Asha Javeed

Lead Ed­i­tor In­ves­ti­ga­tions

asha.javeed@guardian.co.tt

Quash the cy­ber breach re­port. That’s the re­quest from two fired for­mer ex­ec­u­tives of TSTT—for­mer chief ex­ec­u­tive Lisa Agard and for­mer chief fi­nan­cial of­fi­cer Shi­va Ram­nar­ine—to Pub­lic Util­i­ties Min­is­ter Mar­vin Gon­za­les in a le­gal let­ter sent last Thurs­day, as they in­sist that it should not be laid in Par­lia­ment.

The for­mer ex­ec­u­tives be­lieve that the re­port, which con­tains po­ten­tial neg­a­tive find­ings on their role dur­ing the cy­ber breach, “is laden with con­jec­ture and is there­fore in­fect­ed with un­law­ful­ness.”

In the le­gal let­ter by at­tor­ney Ka­ri­na Singh of For­tis Cham­bers, the duo said if they do not re­ceive a favourable re­sponse from Gon­za­les, they would seek leave “to ap­ply for ju­di­cial re­view for an or­der re­strain­ing the pub­li­ca­tion of the re­port on the ba­sis that the pub­li­ca­tion would be il­le­gal, ir­ra­tional, and/or pro­ce­du­ral­ly im­prop­er.”

The re­port, which was re­quest­ed by Gon­za­les fol­low­ing the cy­ber breach on Oc­to­ber 9, 2023, was done by the in­ter­na­tion­al cy­ber­se­cu­ri­ty firm, the Kudel­s­ki Group.

The let­ter from the duo stat­ed, “We are of the con­sid­ered view that be­fore the is­suance of any re­port con­tain­ing ad­verse state­ments and/or find­ings against our clients, Kudel­s­ki must give full and frank dis­clo­sure of the par­tic­u­lars of the al­le­ga­tions which un­der­pin their pro­posed find­ings. This will al­low our clients to ad­e­quate­ly ad­dress those al­le­ga­tions and af­ford them the op­por­tu­ni­ty to re­view doc­u­men­ta­tion or wit­ness state­ments up­on which Kudel­s­ki re­lied to sub­stan­ti­ate such find­ings.

“There­fore, had Kudel­s­ki giv­en due con­sid­er­a­tion to same, it would not have ar­rived at the find­ings and/or po­ten­tial crit­i­cisms against our clients.

We there­fore con­tend that Kudel­s­ki ex­er­cised its pow­ers in a man­ner that is so un­rea­son­able that no rea­son­able per­son could have so ex­er­cised the pow­er, un­fair­ly and its re­port. It is trite law that these as­pects of un­law­ful­ness pro­vide suf­fi­cient ba­sis for in­junc­tive re­lief and fur­ther, for the said re­port to be quashed.”

Fol­low­ing the cy­ber breach, Gon­za­les had or­dered an in­de­pen­dent in­ves­ti­ga­tion in­to the in­ci­dent and gave an un­der­tak­ing that the find­ings would be made pub­lic as he in­tend­ed to lay it in Par­lia­ment. The Kudel­s­ki re­port is an in­de­pen­dent re­port.

Fol­low­ing the breach, TSTT en­gaged the ser­vices of a lo­cal in­de­pen­dent cy­ber­se­cu­ri­ty com­pa­ny, Cy­ber­Eye, which is af­fil­i­at­ed with Cross­word Cy­ber­se­cu­ri­ty Plc in the Unit­ed King­dom, to do a root cause and log analy­sis, se­cure re-en­able­ment, as­sess the ef­fec­tive­ness of TSTT’s cur­rent cy­ber­se­cu­ri­ty con­trols for pro­tect­ing its in­for­ma­tion as­set against cy­ber threats, and, fi­nal­ly, threat mon­i­tor­ing and de­tec­tion as part of its in­ter­nal in­ves­ti­ga­tion.

The duo ar­gued that Kudel­s­ki failed to give con­sid­er­a­tion to those re­ports that were com­plet­ed.

