HAMILTON, Feb 17, CMC – Information Commissioner Gitanjali Gutierrez, has ordered the Cabinet Secretary, Major Marc Telemaque, to issue a decision on whether an external report on the cyberattack which crippled government services in September 2023 should be made public.
The Royal Gazette reported Monday that Telemaque has been until March 11 to provide the newspaper with a decision and the reasoning behind it.
“It is a matter of fact that the Cabinet Office did not provide the [applicant] with an internal review decision within the statutory time frame. The Information Commissioner is satisfied that the Cabinet Office failed to comply with … the Pati Act and now orders the Cabinet Office to issue an internal review decision,” Gutierrez wrote, adding “the Cabinet Office may also wish to consider apologising to the applicant.”
The Royal Gazette said the report was delivered to the Cabinet Office on November 7, 2023, less than two months after the hack, according to information shared in the Senate by tourism minister Owen Darrell last June.
“Those who prepared it, external to Government, have had access to the report,” Darrell told legislators, adding that the report was not produced internally.
Opposition senator Douglas De Couto criticised the Government for its alleged “delaying tactics and lack of clarity” regarding the report.
A Cabinet Office spokeswoman responded later that the report would not be made public.
The Royal Gazette newspaper said it had requested the document under public access to information legislation on September 12 last year but did not receive a decision within six weeks, as required by law.
The newspaper requested an internal review from the head of the authority, Major Telemaque but, again, received no response within six weeks so appealed to the Information Commissioner.
It said the Pati request also sought any other internal or external reports held by the Cabinet Office about the cyberattack and any communications concerning the formation of a joint select committee to investigate the attack.
It was announced in October that the self-governing, bipartisan JSC would be chaired by Lawrence Scott, a government backbencher, with the government legislators Scott Simmons and Anthony Richardson, and the main opposition One Bermuda Alliance’s Robert King and Dwayne Robinson, also appointed.
The newspaper said that Scott promised monthly updates on the committee’s progress in November but nothing further was released before the election was announced on January 8.
The Cabinet Office said that it has received the Information Commissioner’s order and noted its contents.
In May last year, Parliament approved legislation providing for stringent punishment—including life imprisonment—for anyone convicted of offences that cause “a significant risk of serious damage to human welfare or serious damage to national security”.
National Security Minister, Michael Weeks, said the Computer Misuse Act 2024, which the government said is intended to help battle cybercrime in the British Overseas Territory, also will provide for a one-million-dollar fine.
In September, 2023 Bermuda suffered a “major cyber-attack” that brought down government information technology (IT) services.
Premier David Burt said an investigation into the cyber-attack that severely hampered the government’s information systems had found circumstantial evidence that personal data may have been exfiltrated.
Under the new legislation, offences will include unauthorised access to computer material, unauthorised access with intent to impede the operation of a computer and unauthorised acts that cause or create a risk of serious damage.
“Damage” was defined in the legislation as damage to human welfare, the environment, the economy or the national security of any country. The legislation also makes it an offence to adapt, supply or offer to supply any article to assist in computer crime.
CMC/af/ir/2025