IBAC publishes responses to our investigations and research reports to inform the community about actions agencies advise they are taking and to assist Victoria Police and the public sector to strengthen policies, systems and practices to prevent corruption and misconduct.
In June 2022, January 2023 and August 2023, Victoria Police provided IBAC with progress updates on its implementation of Recommendation 2 of IBAC’s special report on Operation Dawson. Recommendation 2 recommended that:
Victoria Police regularly reinforce with all personnel the legislation, policies and requirements around the access to and use of Victoria Police information in accordance with the Victoria Protective Data Security framework’s guiding principle to promote a positive security culture. In particular, it should be made clear in training and awareness-raising activities that:
- it is improper for these systems to be used in connection to matters personnel have a personal involvement or interest in
- police personnel have an obligation not to disclose information to other personnel who request information, except where they have a demonstrable, legitimate business need which arises from and is directly related to the performance of their current duties
- there are potential serious consequences of such improper conduct, as illustrated by Operation Dawson.
IBAC considers that this recommendation has been acquitted and closed.
Progress response from Victoria Police (June 2022)
The below actions emphasise the specific ways Victoria Police is implementing this recommendation. Achieving a positive security culture is fundamental to all the work undertaken by Victoria Police.
Actions underway or planned to acquit this recommendation include:
- The compulsory Cyber Security Awareness Training online course is to be updated to include specific reference to the subject material arising from Operation Dawson. Every member of the organisation completed this program when it was introduced in 2019 and since then every new employee completes it upon arrival. Its current content indirectly addresses the issues raised in Operation Dawson, however a more direct focus is to be implemented. An external contractor has been contracted to review the content.
- A number of security related policies have been reviewed by an external consultant. As a result, twenty (20) policy amendments were proposed and a number of these are now being progressed through the Policy Liaison Officer (PLO) network. Once these have been accepted and finalised we will be able to review each of them and determine whether there is sufficient coverage, or the need for further adjustment that will assist and address this Recommendation.
- Updating and regularly changing the Law Enforcement Assistance Program (LEAP) access acknowledgement questions is another activity that is planned. Before accessing LEAP, personnel must complete four questions, to acknowledge their responsibilities in accessing the system and using the information for valid reasons. These questions are being updated to bring them into line with members demonstrating their knowledge of the issues raised in Operation Dawson. The questions will be rotated and mixed to ensure the acknowledgement made is a considered response, re-enforcing employee’s responsibilities to maintain secure data and use for business purposes.
- Internal webpages will be updated to include specific reference to Operation Dawson and the principles referred to in the recommendation.
- A specific reference to the issues raised in Operation Dawson occurs in specific face-to-face training. Currently ongoing face-to-face training is conducted at the Victoria Police Academy.
- Information being provided to the Victoria Police Protective Security Portfolio Holders (PSPH’s - approximately 650 locally based personnel) regarding Operation Dawson for local discussion and input.
Progress response from Victoria Police (January 2023)
The below actions emphasise the specific ways Victoria Police is implementing this recommendation. Achieving a positive security culture is fundamental to all work undertaken.
Actions underway or planned to acquit this recommendation include:
- The compulsory Cyber Security Awareness Training online course is being updated to include specific reference to the subject material arising from Operation Dawson (the People Development Command are currently finalising the new course). Every member of the organisation completed this program when it was introduced in 2019 and since then every new employee completes it upon arrival. Its current content addresses the issues raised in Operation Dawson, with a more direct focus on information security. As the content of the online course will include new information, Victoria Police will consider if this package should be compulsory for completion by all employees.
- Security related policies have been reviewed by an external consultant and are currently in the process of being promulgated.
- The Law Enforcement Assistance Program (LEAP) access acknowledgement questions have been assessed and reviewed. Before accessing LEAP, members must complete four questions, to acknowledge their responsibilities in accessing the system and using the information for valid reasons. These questions ensure members demonstrate their knowledge of the issues raised in Operation Dawson and their commitment to only accessing and using LEAP in line with legislation and policy.
- Victoria Police internal webpages have been updated to include a specific reference to Operation Dawson and the principles referred to in the recommendation. A specific reference to the issues raised in Operation Dawson has been incorporated in specific face-to-face training, and included as a standing agenda item at training sessions with all new recruits, constable’s probation confirmation sessions and Sergeants Courses. Ongoing face-to-face training is conducted at the Victoria Police Academy in the first week of recruit attendance. Notes that are used in standing sessions at the Academy highlight information security and reference Operation Dawson where appropriate. Additional training opportunities such as station training days also occur periodically and also reference Operation Dawson.
- Information about Operation Dawson has been provided to the Victoria Police Protective Security Portfolio Holders (PSPHs) via email and in discussions in a PSPH Community of Practice meeting. Information highlighting Operation Dawson has been made available to all Victoria Police personnel via an intranet article on the Victoria Police Bulletin Board.
Progress response from Victoria Police (September 2023)
Victoria Police is continuing to review its Protective Security policies as part of the broader review of policies under the stewardship of the Digital Services and Security Department.
Summary of Protective Security policies currently under review and consolidation:
- VPM Portable recording devices and digital asset management, is a new VPM published on 15/9/2023. This new VPM consolidates and replaces:
- VPM Digital asset management
- VPMG Portable recording devices.
- The full suite of VPM Information management and security policies
- The publication of all the new VPM’s is planned to be a staged approach, commencing January 2024 (Suite one - Information management use and sharing, Suite two - ICT equipment services and digital assets, Suite three - Physical and personnel security)
IBAC has requested Victoria Police advise IBAC when these new VPMs have been implemented.