Gon­za­les: It will be laid

But Gon­za­les yes­ter­day in­sist­ed that the re­port, which in his view took too long, would be made pub­lic but could not give a def­i­nite date. He said it was sent to the Na­tion­al Se­cu­ri­ty Coun­cil, and he ful­ly in­tends to lay it in Par­lia­ment with­in the short­est time pos­si­ble.

“Noth­ing sur­prised me in the re­port,” he said. “When the re­port is laid, the coun­try will see some of the key rec­om­men­da­tions as to what TSTT needs to do to boost its cy­ber­se­cu­ri­ty. I can al­so say that TSTT has done a lot of work in the last year to com­ply with some of the rec­om­men­da­tions in the re­port,” he added.

The Kudel­s­ki in­ves­ti­ga­tion

The le­gal let­ter said that on Sep­tem­ber 26 and 29, 2024, the Kudel­s­ki team con­tact­ed Agard and Ram­nar­ine on po­ten­tial crit­i­cisms that were be­ing ad­dressed. The let­ter said that giv­en that nei­ther Agard nor Ram­nar­ine have had sight of the fin­ished re­port, they are un­clear whether those crit­i­cisms have changed, and they de­scribe this as un­fair, ir­ra­tional, and il­log­i­cal. It al­so said that, in their view, Kudel­s­ki has not fa­cil­i­tat­ed the duo with “a fair and mean­ing­ful op­por­tu­ni­ty to be heard fol­low­ing its no­tice to our clients of the high­light­ed ‘po­ten­tial crit­i­cisms’ against our clients.”

The let­ter added, “We have ad­vised of sev­er­al ob­jec­tions, in­ter alia, is­sues of dis­put­ed fac­tu­al ac­counts, the re­liance on per­sons un­known and undis­closed in the re­port, and the re­liance on same to make spec­u­la­tive as­ser­tions which are con­tra­dic­to­ry to ma­te­r­i­al ev­i­dence con­tained in doc­u­men­ta­tion as well as oth­er ex­pert re­ports un­der­tak­en and di­rect­ly re­lat­ed to the is­sues raised in this mat­ter. As you are aware, in­ves­tiga­tive re­ports may be quashed and/or in­junct­ed from pub­li­ca­tion be­cause of the fail­ure to ad­here to prin­ci­ples of nat­ur­al jus­tice.”

The duo al­so claim that while Kudel­s­ki ad­vised them of “a re­vised ap­proach” in pro­ceed­ing to com­pile the terms of its re­port, it has frus­trat­ed their “le­git­i­mate ex­pec­ta­tion to a pro­ce­dur­al ben­e­fit.”

Both Agard and Ram­nar­ine raised con­cerns about a con­clud­ing state­ment in a let­ter from Kudel­s­ki, which they in­clud­ed in their le­gal let­ter sub­mit­ted to Gon­za­les.

“Kudel­s­ki fur­ther pre­ma­ture­ly con­clud­ed that ‘we do not con­sid­er that the process of our in­ves­ti­ga­tion lends it­self to re­solv­ing such dis­put­ed rec­ol­lec­tions of events not oth­er­wise sub­stan­ti­at­ed by doc­u­men­ta­tion, and nei­ther do we con­sid­er that the sub­ject mat­ter of these dis­putes is suf­fi­cient­ly cen­tral to our re­port to re­quire such res­o­lu­tion’.

“Re­spect­ful­ly, we do not ac­cept this po­si­tion, which di­rect­ly im­pacts the in­tegri­ty of any in­tend­ed re­port to be com­piled. Fur­ther, this ap­proach is demon­stra­tive of a plain­ly il­log­i­cal ap­proach. By ne­ces­si­ty, cer­tain facts would need to be re­solved pri­or to ar­riv­ing at con­clu­sions. Such an ap­proach may al­so be demon­stra­tive of “pre­de­ter­mi­na­tion” be­cause, in essence, it ap­pears that Kudel­s­ki adopt­ed a closed mind to­wards the in­for­ma­tion po­ten­tial con­cerns of our clients,” the let­ter said.

