The federal government’s response to a Medicare data breach that led to patient details being sold on the dark web was “disappointing, confusing and often contemptible,” according to a former detective who headed the Australian federal police’s investigations into high-tech crime.

Nigel Phair, now an adjunct professor at the University of Canberra’s Centre for Internet Safety, told a Senate inquiry the government’s response to data breach concerns meant “less and less people will trust the government with their health details”.

A Guardian Australia investigation revealed in July that a darknet vendor on a popular auction site for illegal products was selling access to anyone’s Medicare card details. The seller used an Australian Department of Human Services logo to advertise what they called “the Medicare machine”.

In his submission to a Senate inquiry into the data breach, Phair criticised the responses of the Department of Health, including the health minister Greg Hunt, and the Department of Human Services, including human services minister Alan Tudge.

“Unfortunately we are plagued by a culture at all levels of government to ‘spin’ the message, including events related to cyber security,” his submission said.

“There is nothing good to come from this in the long term. Considered use of language to clearly communicate cyber security issues is critical, particularly in response to cyber incidents. Effectively communicating cyber security concepts can build confidence, provide assurance and convey opportunity.

“It can be the difference in whether management of a cyber incident, such as the one being investigated by the committee, is perceived as a success or failure.”

He urged departmental and ministerial spokespeople to become fully educated on cyber terminology, the broader online threat environment and its impact on public trust, safety and confidence.

This education should be “combined with a willingness to accept mistakes and inform citizens how they are being addressed”, he added.

A few days after Guardian Australia revealed the data breach, Tudge and Hunt announced a review into the the security of Medicare online. The government has still not announced how the breach occurred. The review’s final report is due by 30 September.The government was warned in 2014 in a report from the auditor-general’s department that Medicare data security procedures did not fully comply with mandatory information security requirements.

Last month, the dark web data breach was referred to the Australian Senate finance and public administration references committee for inquiry.

Submissions to the inquiry closed on Wednesday and Phair’s submission is the first to have been published on the inquiry’s website. A Senate committees spokeswoman said further submissions would be uploaded.



Phair said his centre believes it is unlikely the breach occurred due to a technical failure within the department. It was more likely an “end user” who had bone fide access to the Medicare system abused this access for financial gain, he said.

“Should this be the case, then there has been a major policy and procedural failure by the department with monitoring, investigating and prosecuting unlawful access by legitimate users,” he said. “Australians are early and eager adopters of the internet and associated technologies. However the constant reporting of breaches is diminishing their trust, safety and confidence.”

He said the breach and lack of adequate government response would make Australians reluctant to sign up to other online information management systems such as My Health Record which contains an individual’s health information and allows them to share this between doctors, hospitals and other healthcare providers.

Peter Shergold, a former head of the Department of Prime Minister and Cabinet, Michael Gannon, the president of the Australian Medical Association, and Bastian Seidel, president of the Royal Australian College of General Practitioners, are conducting the review ordered by Hunt and Tudge.

They are examining the operation of the Health Professionals Online Services web portal which is used by doctors, hospital staff and health clinics to look up Medicare numbers.

Gannon told Guardian Australia the review panel needed to consider how to tighten security while maintaining access to the Medicare databases for thousands of medical practices who used it daily, particularly for patients who had lost or forgotten their Medicare card.

“Our advice to the review is that there was about 150 details for sale on the dark web, but there are tens of thousands of times a week where the database is appropriately and legally being used,” he said.

“But we acknowledge the need to tighten security. It’s all too easy for anyone to obtain card details under the current system and perhaps its surprising it’s only come to the government’s attention this late. We have found the online system is probably more secure than the telephone system, so that’s one thing we’ve been looking at.”