Chapter 6

Security of Parliament House

Introduction

6.1        The security arrangements at Parliament House have been an issue of significant interest to parliamentarians and have been examined a number of times during the committee's estimates hearings. Concerns have been raised about the effectiveness and management of security, notably the serious breach which occurred during a media conference being held by the Prime Minister in August 2012.

6.2        The following discussion canvasses changes to security arrangements at Parliament House, and issues canvassed at estimates and in evidence received during the inquiry.

Security arrangements at Parliament House

6.3        The Presiding Officers are jointly responsible for the security of the parliamentary precincts as a whole under the Parliamentary Precincts Act 1988. In relation to the Ministerial Wing, the Presiding Officers' powers and functions are subject to any limitations and conditions agreed between the Presiding Officers and the relevant Minister.[1]

6.4        The external security at Parliament House is provided by the Australia Federal Police Protection section (AFP-UP). The AFP-UP provide a constant presence of mobile and static patrols as well as security for the Prime Minister's Suite and the Cabinet Suite.

6.5        The Parliamentary Security Service (PSS) provide internal security through access control and security screening at entrance points as well as a mobile and static presence throughout the building including the chambers and the public galleries. Internal and external security is supported by closed-circuit television (CCTV) and a variety of electronic systems. The PSS also provide security for functions, official visits and other significant activities.[2]

6.6        Until 2003–04, responsibility for the security function was divided between the Senate and the House of Representatives with funding for security also shared equally between the two chamber departments. Under this arrangement, the Security Controller was responsible for the overall coordination of security arrangements within the precincts in consultation with the Usher of the Black Rod and the Serjeant-at-Arms. From 1992, the Security Controller was a senior AFP officer.

6.7        Following a security review undertaken in 2000–01, the Presiding Officers agreed to the establishment of a Security Management Board (SMB). The membership consisted of the Secretary of the Joint House Department, Usher of the Black Rod, the Serjeant-at-Arms and the Parliamentary Security Controller with a representative of the Special Minister of State for Ministerial Wing issues. The SMB's responsibilities included provision of advice on security matters; development of a five-year strategic plan to address parliamentary security issues; and, development of an annual action plan from the strategic plan and work cooperatively to achieve the plan.[3]

6.8        As part of the review by the Parliamentary Service Commissioner of aspects of the administration of the Parliament (Podger Review), the security function was considered. The Podger Review found the security governance arrangements 'complex and confounded'. It was noted that until the establishment of the SMB, the Presiding Officers had no dedicated source within Parliament House of strategic policy and planning advice on security issues. In addition, it was reported that there was no long-term strategic security plan and little capacity to address strategic security issues. Management of the security function was found to be fragmented and responsibilities and accountabilities 'dispersed and diffused'. It was noted that the SMB had no decision-making authority, no budget-management role, no secretariat support and no dedicated management resource to advise on strategic and planning issues.[4]

6.9        As part of the Podger Review, a high-level protective risk assessment of the operational security arrangements for the parliamentary precincts was commissioned. Following consideration of options put forward as a result of the assessment, the Podger Review recommended that a centralised security organisation be created in the amalgamated parliamentary services department.[5]

6.10      On 4 August 2003, the security function was transferred to the Joint House Department. Following implementation of the Podger Review, the security function was transferred to the Department of Parliamentary Services on 1 February 2004. In 2005, the Parliamentary Service Act 1999 was amended to provide for the continuation of the SMB. The function of the SMB is to provide advice, as required, to the Presiding Officers on security policy, and the management of security measures for Parliament House. Membership of the SMB is now established as the Secretary of DPS, an employee of the Senate (the Usher of the Black Rod), an employee of the House of Representatives (the Serjeant-at-Arms), and an employee of the Parliamentary Budget Office. In addition, the SMB may invite representatives of organisations involved in the development of security policy and provision of security services to attend meetings.

6.11      In 2005, the Australian National Audit Office (ANAO) reviewed the implementation of the resolutions arising from the Podger Review. The ANAO observed an improvement in the management and coordination of security services following the establishment of the SMB as a permanent body and the centralisation of the security function within DPS. The ANAO also noted that the SMB has an overarching management role in the formulation of policies and procedures and in the monitoring of key aspects of service provision. In addition, the SMB has sought expert advice to assist the formulation of changes or enhancements to security arrangements and security experts could attend SMB meetings.[6]

6.12      The ANAO commented on the provision of a security strategic plan for Parliament House. It was noted that while the Podger Review suggested the development of a plan, this was not part of the parliamentary resolutions at the time of the establishment of DPS and the SMB had not undertaken this task. The ANAO stated that it considered the 'development of a strategic plan to be an important step that would assist DPS in effectively managing Parliament House security'.[7] The Parliament House Security Strategic Plan 2009–14 was approved during 2008–09 and a Security Action Plan was developed. The Action Plan outlines priorities for future security infrastructure investments.[8]

Security budget

6.13      The DPS annual report provides staff costs for the PSS and AFP-UP as well as direct costs of Pass Office operations. The following table provides the security sub-program costs for 2005–06 to 2011–12.

