Victorian public servants hacked the emails of fire chiefs in order to “misuse” information to further the interests of the firefighters union and its secretary.
The insight into the hacking of internal communications at the then-named Metropolitan Fire Brigade (MFB) was published by the Independent Broad-based Anti-corruption Commission (IBAC) on Wednesday.
Union boss Peter Marshall worked with senior staff to access the unauthorised data after becoming convinced he was the subject of a bullying investigation by WorkSafe, according to the report.
IBAC identified five separate incidents where MFB information was accessed or disclosed without authorisation between April 2018 and May 2019.
Three of these incidents involved public servants from the MFB’s information and communications services business area.
“In incidents that IBAC identified, individuals involved were motivated to misuse MFB information to further the interests of the Victorian branch of the United Firefighters Union (UFU) or its Secretary, Peter Marshall,” the report read.
“In addition to accessing other employees’ email accounts, IBAC found individuals shared sensitive MFB information directly with the UFU without permission.
“IBAC’s investigation also found that Mr Marshall sought assistance from employees to inappropriately gather sensitive information on internal investigations related to him, executive contracts and another confidential organisational matter.”
In 2019, Mr Marshall shared an MFB PowerPoint which detailed proposed use of fire incident response simulation software with then-emergency services minister Lisa Neville.
“Mr Marshall had received this document as a result of an unknown MFB employee disclosing it without authority,” the report read.
The PowerPoint contained a pitch for MFB to retain a third party’s software services to assist MFB to close stations and reallocate resources.
Ms Neville later attended a meeting with the then-MFB chief executive and board president where she presented a printed copy of the document and asked why the software was being considered.
“The CEO told IBAC how, following their explanation to the minister regarding the software, she said, ‘You can’t have it’,” the report read.
“The CEO’s evidence was that they believed Mr Marshall had influenced the minister before her meeting with the CEO with the intention of stopping MFB purchasing the software.”
In the report, IBAC found the brigade’s internal information was communicated directly to Mr Marshall without the knowledge of MFB executives.
“To the extent Mr Marshall (in his role) has a broad right to access documents held by MFB, in the incidents identified in Operation Turton, IBAC found no evidence that notice was given to MFB management,” according to the report.
“Instead, the information was provided to the UFU directly by MFB employees – sometimes in their roles as union representatives – without any formal processes being followed or documentation kept.”
“(This access) meant some employees felt comfortable sharing MFB information with the UFU, as there was a view the union would get this information, in time, through other established processes.”
The MFB was abolished in 2020 and absorbed into the newly created Fire Rescue Victoria (FRV).
Four recommendations were made to FRV by IBAC Commissioner Victoria Elliott in the report in order to address corruption risks and improve workplace culture and information security.
“We hope that FRV will continue to engage with its workforce to enhance its information and communication technology systems and processes, addressing the structural and cultural issues identified in Operation Turton,” Ms Elliot said.
IBAC requested FRV provide a progress report on the action taken in six months’ time and a full report on its outcomes within 12 months.