They ar­gue that Kudel­s­ki has drawn con­clu­sions that are un­sup­port­ed and base­less and, in the ab­sence of ev­i­dence, that they have act­ed con­trary to its terms of ref­er­ence [as of 21 March 2024] and its ex­er­cise of dis­cre­tion through­out the in­ves­ti­ga­tion, and its find­ings are pri­ma fa­cie ir­ra­tional.

The let­ter not­ed that Kudel­s­ki’s de­ci­sion not to pro­vide specif­i­cal­ly re­quest­ed items of dis­clo­sure of ma­te­r­i­al by Agard and Ram­nar­ine has de­prived them of hav­ing a fair and mean­ing­ful op­por­tu­ni­ty to be heard.

“Our clients sought the dis­clo­sure in or­der to sub­mit their full sub­stan­tive re­spons­es, as such ma­te­r­i­al would have giv­en our clients the prop­er con­text of the re­spec­tive po­ten­tial crit­i­cisms high­light­ed in the re­spec­tive let­ters. Thus, our clients’ rep­re­sen­ta­tions are in­com­plete. It is trite law that where al­le­ga­tions/crit­i­cisms are to be made against any in­di­vid­ual, that in­di­vid­ual should be sup­plied with suf­fi­cient par­tic­u­lars to en­able a full, prop­er and in­tel­li­gi­ble re­sponse,” the let­ter stat­ed.

“Ul­ti­mate­ly, there can be no fair pre­sen­ta­tion of Kudel­s­ki’s find­ings in the re­port, as Kudel­s­ki has in­ac­cu­rate­ly sum­marised rep­re­sen­ta­tions re­ceived from pur­port­ed in­ter­est­ed par­ties, which can have the fa­tal ef­fect of mis­lead­ing all read­ers of the said re­port, over­look­ing rel­e­vant con­sid­er­a­tions which was im­prop­er­ly omit­ted from the re­port.”

The fall­out

Four of TSTT’s top ex­ec­u­tives have de­part­ed the or­gan­i­sa­tion fol­low­ing the cy­ber breach. Agard sub­se­quent­ly apol­o­gised to the com­pa­ny’s cus­tomers whose da­ta was stolen and ex­pressed re­gret for the way the com­pa­ny han­dled its com­mu­ni­ca­tion fol­low­ing the ­cy­ber­at­tack at an in­vestor brief­ing on No­vem­ber 10.

“In our haste to ad­dress the cy­ber prob­lem, there were some things that we could have done bet­ter. We were so busi­ly fo­cused on iden­ti­fy­ing the prob­lem, con­tain­ing it, and restor­ing full ca­pa­bil­i­ty to serve our cus­tomers that we ne­glect­ed per­haps to com­mu­ni­cate ef­fec­tive­ly with them,” she said.

“The in­for­ma­tion cur­rent­ly in the pub­lic do­main is large­ly per­son­al iden­ti­fi­able in­for­ma­tion, which ex­perts have ad­vised us does not pose an el­e­vat­ed risk of fraud­u­lent ac­tiv­i­ty to cus­tomers. We have, of course, ad­vised our cus­tomers to be ex­treme­ly vig­i­lant and on the alert for any sus­pi­cious ac­tiv­i­ty,” she added. How­ev­er, the TSTT board fired her three days lat­er and ap­point­ed Kent West­ern, TSTT’s gen­er­al man­ag­er, cus­tomer ex­pe­ri­ence, as act­ing chief ex­ec­u­tive.

Ram­nar­ine was fired two months lat­er.

“TSTT made a de­ci­sion to ter­mi­nate my em­ploy­ment for no rea­son. It’s a clause that I specif­i­cal­ly re­quest­ed to be put in­to my con­tract and that is to en­sure that in the case of hos­til­i­ty or an­i­mos­i­ty or any oth­er types of is­sues that may arise that we can both part ways am­i­ca­bly,” Ram­nar­ine had told a Joint Se­lect Com­mit­tee on Feb­ru­ary 19.