Table 6.1: Security services subprogram 2.1 – 2005–06 to 2011–12

Service	2005–06	2006–07	2007–08	2008–09	2009–10	2010–11	2011–12
PSS	$8.37m	$10.44m	$10.59m	$11.70m	$11.661m	$12.060m	$13.232m
AFP-UP	$9.98m	$10.07m	$10.48m	$10.48m	$10.213m	$10.303m	$10.298m
Additional guarding PSS*	NA	NA	$365,903	$350,359	$417,574	$382,592	Now included with PSS
Additional costs for official visits	NA	NA	NA	$31,404	$4,349	$0	Now included with PSS & AFP
Pass office operations	NA	$221,994	$210,223	$165,910	$151,476	$149,330	$149,101
Costs of security sub program	$30.26m	$29.64m	$29.875m	$32.447m	$29.799m	$30.562m	$34.067m

*Addition PSS guarding for non-parliamentary and parliamentary functions

Source: DPS Annual Reports, 2005–06 to 2011–12

6.14      Costs for security are affected by the number of days of sitting and, to a lesser extent, the number of functions held in Parliament House. In addition, DPS noted that it pays for AFP-UP services but has little or no control over those costs. For example, at the May 2009 Budget Estimates DPS stated that the AFP had advised DPS that the cost of providing protection at Parliament House would increase by 15.8 per cent, approximately $1.6 million.[9]

6.15      Significant expenditure on security infrastructure has been undertaken. For example, in 2005–06 the security enhancement of the perimeter was completed. The cost of the project was $11.5 million and included construction of security barriers, the installation of bollards, seismic detectors and blast mitigation measures for Ministerial Wing windows facing the Ministerial Wing car park. In 2010–11, additional funding of $18.3 million with a further $3 million provided over four years was received by DPS for related security expenses.[10] In the 2011–12 Budget, in recognition of costs of additional staffing, Hansard, broadcasting and security costs arising from additional scheduled sitting hours in the House of Representatives and the Main Committee over the life of the 43^rd Parliament, $0.7 million was provided over two year.[11]

Security reviews

6.16      Security arrangements at Parliament House are reviewed on a regular basis with a physical security review being undertaken in one year and an IT security review in the next.[12] The following provides an overview of some recent security reviews:

• 2003: risk review and analysis of external precincts conducted by ASIO;[13]
• 2005: Protective Security Coordination Centre review;
• 2006–07: review initiated by the Presiding Officers of all elements of building security as the first stage of developing a five-year security strategic plan;
• October 2007: Signet Group International reported on Stage 1 of a comprehensive review of security arrangements in the Parliamentary precincts (other than information technology). Recommendations included the improvement of X-ray machines and coverage of CCTV;[14]
• August 2008: internal Security Continuous Improvement Review of all aspects of security and recommended a further review to assess the PSS structure and roster;[15]
• 2008–09: internal structural and roster review;[16]
• 2009: a physical security risk review conducted by the Attorney-General's Department identified a number of vulnerabilities on the building and recommended security enhancements including the reorganisation of parking arrangements in the public car park, and enhanced security for the private car parks;[17] and
• 2010–11: security risk review of information security arrangements in Parliament House.[18]

Issues raised in relation to security

Enhancement of security in the parliamentary precinct

6.17      Over the years, a range of security enhancement work has been undertaken at Parliament House. Major projects have included:

• 2005: construction of a wall around the inside of Parliament Drive and the installation of bollards  to prevent unauthorised vehicle access, in particular to the grassed ramps and the slip roads to the Senate, House of Representatives and Ministerial Wing entrances;[19]
• 2009–10: the analogue CCTV Camera Management System was largely replaced with a digital system;[20] and
• 2011–11: additional funding received to improve security at Parliament House including changes made to the public car park.

