Bank report leak exposes tech flaw

Johannesburg - SA's banks say more effort should have been made to keep a confidential report on banks charges from being leaked online, with IT professionals saying not enough was done to encrypt it.

"Banks provided this information in goodwill and had signed a confidentiality agreement - every possible effort should have been made to keep this information confidential," André du Plessis, the financial director at Capitec, told Fin24.com.

Capitec's low-cost banking offering compared very favourably to those offered by South Africa's large retail banks in the Competition Commission report and has come in for praise from consumers.

"We're disappointed, but we're not pinning the blame on anyone," said Rob Shuter who heads up retail banking at Nedbank who described the turn of events as "an unfortunate speedbump along the way".

Hard to compare

Both Shuter and du Plessis questioned how much meaningful information could be extracted from the findings owing to the number of products offered by each institution.

"While all the banks submitted the information that was expected of them, it is very difficult to draw a realistic comparison between the banks and products - every bank has its own costing basis," said du Plessis.

"I'm not sure how much insight you are really getting," said Shuter, who pointed out that the banks had been asked to submit historical data that had not necessarily been used for costing purposes.

He added that different banks had submitted different data and there was no explanation or discussion on how the data was prepared.

'Not guilty'

Instructions on how to uncover the "confidential" portions of the Competition Commission's findings appeared on an online consumer forum focusing on South African technology issues, Mybroadband.co.za.

Its founder, Rudolph Muller, denied any wrongdoing in terms of the "leak", and pointed out that very little real "encryption" had taken place and that basic voice recognition software and conversion tools were able to uncover the confidential date.

"Technically it does not seem to have been well handled," he said.

Muller said the Competition Commission had asked him to remove the posting from the website - with which Muller complied - but at this stage no formal legal request had been put forward to find the person who had posted the information on the site.

"I carried no knowledge whatsoever of this being posted on the site until it was brought to my attention," said Muller.

The site receives a number of anonymous postings on the site every day and Muller confirmed that, from time to time, the site was asked to remove offensive posts.

The site's moderators will review the request and remove postings if the complainant has a genuine case. Should a legal request be submitted and Mybroadband.co.za feels it has merit, it will supply authorities with necessary information in terms of the posters identification.

- Fin24.com