Dear Sir,

September 8, 2017 (six years ago)

From the Progressive Labour Party government Throne Speech:

“In 2017, national security must also focus on cybersecurity and ensure that our digital infrastructure is protected and safe. The Government will introduce Bermuda’s first National Cybersecurity Strategy to promote the maintenance of a secure electronic infrastructure in both the public and private sector. As the potential for cyberattacks to generate significant consequences to Bermuda’s economy and society increases Bermuda’s cybersecurity is a national priority. A harmonised approach that ensures Bermuda prevents, is prepared for and recovers from cyberattacks is required. Accordingly, the Government will commence stakeholder consultations to develop a National Cybersecurity Strategy.”

June 17 2023 (six years later)

Michael Weeks, the Minister of National Security, said:

“A cybersecurity unit is being developed to protect the island’s digital assets”. Michael Weeks told the House of Assembly that his ministry worked with several groups, including the International Telecommunications Union, to develop a plan for a cybersecurity unit. He said that once the system was up and running, it would lay down the foundation for the National Cybersecurity Incident Response Team to protect the island’s public and private digital infrastructure. The taxpayer should be aware (and reassured) that since 2019, the Government has engaged a senior-level, risk-based Enterprise Cybersecurity Programme Leader with exceptional breadth and depth of knowledge, skills and experience.

September 22, 2023

David Burt, the Premier:

“The Government is experiencing some challenges with our IT systems. There has been an incident which is affecting not only the Bermuda Government but some other regional governments as well. Our initial indication is that it’s come from an external source, most likely from Russia, and we are working with agencies to make sure that we can identify any particular challenges and make sure that services are restored as quickly as possible.”

In response, Her Excellency the Governor, Rena Lalgie, said:

“Yesterday Bermuda’s Government IT systems were subjected to a major cyberattack. That incident is ongoing. While there was an early indication of the geographical source of that attack, any further speculation on the possible source or motivation for the attack would be unhelpful.”

In response, Walter Roban, the Acting Premier, said:

“The very heart of public services has been attacked and immobilised. There are international implications around some of the issues that have arisen as a result of this.”

Let me first say that I commend this government, which, in 2017, identified cybersecurity as being a critically important aspect of the protection of all taxpayer data collected and pledging to move forward with a data security plan. I cannot recall previous administrations having a focus in this space and I think we all know how much the technological world we live in has changed and presents serious risks many of us have little to no clue about.

I have four questions:

• Over a period of six years, was a cybersecurity plan formulated?

• If so, was that plan accepted by the Minister of National Security?

• If so, was that plan implemented?

• If not, why not?

The public deserve to know what, if anything, was in place this week to address the recent cyberattack because we paid for five years of planning for cybersecurity for exactly this type of occurrence. Maybe that plan exists and is sitting on a crowded tech “shelf” in government data storage. We won’t get access to it anytime soon.

BEVERLEY CONNELL

Pembroke