6.18      The following discussion canvasses issues raised in relation to the security projects.

Perimeter enhancements

6.19      In late 2001, following increased concerns regarding security, temporary vehicle barriers were placed around the building to prevent access to the grass ramps and roof. In 2004, security upgrades to the perimeter of Parliament House were proposed. This included the replacement of the temporary barriers with a low wall around the inside of Parliament Drive, speed humps and the installation of fixed and retractable bollards to control vehicle access to the building. The total cost of the work was estimated at $11.5 million and funding was provided in the 2004–05 Budget.[21] As the work was external to the building, the approval by the Parliament was necessary.[22]

6.20      The installation of the bollards included both fixed and retractable bollards with retractable bollards being installed on the slip roads to the Senate, House of Representatives and Ministerial Wing entrances. At the February 2004 Additional Estimates, DPS indicated it proposed to engage the building architects to undertake the design work and that it hoped that the bollards would be installed by 31 March 2005.[23]

6.21      The original specification called for the use of electromechanical bollards in some areas. DPS indicated that no Australian manufacturer could supply bollards to meet the security specifications required. In total, 182 bollards, including pneumatic bollards, were imported from the United States.[24] The cost of design, supply and installation the bollards was $2.247 million.[25]

6.22      The installation of the bollards was completed during 2005 but the retractable bollards did not become operational until early January 2006.[26] During this period, discussions were held as to the operation of the retractable bollards including whether they would remain retracted at peak times to assist access to the building and the times that they would not be operational. It was agreed that the bollards would operate at certain periods of the day including longer during a sitting day. On advice from the Protective Security Coordination Centre, it was agreed that any holder of a photographic pass would be able to operate the bollards rather than restricting access to the slip roads to parliamentarians and Commonwealth cars.[27]

6.23      This matter was canvassed during estimates and concerns were raised about the efficacy of installing bollards and then allowing any pass holders (over 7,000 at that time) to activate them and access the entrances of Parliament House. DPS commented it was looking at this issue and stated:

The issues that we have begun to wrestle with include the fact that there has been a history of all those passes being able to use all the ramps and there has been a set of expectations there from those 7½ thousand people. And there are some pieces of gear that would actually be very hard to bring into the building except by driving right up to the entries on the Senate and Reps sides.[28]

6.24      From February 2009, access to the slip roads was restricted to pass holders 'who have demonstrated a genuine business need to do so'.[29] This reduced the number of pass holders who have access to one or more of the three slip roads to about 1,750.[30]

6.25      During the six month period in 2005, during which consideration of their operation was undertaken, the retractable bollards were locked into the ground. When agreement was reached on the operation of the bollards, problems arose with their operation and a number of mechanical failures occurred.[31] This continued into 2006 and 2007, albeit at a decreasing level.[32] In addition, a number of incidents occurred due to driver error.[33] Work was carried out on the bollards at the end of 2006 when they were recommissioned and DPS entered into a maintenance contract with the installers.[34] In 2008, additional stop and go lights were installed.[35]

Parliament Drive

6.26      With Parliament House staff being dropped off or picked up on Parliament Drive rather than using the slip roads, concerns were expressed about safety.[36] As a result of the problems with traffic and safety concerns, Parliament Drive was converted to one-way in August 2006. The initial work to convert to one-way traffic was undertaken at a cost of $100,000.[37] As part of this work, temporary bollards were installed to ensure traffic moved in the correct direction around Parliament Drive. DPS noted that the impact of traffic entering and exiting the car parks on the through-traffic had improved.

6.27      A post-operative review and a traffic management report were commissioned at a cost of $50,000.[38] In 2009–10, additional work was carried out on Parliament Drive as a result of the change to one-way traffic, and the recommendation of external traffic engineers to avoid accidents about the building and to make the pedestrian crossings compliant to current standards. At the same time, speed humps at the corners of Parliament Drive which were installed in 2006 at a cost of $132,000[39] were removed and work was undertaken on the road pavement which was due for renewal or replacement. The cost of this work was $1.9 million including $600,000 for the road pavement.[40] The work received parliamentary approval in August 2009.

6.28      In response to questioning about the necessity of this work and the low number of accidents on Parliament Drive, Mr David Kenny, then Deputy Secretary, DPS commented:

I will just say again that the advice from the traffic engineers, the consultants, was quite comprehensive. It identified a number of what they considered to be serious defects with the set-up, including that, as you will recall, we had had the temporary orange bollards in place from the time the one-way road was put in place. This work is making permanent changes that those orange bollards had been attempting to enforce in terms of traffic movements.[41]

6.29      At the October 2011 Supplementary Estimates, the committee examined further security work for the Ministerial Wing car park which included bollards and high-security gates at a cost of $940,000.[42] Following completion of the work, traffic congestion at the Ministerial Wing resulted in vehicles queuing across the pedestrian crossing on Parliament Drive creating a significant hazard. DPS reported that a PSS officer had been assigned to the car park entrance in the mornings to assist with vehicular access. A traffic engineer had been engaged to look at a new traffic plan and Mr Alan Thompson, then Secretary, DPS, stated:

We have a dilemma. On the one hand we are trying to secure the safety of the car park, the occupants and the occupants in the ministerial wing, and we are still trying to fine-tune the way those bollards and the first gate work. We have commissioned a small piece of work to look at whether we can realign a little bit of the road to create a lane into which cars going into that car park can pass without impeding cars wanting to proceed further along Parliament Drive.[43]

6.30      The committee was informed that DPS had also examined the timing of the gates and bollards but noted that:

Part of the problem is that it is a hydraulic system which drives the gates and the locking pin, and that takes some little time to engage. We are trying to speed up as best we can. It is about striking that balance between and security and safety, and we are doing our utmost to get that right.[44]

6.31      DPS indicated that the change to the hydraulic system would cost about $20,000.[45] The committee questioned the need for the additional cost to a project of approximately $1 million, given the volume of traffic using the car park and the predictability of the congestion.

