The Tribune

By NEIL HARTNELL

Tribune Business Editor

nhartnell@tribunemedia.net

Attorneys yesterday warned the latest Registrar General’s Department hack shows the government “cannot get away” with any IT system deficiencies, adding: “We’re an obvious target.”

Carey Leonard, the Callender’s & Co attorney, told Tribune Business that the government and its agencies must spare no expense in protecting themselves against intruders given that the consequences affected a far greater number of businesses and consumers.

He disclosed that the latest hack, and subsequent closure of the Registrar General’s online database, had been deeply “frustrating” as it had forced corporate Bahamas - and especially the financial services and real estate sectors - back to manual processes “just when we need to speed things up” as the economy emerges from its COVID-19 lockdown.

“It really goes to show the necessity of the government updating its IT infrastructure,” Mr Leonard said of the situation. “It’s important the government spends time, energy and effort on proper security. Everyone is going to get attacked, and especially ourselves and the likes of Cayman and Bermuda, because we have all these companies domiciled here. We’re an obvious target.

“What I do say is what lessons has the government learned from this, what are they going to do about it, and let us know how they plan to prevent it from happening again. We need to have a plan of action from the government that they will protect it going forward.

“It’s good that they’re trying to do everything electronically, but the government is going to have to make sure it protects all the data and that if functions efficiently,” the former Grand Bahama Port Authority (GBPA) in-house attorney added.

“If one business gets hit it’s that business. If the government gets hit, it’s everybody business. It’s a much bigger knock-in effect if something goes down. That’s the critical part of it. The private sector can get away with it, the government can’t. It must protect and function at all times.

“It’s rough on government, but that’s the fact. If one bank goes out only its customers are affected, but if the Registry goes out it affects all the country. It’s more important that the government gets it right than the private sector.”

Mr Leonard spoke out after Carl Bethel QC, the attorney general, confirmed exclusively to Tribune Business that the Government had again been forced to shutdown the Registrar General’s Department’s online portal and database after the Royal Bahamas Police Force (RBPF) detected two further attempted incursions that were linked to Internet Protocol (IP) addresses in Russia and Bulgaria.

These “probes” followed two previous hacks of the same agency, the first by the International Consortium of Investigative Journalists (ICIJ) in 2016, and the second earlier this year by the Distributed Denial of Secrets group. Fortunately for The Bahamas, both groups only obtained Companies Registry information that is publicly available for a fee, such as the names of all Bahamas-domiciled corporate vehicles and their directors.

However, the shutdown has again impacted the efficiency, time and cost associated with the ease of doing business in The Bahamas. Mr Leonard was yesterday backed by fellow attorney Thomas Dean, of Dupuch & Turnquest, who told Tribune Business: “You have no idea how bad it is.

“Some of our checks as attorneys are done on the CRIS system, both title documents and deeds. Any time the Registry is down is a great hindrance. That is one of an attorney’s best resource checks. Instead of writing the lawyer’s letters and waiting for confirmation, you can go on the Registry and determine if that is correct. It’s not functioning now, I can assure you.”

The Registrar General’s Department is the hub around which much of corporate Bahamas and, in particular, the financial services industry functions. It plays a critical role in the incorporation of companies and other Bahamas-domiciled vehicles, such as International Business Companies (IBCs), all of which are key cogs in structures employed by high net worth and institutional financial services clients.

The agency handles annual company filings/returns, and the payment of associated fees and name reservations/searches. Patent applications and approvals; the recording of deeds and documents, such as real estate conveyances; and births, marriages, deaths and adoptions are among its other core functions, meaning the Registrar General’s Department touches every Bahamian and resident at some point in their life.

The closure of the online portal and database has thus meant that attorneys and the private sector have been forced, at least temporarily, back to a manual system for performing daily corporate functions, which Mr Leonard said has caused significant frustration in the private sector.

“It’s a bit of a pain,” he told Tribune Business. “You’ve got to go and do it manually, certificates of good standing and things like that. It’s been frustrating, trying to get things done. That’s all. If you want to do a search or pull put a document the portal has been down, and we have not been able to access it for weeks and weeks.

“That’s a problem with title stuff, as you may not be able to see a key document. It slows everything down just at a time when, as a country, we truly need to speed things up to get revenue in. I think it’s fair to say we have been frustrated by it.

“In all fairness they [the Government] have been working on it, but the problem is it should not have happened in the first place. They don’t have a fall back position if things are compromised. So that’s another thing the Government has to look at: How it recovers of one portal gets hit.”

Mr Bethel said the Registrar General’s Department will likely re-open by week’s end once “several layers” of new cyber security defences have been deployed. He added that he was seeking to split up the Registrar General’s Department’s electronic database into several separate ones based on their functions.

This, he explained, will mean that the companies registry will be separate from that of births, marriages and deaths. With these on separate servers, Mr Bethel said any hacker able to penetrate one of these databases would be unable to access all - as they can presently.