Public Sector Performance Report 2008

This first Public Sector Performance Report for 2008 brings to notice legislative compliance and control issues.

Regulation of Security Workers

More than 15 000 people are currently employed as security workers in Western Australia. The public relies on personnel employed by private firms and Government agencies to secure their safety and the security of their property. Security functions range from the installation of security equipment in the family home to the protection of patrons in entertainment venues. Various incidents within the security industry in Western Australia over the last decade have highlighted the need to ensure appropriate regulation of security workers.

There is specific legislation that regulates security workers in different situations including homes and public venues, prisons, courts, public transport and the casino. Agencies responsible for controlling entry into the industry and providing oversight of security workers include the Western Australia Police (WAP), the Department of Corrective Services (DCS), the Department of the Attorney General (DotAG), the Public Transport Authority (PTA) and the Gaming and Wagering Commission (GWC).

In general, security workers must demonstrate that they are of good character and competent before being employed in the industry. They are then subject to ongoing monitoring to ensure continued compliance with legislative and agency requirements.

What the examination found...

The overall regulation of security workers by the five government agencies examined is adequate, with the PTA, DotAG and GWC often displaying good practice.

We found no indication that agencies have allowed people to enter the security industry who had not met required character and competency standards.

all agencies except WAP were obtaining the information required by legislation and internal policies to assess the suitability of applicants
agencies generally used the information to properly assess suitability of individual applicants though some opportunities for improvement were noted.

We found no evidence that agencies have allowed unsuitable people to continue working in the industry when they have failed to comply with relevant employment and licence conditions. Nevertheless, a number of improvements are needed to the way some agencies monitor compliance.

all agencies had some form of monitoring of security workers and were conducting investigations in response to incident reports, complaints and allegations of non-compliance. WAP however were not always following up incident reports and they could more proactively monitor compliance
not all agencies sought information about charges and convictions incurred by security workers while employed in the industry
there was limited testing for illegal drug use.

All agencies except WAP had adequate internal controls to ensure licensing decisions were consistent and appropriate.

Information Security: Disposal of Government Hard Drives

Every day, Western Australian public sector agencies process large amounts of information. This includes information relating to government, private businesses and the general public. A large portion of the information processed by public sector agencies is created and stored on computer hard drives.

Computers are upgraded regularly in government agencies, requiring data to be transferred from old to new computers. The old computers – including the hard drives – are then disposed of in a number of ways including sale at public auction, donation to schools and charities or physical destruction. Prior to disposal, it is important that any sensitive information is removed from the hard drives. Formatting hard drives or simply deleting files does not prevent data from being recovered. If not properly removed then recovering the data from hard drives is a relatively simple process.

Four out of 10 examined ex-government computers we purchased at auction contained recoverable data. From these computers we were able to recover confidential and sensitive data, including information about public sector employees, detailed technical information about agencies IT systems and documentation of their internal software development projects.
None of the seven sampled agencies had comprehensive policies or procedures for secure removal of data from computer equipment prior to disposal. While all agencies did have a process in place, it was either inadequate or was not applied consistently.
Government guidance on appropriate methods of removing data from computers prior to disposal is limited. This has contributed to some agencies using methods that do not provide adequate security while others, arguably, exceed reasonable requirements.