Public car park

6.32      Work has been undertaken in the public underground car park to the parking arrangements and to upgrade security with the construction of a security wall.[46] This work resulted in changes to the number of car, taxi and coach parking spaces with DPS indicating in May 2010 that there were an additional two taxi spaces, four small coach spaces and more than 20 car spaces in different zones. Large coach parking spaces were decreased by two.[47] The construction of the security wall in the car park was undertaken in 2011–12.[48]

6.33      The total cost of the changes to the underground public car park was $9.12 million. The cost of the wall and work changes directly associated with the wall was $7.7 million and the cost of the work on bus parking and entry-exit gates was $1.4 million. The construction of the wall resulted in a small reduction in car parking spaces.[49]

6.34      Submitters commented that the effect of these changes was to decrease accessibility to Parliament House. MS Australia, for example, stated that the work had compromised access for people with mobility issues getting from their taxi to the lift entrance and also getting a taxi on exit from the building. MS Australia noted that some corrective action had been taken 'however for people using wheelchairs the access around the concrete barriers is difficult still'. The position of the taxi rank on a relatively steep slope caused difficulties for wheelchair users and the lack of a pram crossing at the taxi pick up spot to allow a person in a chair or other mobility aid to exit the roadway was also raised. MS Australia recommended the relocation of the taxi zone and 'consultation with users of wheelchairs as well as access consultants to look at the best location for this important zone and also address the security concerns that have made the use of concrete barriers important in the first place'.[50]

6.35      The Disability Discrimination Commissioner, Mr Graeme Innes, also raised concerns about the car park directly with DPS. The Commissioner noted that there was a 'chicane of barriers which were there for security purposes' which impeded entry to the building for people with a disability. DPS commented at the May 2011 Budget Estimates that the car park had been reconfigured in 2010 and that:

We took a lot of care to make sure that we still had taxi ranks in accessible locations and so on. One issue that we had not dealt with well enough at that stage was people with sight impairment making their way from the taxi rank through to the physical entry to the building. Mr Innes alerted us to that, and we have now put down tactile strips from where people would alight from a taxi all the way through to security point 1 in the basement. That has been in place for some weeks now.[51]

6.36      Ms Mills also commented on access problems in the car park at the committee's October hearing and stated that:

I believe there are more actions required in the car park now to ensure that there has not been unnecessary disruption to access or the prominence of entry into the building as a result of the building of the wall, and particularly around disability access, which is something I am very determined that we improve upon. We are doing some work to map out a program of work that might improve the amenity for people arriving at the building coming through the public car park area.[52]

6.37      As a first step, DPS will modify the humps across the pedestrian walkway as these are not compliant as they are too high. Further work will then be required to improve the route, pedestrian safety, signage, and possibly lighting. A second access for a lift may also be required in the future.[53]

Gates on underground car parks

6.38      Following the 2009 security risk review which identified a number of vulnerabilities on the building, crash rated security gates were installed on the private car parks for the Senate, House of Representatives and the Ministerial Wing. These gates replaced the boom gate and roller door used after hours. The Ministerial Wing gates were installed at a cost of $1.1 million and the other gates at a cost of $1.72 million with a total cost of $2.82 million.[54]

6.39      DPS noted that it was trying to 'strike that balance between making sure we get people into the building quickly and not cause a traffic jam along Parliament Drive, and also provide the building with a level of security which can be adjusted depending on the threat'.[55]

CCTV system

6.40      On 18 June 2010, a new digital security camera system went into use.[56] DPS stated that the replacement was undertaken as the old MaxPro system lacked adequate support system, the storage capacity was limited including being unable to keep recorded footage for more than 72 hours and additional cameras required to address identified blind spots could not be added.[57] The system was installed by British Aerospace (BAE). The total cost of the project was $7.1 million, with the contract for BAE valued at about $4.5 million.[58]

6.41      DPS indicated that it was 'largely' very happy with the operation of the new system, but acknowledged that there had been some problems including that high-definition cameras dropped out.[59] It was also revealed that the MaxPro system had utilised a separate network, unlike the BAE CCTV system which operated through the Parliamentary Computer Network (PCN).

