens,” he said.

Australian Privacy Foundation board member Monique Mann said the situation also created a “whole range of information security risks”, particularly if government work was being conducted on private accounts and passwords were not being managed effectively.

A series of questions was sent to Ms Palaszczuk’s office, including whether she was aware of the data breach, what action may have been taken to secure the account, and whether the password had been changed since 2012 or used for any other personal or official accounts.

Questions were also asked about whether she would call for an investigation into the use of the account or allow the release of emails associated with it.

Loading

“Please refer to the Premier’s statements on these matters,” a spokesman for Ms Palaszczuk said.

“Also refer to the CCC chairman’s comments that there was nothing of interest to the CCC in the emails and no evidence at all of wrong-doing and that the further investigation into the matters, as the LNP demands, would be ‘a wild fishing expedition’ … and a ‘waste of time’.”

Fronting a regular parliamentary committee meeting on Friday, Mr MacSporran revealed Ms Palaszczuk also had a second email address — [email protected] — and said the use of private accounts was “inappropriate” while some of the emails sent could “properly be categorised as public records”.

In the 2020 estimates hearing, Ms Palaszczuk clarified an earlier denial to Parliament in 2017 to say she had not used the email account for official business since she banned ministers from using personal accounts and other messaging apps to discuss such matters in 2018, following the investigation into Mr Bailey’s use — and subsequent deletion of — his own.

LNP integrity spokeswoman Fiona Simpson reiterated calls on Friday for Ms Palaszczuk to release the emails. Both Mr Bailey’s office and the LNP’s administrative branch were contacted for comment.