Our reference: FOI 22/23-0600
GPO Box 700 Canberra ACT 2601 1800 800 110
dis.gov.au
25 October 2022
Beverly
By email: foi+request-9422-fe8d3180@righttoknow.org.au
Dear Beverly
Freedom of Information request — Request consultation process
Thank you for your correspondence of 1 October 2022, in which you requested access under the Freedom of Information Act 1982 (FOI Act) to documents held by the National Disability Insurance Agency (NDIA).
Scope of your request You have requested access to the following documents:
As of today (1 Oct 22) how may APIs (application programming interfaces) are there at the NDIA/NDIS? Are they all ‘secure by design’? Have they all been cybersecurity tested and certified? Have they all be risk assessed and approved? Can I please have a copy of the report that confirms and sums all this up? Along with some information on the qualifications and experience of the individuals/vendors that conducted this recent, ongoing analysis.
Noting the NDIS/NDIA is not obligated, nor complies with the Australian Government’s Protective Security Policy Framework (PSPF), can you please provide details on which/what specific cybersecurity standards and government level security standard(s) are used at the NDIS?
This includes all APIs used for bridging between applications, payments processing, connecting to participants bank accounts and details, provider billing, government integration, internal systems, data estate query, payment/shopping, accommodation, GST, etc connections.
Practical refusal I am authorised to make decisions under section 23(1) of the FOI Act.
I am writing to advise that the work involved in processing your request in its current form would substantially and unreasonably divert the resources of the NDIA from its other operations due to its size and complexity. This is called a ‘practical refusal reason’ under section 24AA of the FOI Act.
On this basis, I intend to refuse your request. However, before I make a final decision, I am writing to provide you with an opportunity to revise your request. This is called a ‘request consultation process’ as set out under section 24AB of the FOI Act. You have 14 days to respond to this notice in one of the ways set out below.
Why I intend to refuse your request
Through consultation with the relevant line area, I have been advised that the Agency has hundreds of APIs, each with multiple documents, which are likely to be relevant to your request.
The line area has estimated that it would take analysts more than 4 weeks to sort through and collate any relevant documents. We would also need to consider whether we would need to create a document pursuant to section 17(1) of the FOI Act, to provide some of the information you are seeking. An FOI Officer will then need to review each document for any sensitivities and possible exemption under the FOI Act, schedule each document, consider if any third-party consultations are required and carry these out as needed, a decision will need to be made on each document, and a decision letter prepared.
As a result, I am of the view that the work involved in the processing of this request would substantially and unreasonably divert the resources of the NDIA from its other operations.
Request consultation process
You now have an opportunity to revise your request to enable it to proceed.
Revising your request can mean narrowing the scope of the request to make it more manageable or explaining in more detail the documents you wish to access. For example, by providing more specific information about exactly what documents you are interested in, the NDIA will be able to pinpoint the documents more quickly and avoid using excessive resources to process documents you are not interested in.
To reduce the scope of your request, you might like to consider seeking access to documents in relation to a specific API.
You have 14 days to contact me and do one of the following:
a. withdraw your request b. make a revised request c. indicate that you do not wish to revise the request.
During this period, you are welcome to seek assistance to revise your request. If you revise your request in a way that adequately addresses the practical refusal reason outlined above, we will recommence processing it.
Please note that the time taken to consult with you regarding the scope of your request is not taken into account for the purposes of the timeframe for processing your request.
You can contact me by email at foi@ndis.gov.au.
Alternatively, you can reply in writing to the following address:
Freedom of Information Section Parliamentary, Ministerial & FOI Branch Government Division National Disability Insurance Agency GPO Box 700 CANBERRA ACT 2601
If you do not contact me within this period, that is by 8 November 2022, your FOI request will be taken to have been withdrawn under subsection 24AB(7) and will not be dealt with any further.
Please do not hesitate to contact me if you have any questions.
Yours sincerely
Carolyn Assistant Director FOI Parliamentary, Ministerial & FOI Branch Government Division