6.42      DPS informed the committee that there were technical reasons why the new security cameras were not on the separate system. DPS went on to indicate that the network was being upgraded with the intention of moving the new camera system back onto the separate network. Until that occurred, DPS agreed that having the cameras on the PCN left the system more open to attack including by hackers, viruses and failures if the PCN servers crashed.[60] Indeed, BAE had indicated that there had been failures due to 'external influences'. In response to questioning by the committee, Ms Bronwyn Graham, DPS, agreed that this was the case.[61] Mr Kenny commented:

Under the MaxPro system you were still vulnerable to a server crash but, because it was on a different network, it was less vulnerable to hacking. But, as I said a minute or so ago, we were not able for technical reasons to place the new system on the old network. We are upgrading the old network and then we will move it.[62]

6.43      Other interruptions to CCTV operations occurred when the CCTV operator's workstation crashed and as a result of intermittent power failures. Ms Graham indicated that if a workstation crashed, a reboot would be required. This would take 'a couple of minutes' to occur.[63]

6.44      In relation to power failures, DPS reported that as an unintended consequence of an electrical infrastructure upgrade on the weekend of 27–28 August 2011, there were intermittent power failures resulting in approximately 50 per cent of the CCTV camera servers not being available during times on those days. The interruptions were caused by the failure of a temporary power supply device. The outage also affected the user interface for the radio and telephone system in use within the security control room. However, the two-way radio handsets in use throughout the building and the Parliament House telephone system remained fully operational.[64]

6.45      DPS indicated at the February 2012 Additional Estimates that the computer network development work being undertaken was 'in its final stages'. Once this occurred, 'we will isolate–let's call it, the security network and the building management network–from other components of the network'.[65] It was noted that the decision to isolate the camera network was made by the SMB in April 2011. The SMB had considered the recommendations of the Information Security Risk Review (completed in February 2011) which had included a vulnerability assessment conducted by the Information Security Division of the Defence Signals Directorate. This report recommended that 'from a security perspective, the Building Management System [BMS] should remain separate and not be connected to the PCN in future'.[66] The BMS not only operated the CCTV system but also electronic access, and monitors and operates various systems in the building including the air conditioning.

6.46      A report in The Canberra Times stated that the security report on the new CCTV system had commented that:

...in the event of an attack on Parliament, the security flaws could help the attackers take control of critical assets in the building. "Control of these assets would allow an attacker to locate a person in the building"...

Attackers could then "seal or unseal doors to facilitate an attack, remove lighting and power from the area, continue to survey the person throughout the incident while removing [security staff's] ability to respond or even be aware an incident is occurring"...

The report also revealed that the new BAE workstations associated with the security camera system had a particular flaw that allowed security guards to access the public internet without requiring a long-on – something hackers are known to exploit to access classified system. Security staff had been consistently reporting faults with the system but their concern had been all but ignored by senior department staff, the report stated.[67]

6.47      The isolation of the system was achieved by the installation of new technology boxes as part of the ICT network replacement program which will be completed by the end of 2012.[68] DPS indicated that it would then be possible to move the CCTV system to a dedicated virtual network and this was expected to occur in the first quarter of 2013.[69] In response to concerns that there appeared to be a lack of understanding in DPS of the importance of having the new CCTV system on a separate network, and therefore operational when a server fails, Mr Kenny stated:

The security that we are providing is multiple layer, of which the CCTV cameras are just one part. When the building is operational—that is, when parliament is sitting—then the security is provided by the AFP outside and...PSS officers inside, including staff in the operations room who are monitoring the security cameras. If a server crashes then it is rebooted. Yes, I acknowledge that for the duration that that server is down, the cameras it is servicing are basically unavailable.[70]

6.48      DPS also stated that the estimated cost to make the CCTV camera management system a stand-alone system, that is, a physically separate system, would be in the order of $3 million.[71]

6.49      It was noted by DPS that in the event of a server crash and loss of CCTV capability contingency plans include the use of Australian Federal Police (AFP), PSS officers and security systems such as sensors, alarms and secure radio networks.[72]

6.50      Following the May 2012 Budget Estimates, DPS provided further information on the security assessments of the new CCTV system. The committee was informed that security aspects of the BAE system were assessed as part of the tender assessment process. These included its ability to control and restrict viewing of selected cameras to selected operators, and how the system managed user accounts and privileges.[73] DPS also clarified that the risk assessment for the new network was conducted by an external IT security contractor and reviewed by the Defence Signals Directorate.[74]

Photographic passes

6.51      In addition to parliamentarians, parliamentarians' staff and staff of the parliamentary departments, photographic security passes are issued to a range of other people entering Parliament House. These people include contractors, lobbyists, Commonwealth officers, media, ministerial staff and nominated family of parliamentarians. All passes have an automatic expiry date; the maximum life of a pass depends on passholder category.

