* * * * 核心 hé xīn 事實 shì shí 大致 dà zhì 準確 zhǔn què 。 。
**The core facts are largely accurate.**
On 21 February 2014, the Australian Information Commissioner opened an investigation after media reports revealed that the Department of Immigration and Border Protection (DIBP) had published personal information of approximately 9,528 asylum seekers on its website [1].
* * * *
The information was contained in a Microsoft Excel spreadsheet embedded within a Microsoft Word version of a routine "Immigration Detention and Community Statistics Summary" dated 31 January 2014 [2].
The Privacy Commissioner's investigation, released in November 2014, found the department breached two privacy principles: unlawful disclosure of personal information and failure to have reasonable safeguards in place [3].
這些 zhè xiē 資訊 zī xùn 包含 bāo hán 在 zài 2014 2014 年 nián 1 1 月 yuè 31 31 日 rì 一份 yī fèn 標題 biāo tí 為 wèi 「 「 移民 yí mín 拘留 jū liú 和 hé 社區 shè qū 統計 tǒng jì 摘要 zhāi yào 」 」 的 de 例行 lì xíng Microsoft Microsoft Word Word 文件 wén jiàn 中 zhōng 的 de Microsoft Microsoft Excel Excel 試算表內 shì suàn biǎo nèi [ [ 2 2 ] ] 。 。
The report confirmed:
- The data included personal details of almost 10,000 asylum seekers (9,528 confirmed, with over 2,500 being children) [4]
- The information was accessible online and was accessed over 100 times from IP addresses in 16 countries including China, Russia, Egypt, Pakistan and Malaysia [5]
- The department took 13 days to request removal of cached copies from the Internet Archive after being notified by Guardian Australia, leaving data publicly exposed for 16 days total [3]
- Minister Scott Morrison and department secretary Martin Bowles disclosed the location of the file in a press release after the breach was reported—information that Guardian Australia had deliberately withheld to limit harm [3]
The Information Commissioner officially found the disclosure was "unlawful" under the Privacy Act [1][3].
The government was eventually ordered to compensate affected asylum seekers in a 2020 determination, marking the first time in Australian history that victims of a mass government data breach received compensation for non-economic loss [6].
It resulted from a publishing error where an Excel spreadsheet containing personal information was embedded in a publicly released statistical report, not a deliberate leak or hack [1][3].
**2.
Departmental response:** After the breach was discovered, the department did take containment steps including removing the file, engaging KPMG for a review, and attempting to remove the file from public search engines [3].
Training and policy deficiencies:** The Privacy Commissioner found the department had policies that "implied awareness of the risk of embedded personal information" but these had "lack of detail" and staff were not adequately trained in online publishing procedures [3].
**4.
Timeline of minister's statements:** The claim about Morrison "making public further information about where to find the still life threatening document" requires context.
Morrison stated on 19 February 2014 that he had been advised "all possible channels to access this information are closed"—but the file remained available on the Internet Archive for almost two weeks after this statement [3].
**5.
Systemic issue, not unique:** The claim frames this as a specific Coalition failure without acknowledging that government data breaches occur across administrations and departments.
The original sources are a mix of mainstream and advocacy sources:
- **The Guardian Australia**: Mainstream news outlet, generally credible, was the outlet that originally broke the story [3].
The reporting includes direct quotes from official investigations.
- **SBS News**: Australian public broadcaster, credible mainstream source [original source 1].
- **Crikey**: Independent news site with a reputation for critical reporting, generally factual but can have an adversarial stance toward government [original source 2].
- **New Matilda**: Left-leaning independent media outlet, advocacy-oriented journalism.
Should be read with awareness of political perspective [original source 4].
- **ZDNet**: Technology-focused mainstream publication, credible for tech/privacy reporting [original source 6].
**Did Labor have similar data breaches?**
Search conducted: "Labor government data breach privacy incidents Australia"
Finding: The 2014 asylum seeker data breach occurred under the Abbott Coalition government.
* * * *
During the Rudd/Gillard Labor governments (2007-2013), there were various data security incidents, though none of comparable scale affecting asylum seekers specifically became publicly prominent.
**Government data breaches are a systemic, non-partisan issue:**
- The Notifiable Data Breaches (NDB) scheme, established in 2018, reports over 1,100 data breaches annually across all sectors [7].
Government agencies consistently feature in these statistics regardless of which party is in power.
- In 2017, the Australian Bureau of Statistics faced significant criticism over the 2016 Census data collection and security concerns, though this was not a breach of published data [no direct equivalent found].
- Various departments across both Labor and Coalition administrations have faced privacy and data security challenges.
The 2014 DIBP breach is notable primarily for its scale and the vulnerability of the affected population (asylum seekers)."
**Key distinction:** While data breaches occur under governments of all stripes, the specific circumstances here—affecting a vulnerable population with potential life-threatening consequences if returned to home countries—make this breach particularly serious.
The scale (nearly 10,000 individuals) and international accessibility (downloads from 16 countries including hostile nations) were exceptional factors [5].
**While the facts are largely accurate, the claim's framing warrants scrutiny:**
**Critics' position:** The breach represented a catastrophic failure of data security affecting vulnerable asylum seekers.
Asylum seekers subsequently argued in court that exposure of their details put them at risk of persecution if returned home [3][8].
**Official findings:** The Privacy Commissioner concluded the department breached privacy law, had inadequate policies, and staff lacked proper training.
The commissioner noted deficiencies in policies, procedures, and training "failed to adequately mitigate against the risk of a data breach" [3].
**Government perspective:** The breach was accidental, and the department took steps to contain it including removal, KPMG review, and search engine delisting attempts.
The minister's statement that "all possible channels" were closed appears to have been based on departmental advice that was incorrect regarding the Internet Archive caching [3].
**Comparative context:** This breach is frequently cited as one of Australia's most serious government data breaches due to the vulnerability of affected individuals and international accessibility.
The subsequent 2020 OAIC compensation order was unprecedented for a government data breach [6].
**Key context:** This breach is not typical of government data handling, but it also was not the result of deliberate malfeasance.
It resulted from systemic deficiencies in training, procedures, and oversight that the OAIC found should have been addressed given the known risks of publishing sensitive information.
The department did unlawfully disclose personal details of approximately 9,500-10,000 asylum seekers, the information remained accessible for 13 days after notification (16 days total), and the minister's press release disclosed information about the file location.
The department did unlawfully disclose personal details of approximately 9,500-10,000 asylum seekers, the information remained accessible for 13 days after notification (16 days total), and the minister's press release disclosed information about the file location.