When asked whether his de­par­ture was linked to the mal­ware in­cur­sion, he an­swered, “I would say that there was a great deal of dis­in­for­ma­tion put out there about my not ap­prov­ing spend­ing which has been re­fut­ed, which has been rub­bised. It has been pub­li­cised prop­er­ly de­spite the at­tempts of the net­work and IT team and oth­ers for that dis­in­for­ma­tion to cloud the in­com­pe­tence that was at play. “So I  would say, at this point, in hind­sight, I would say that played a sig­nif­i­cant role but be­cause it’s a ter­mi­na­tion for no rea­son and they af­fect­ed that clause I can­not say specif­i­cal­ly what that would be. I would say that in the past year and a half, and I would ven­ture out there, there has been sig­nif­i­cant amount of hos­til­i­ty and an­i­mos­i­ty di­rect­ed to­ward my­self.”

TSTT’s Se­nior Man­ag­er-Cor­po­rate, En­vi­ron­men­tal, So­cial, Rep­u­ta­tion Man­age­ment Khamal Georges al­so sub­se­quent­ly re­signed.

A few weeks ago, TSTT’s chair­man Sean Roach al­so de­part­ed the board.

About the cy­ber breach

The cy­ber breach at TSTT oc­curred on Oc­to­ber 9 at 4:18 pm but was on­ly made pub­lic on Oc­to­ber 27, af­ter Fal­con Feeds, an In­dia-based tech­nol­o­gy se­cu­ri­ty com­pa­ny, re­port­ed on its X so­cial me­dia ac­count that ran­somware group Ran­somExx, added TSTT (http://tstt.co.tt) to its vic­tim list. It claimed to have ac­cess to 6GB of or­gan­i­sa­tion da­ta.

On Oc­to­ber 28, TSTT said in a state­ment that there was no com­pro­mise of cus­tomer da­ta but added that it had not cor­rob­o­rat­ed in­for­ma­tion in the pub­lic do­main pur­port­ed to be cus­tomer in­for­ma­tion. How­ev­er, af­ter cy­ber­se­cu­ri­ty ex­perts went dig­ging in­to the da­ta and made their dis­cov­er­ies pub­lic, the com­pa­ny is­sued an­oth­er state­ment.

On No­vem­ber 3, TSTT ad­mit­ted that 6GB, or less than one per cent of the petabytes of the com­pa­ny’s da­ta, was ac­cessed but that the ma­jor­i­ty of its cus­tomers’ da­ta was not ac­quired and no pass­words were com­pro­mised. Guardian Me­dia had ex­clu­sive­ly re­port­ed that the names of the coun­try’s top of­fi­cials, Prime Min­is­ter Dr Kei­th Row­ley, Pres­i­dent Chris­tine Kan­ga­loo, Chief Jus­tice Ivor Archie, Fi­nance Min­is­ter Colm Im­bert, Na­tion­al Se­cu­ri­ty Min­is­ter Fitzger­ald Hinds, Po­lice Com­mis­sion­er Er­la Hare­wood-Christo­pher, and Pub­lic Util­i­ties Min­is­ter Mar­vin Gon­za­les, were all in­clud­ed in a list of peo­ple found in doc­u­ments down­loaded from the dark web from TSTT’s da­ta breach.

And de­spite de­nial by TSTT, Guardian Me­dia ob­tained scans with cred­it card in­for­ma­tion, as well as bank ac­count num­bers, in­clud­ed in the 6GB da­ta bun­dle. Al­so in­clud­ed among the scans were bank­ing in­for­ma­tion for cus­tomers, com­pa­nies, state en­ter­pris­es, and min­istries, as well as cred­it card num­bers in trans­ac­tion re­ceipts. There were al­so for­eign ID cards and doc­u­ments in the dump. The list con­tained 1.2 mil­lion en­tries.