6.52      The number of passes issued as grown significantly over the last few years. In 2008 there were some 8,254 photographic passes on issue.[75] As at January 2011, the number had increased to 8,989 and in October 2011 there were 9,451 photographic passes on issue.[76] There were 10,245 active passes on issue as at 5 November 2012.[77] The committee notes that between October 2008 and January 2011 (28 months) passes on issue increased by 735; over the next nine months passes on issue increased by 462 and in just over the year between October 2011 and November 2012 the increase was 754 passes (an 8 per cent increase in 12 months).

PSS staffing and rosters

6.53      Over the years, a number of key issues have been raised in relation to the PSS and include the adequacy of security clearance,[78] appropriateness of training,[79] PSS rostering and numbers of PSS staff.

6.54      During 2007–08, two internal reviews of DPS security were undertaken: the Security Continuous Improvement Review; and a structural and roster review. The Security Continuous Improvement Review was undertaken in 2007 internally by DPS staff attending workshops and meetings. It was finalised in August 2008 and included a recommendation which summarised opportunities to improve the security roster. Both reviews resulted in a decrease in the number of security staff.[80]

6.55      The structural and roster review was described as having the aim to 'provide the same level of security service to the building but to bring our staff numbers back to broadly the level of that we had in 2005–06'. This would involve the loss of 25 operational, roster and pass office positions. While acknowledging the change in the security environment, Mr Thompson noted that there were budget considerations in making cuts and stated that 'we are certainly not wishing to diminish the level of security that we provide but we do believe we have got to manage within budget'.[81] Mr Thompson argued that the PSS could be operated more effectively with a staffing level similar to that of 2005–06 and that the security of the building would not be compromised.[82]

6.56      In response to concerns that the staff cuts were based only on budgetary issues, Mr Kenny stated:

The change that is being talked about, the 25, came about as a result of an internal review that commenced last year as to the best way we could deliver security at existing levels. That work intensively involved consultation with the PSS staff, who know how the system works, and also PSS management. As a result of that, they have come up with a modified way of working which uses less people...As I said, that process commenced last year and is consistent with the various advices we have had over the time from the intelligence agencies and from the Signet people.[83]

6.57      Four of five Parliamentary Security Operations Room (PSOR) supervisor positions were abolished as a result of the PSOR review. The remaining PSOR supervisor position was retitled PSOR Team Leader and the number of operator positions was increased from nine to 11. As a result of the Pass Office review, one position was abolished and one position was converted to part-time.[84]

6.58      DPS also indicated that a review was concluded in January 2009 aimed at simplifying the management and supervisory structures within the security and facilities sections, reducing operating costs and strengthening management capability. The new structure delivered approximately $800,000 in savings.[85]

6.59      In May 2009, a further review of the PSOR was completed. The purpose of this review was to identify opportunities to create a more efficient business unit through structural changes, roster integration with the wider PSS and reduction of operating costs.[86] In September 2009, the operation of the Pass Office was reviewed.

6.60      DPS concluded that:

In 2008–09, reforms to the Parliamentary Security Service (PSS) were recommended following extensive consultation with PSS staff...The key driver for these reforms was the requirement to reduce operating costs, and has resulted in a change in the balance of staffing between ongoing full-time staff and sessional staff.[87]

6.61      The security and facilities review was implemented at the same time as the changes arising from the security roster review, changed security 'call out' procedures, and transfer of some Ministerial Wing functions from the AFP-UP to the PSS.[88]

6.62      The committee was provided with the full-time equivalent (FTE) number of security staff from 2005 to 2012. These figures include part-time, casual and full-time staff both uniformed and non-uniformed as follows:

Table 6.2: PSS full-time equivalent staff numbers

Year	FTE
March 2005*	162.08
March 2006*	133.20
March 2007*	156.84
March 2008*	154.98
March 2009*	156.53
2009–10#	140.8
2010–11#	139.4
2011–12#	148.8

Source: *Budget Estimates May 2009, Answer to question on notice P4; #Department of Parliamentary Services, Answer to question on notice No. 7 dated 18 October 2012.

6.63      The average number of uniformed security staff in 2011–12 was 132.7 FTE.[89]

6.64      The DPS annual report also provides the number of hours of internal guarding. It was noted that the number of hours of internal guarding varies depending on the number of parliamentary sitting days and, to a lesser extent, the number of functions held in Parliament House.

