Secrecy rules were invoked in the Senate after the Opposition attempted to get details on possible cyberattacks targeting the Bermuda Government over the past three years.

Douglas De Couto, the Shadow Minister of Finance, voiced frustration with the silence.

He told The Royal Gazette that the Government had yet to state conclusively that personal information had not been breached in the cyberattack of September 20 that crippled the government IT system.

Dr De Couto spoke after attempting to get a list of all cyberattacks in the three years leading up to September 30, with “with dates and details on the nature of the attack”.

He questioned whether any ransom was requested, the amount of the ransom, and whether any ransom was paid. He also wanted to know what specific actions had been taken by the Government to improve cybersecurity.

David Burt has repeatedly declined to give details on the attack, including whether ransomware was used — citing the need for confidentiality because the attack remained under investigation.

The Premier has also pointed out that the attack’s perpetrators could be monitoring the island’s news.

Owen Darrell, the Government Senate Leader, responded to the parliamentary questions in the Upper House that there had been “many statements made” on the subject, with an “active investigation that’s still current”.

Mr Darrell referenced order 65 (4) f of the Senate’s standing orders, which states that “a question shall not seek information about any matter which is of its nature secret”.

Joan Dillas-Wright, President of the Senate, ruled there could be “no further discussion on the questions”.

Dr De Couto spoke to the Gazette after the Senate wrapped up for the day.

“First of all, we need to understand if the Government did a good job on this — we do not even know what kind of attacks have happened, let alone what the Government’s response has been.

“How can we be confident that the right changes will be made by the Government to improve security?”

He added: “It’s good practice that people communicate about these kinds of things to increase learning so more people know how to respond.

“Then you have to understand about people’s personal information. My view is that the Government have been cagey about this. We do not know for sure if hackers have taken information.”

He cited examples from passport applications to immigration paperwork as well as vaccination records and travel data held on the resQwest software used to manage the island’s regulations to contain the Covid-19 pandemic.

“Government is really not saying anything.

“The last thing is about ransom. To be honest, if it was not ransomware, the Government would have said that. That seems an easy thing to say and I feel that this is the only reasonable conclusion.”

Dr De Couto questioned why secrecy had been invoked over potential attacks in the previous few years.

“If there was a prior attack, what lessons were learnt and actions taken?”

The Premier stated in October that personal data might have been breached and that a parliamentary committee would be formed to investigate all aspects of the attack.

Dr De Couto said he did not believe Parliament was the appropriate body to investigate. He added: “It will be politicised and the Government will stonewall”.

He deferred to remarks by Jarion Richardson, the Leader of the Opposition, who called for an independent Commission of Inquiry and said leaving an investigation to Parliament would “make it subject to political manipulation”.