Table 6.3: Number of hours of internal guarding, 2005–06 to 2011–12

Year	Number of hours of internal guarding (PSS) – Monthly average
2005–06	18,586
2006–07	20,527
2007–08	25,212
2008–09	25,164
2009–10	21,636
2010–11	21,917
2011–12	23,732

Source: DPS Annual Reports 2005–06 to 2011–12

6.65      At the February 2010 Additional Estimates, the concerns of some PSS officers about shifts not being covered when staff were on sick leave, increased workloads and the risk posed by reduced security numbers were canvassed. DPS indicated that there were 18 fewer uniformed security officers. However, DPS argued that the new roster, introduced as a result of the roster review, aimed to ensure that the correct number of PSS were provided in different areas of the building to match need. Ms Graham stated:

The new roster that was developed as part of the review conducted last year has a spare capacity already built into it. For example, on a night shift we have two additional staff available that are not pre-programmed into a specific point. We use those resources to deal with planned absences and unplanned absences. In the course of the year a staff member would take leave. Invariably, some of that leave would be on a night shift and we would use some of the capacity that is already built in to reallocate and fill that vacancy. We hold over some of those vacancies for unplanned absences on any given day. That is our first port of call for an unplanned absence.[90]

6.66      The roster review also considered the staffing of the security control room and recommended that a further review of the staff and the duties performed in the control room.[91] The review was undertaken by Mr Bob Konig, a non-ongoing DPS employee at the PEL2 level. During the May 2010 Budget Estimates hearing, the committee noted that Mr Konig was the husband of the DPS Chief Financial Officer (CFO). DPS indicated that Mr Konig, while having a background in undertaking reviews, did not have any specific security experience. Ms Graham noted:

The structural review did not look at the elements of security risk and how we manage those risks. The structural review and the roster review looked specifically at how we organised our resources to deliver services. The separate review on our security risks has been done more recently under the guise of the Attorney-General's report.[92]

6.67      As a result of changes to the roster, concerns were raised about the ability of the PSS to undertake the full range of duties including escorting emergency services officers after hours and when multiple emergency services are required in the building. DPS responded that the ability of the PSS to respond to emergency services had been part of the roster review. Ms Graham stated:

It is my understanding that the people involved in that review were comfortable with the ability for the security service to respond, to put a person at the door and to escort them through the building. Specifically, if there are now concerns from our staff about our ability to do that, they have not been brought to my attention and, as far as I am aware, they have not been brought to the attention of the relevant security managers.

Both our control room staff and our team leaders are given a number of forums in which to raise concerns about the security roster. In fact, we are in the process of trialling a suggestion from one of our staff members to improve the way the roster works. If I could reiterate the comments that I made at the last hearing in February. We do not acknowledge that the roster is perfect, but I think we have a very good track record of listening to staff where staff have raised concerns. And where concerns have merit, we have a number of examples where we have responded by putting in additional resources and/or different processes to streamline the way we can respond to different scenarios.[93]

Serious breaches of security

6.68      There have been a number of serious security breaches in Parliament House. These have included intruders jumping from the public gallery into the House of Representatives chamber, hacking of the computer system, and intruders in the private areas of Parliament House including at a media conference held by the Prime Minister.

6.69      There have been instances of non-authorised persons entering the private areas of Parliament House. In September 2011, a man was found with an incorrect security pass outside the House of Representatives chamber. It appeared that he had accessed the building at Point 1 in the building basement and had joined a group of visitors being signed in by a Parliament House staff member. The group received an 'escorted pass' which required them to remain with the staff member who had signed them in. Once inside the building, the person left the group and was eventually found by a PSS officer outside the House of Representatives chamber. Following the incident, the number of guests able to be signed in by a pass holder was limited to five.[94]

6.70      A far more serious breach occurred at a media conference on 23 August 2012. A member of the public was able to enter a restricted area of Parliament House and hand a document to the Prime Minister. The committee canvassed this incident at Supplementary Budget Estimates. The Secretary of DPS provided the committee with an outline of the incident indicating that the intruder had attended a public committee hearing and then, because a door was not manned by the PSS, had entered the private area of the building. He had then visited two offices including the Speaker of the House of Representatives. He then approached the Treasurer's office which notified the PSS. Ms Mills stated that the PSS attended the Treasurer's office, within two minutes of being called, however, he was no longer in the office. The intruder then entered the Prime Minister's media conference and handed her a document. Following this incident he was escorted from the building by the PSS.[95]

6.71      Ms Mills stated that the breach of security was not due to a 'systemic problem', rather it was 'human error' in the security system which occurred when the timing of a committee hearing was not verified with the relevant committee staff. As a consequence, an error was made in the rostering arrangements.[96] Ms Mills explained to the committee that following the incident a consultant had been employed to conduct a two part review with the first part to provide advice about any immediate changes that could be put in place to ensure that such an incident could not occur again. This report has been received and considered by the SMB. The second part of the review will look more broadly at any other issues or areas of improvement that could be introduced regarding the specific issue of unauthorised entry to the private areas of the building.[97] Ms Mills indicated that a strengthened approach to rostering had been implemented and the AFP now provide information to DPS about media conferences being held by the Prime Minister.[98]

6.72      Ms Mills summarised her position in relation to the incident as follows:

Again, all I can suggest is that the ability of the person to get in was unique. One of the findings of it was that it was unique breakdown in our system. It was not a pattern of failure. It was literally a one-off.[99]

6.73      Ms Mills also commented on the features of security in Parliament House noting the size of the building and the need to balance resourcing, risk and the private-public nature of the building.[100]

6.74      While the committee acknowledges that changes have been made to security arrangements following this incident, there are a number of disturbing aspects to the incident. First, the intruder was able to wander the private areas of Parliament House for some 40 minutes without a pass and was not challenged by any PSS officer.

6.75      Secondly, there was a significant lapse in time between the incident and the Secretary and the President's office being informed. Ms Mills stated that the PSS had received the call from the Treasurer's office at 12.30 pm. She was informed at 2.00 pm that a minor security incident at occurred. The President's office was informed just before 3.00 pm with the President being informed shortly after that when question time had finished.[101] Ms Mills accepted that there had been a delay in the information being passed to her from the former deputy secretary.

6.76      Thirdly, the intruder was known to the PSS as the previous week he had caused a minor disruption at a Senate committee hearing. While the PSS had not attended the hearing, the Usher of the Black Rod had requested additional security at the committee's subsequent hearing and a photo of the person was provided to the PSS attending that hearing. Ms Mills commented that:

There was no reason, at that stage, to believe that he provided a greater threat than perhaps a minor disruption at a specific committee hearing. The beauty of hindsight is, did we under-react or over-react? The advice that I have received is that the practices that were put in place regarding his attendance at the committee hearing and the raising of the issue through the Usher are fairly normal practice, and the standard procedures were followed.[102]

6.77      There was also concern raised in the hearing that the consultant engaged by Ms Mills lacked appropriate security expertise. Ms Mills explained that the consultant was an expert in safety and security in public areas. Ms Mills also noted that if the consultant's report 'really indicated there were security issues, as opposed to human factor failures, we would then bring in appropriate people to deal with them'.[103]

Reporting on security matters

6.78      The committee has made comments on the quality of DPS annual reports in chapter 9. In addition to those comments, the committee makes the following observations about reporting on security matters. Successive annual reports have provided little information to assist in assessing security matters at Parliament House. Indeed, the committee found it was difficult to identify accurately the various security reviews that have been undertaken including basic information such as date of completion. The committee found that wording in some sections has remained the same for a number of years with only numbers or percentages being updated.

6.79      The data included is sparse and not particularly helpful in analysing performance. For example, while the number of incidents is reported, there is no indication of the severity of the incident only whether or not correct procedure was followed and that reports were completed.[104] Likewise, no indication is given if procedures were reviewed as a consequence of an incident.

6.80      The performance indicators include 'validation of security of procedures' which have been measured at 100 per cent for the last three financial years. This figure is based on monthly validation exercises. The other measures are the number of incidents, both for the PSS and AFP-UP, and data on security services such as number of hours on guarding and number of scheduled emergency evacuation exercises completed. These indicators provide no real indication of performance and responsiveness of security services. For example, there is no indication of the success of the procedures in place, only the extent to which they have been followed. It could be argued that the procedures can be followed perfectly but that a major breach can occurred because the procedures were not adequate in the first place.

Committee comments

6.81      There have been many risk assessments and reviews of the security at Parliament House, including IT security. In addition, the Security Management Board provides advice to the Presiding Officers on security policy and management of security measures. However, the committee considers that the evidence demonstrates that many aspects of security in Parliament House have been poorly managed. The committee notes, for example, that there has been a concentration on very costly physical security measures at the perimeter of Parliament House, while decreasing numbers of PSS staff have been required to take on more areas of responsibility including patrolling the Ministerial Wing.

6.82      A further example of poor security planning and project management was the installation of the new CCTV which was undertaken at great expense, some $7 million. Rather than being on a separate network, it will operate through the Parliamentary Computer Network until next year. As a consequence, the CCTV system will be at risk of hacking and will be unserviceable if the PCN servers crash. The information provided by the DPS senior executive about this project at estimates was vague, less than frank and, in some instances, misleading. The committee considers that the management of the installation of the new CCTVs is yet more evidence of the ineffectiveness of the former DPS senior executive.

6.83      The committee also notes the increase in the number of photographic security passes on issue. While much public money has been expended on significant security projects undertaken to the exterior of the building, more and more people have been issued with passes which allow access to most areas of the building. The committee considers that the basis for the issuing of passes should be reviewed.

Navigation: Previous Page | Contents | Next Page