COI Report – Part IV Page 177 of 425 steps were taken to verify if the queries did in fact return zero results. 36 Han also confirmed that there were no ongoing audits or penetration testing that may have led to the queries. 560. By the end of the meeting, it was agreed that the matter should be escalated to Benedict. Serena has explained that to her mind, while there was no operational impact, it “would be better to over-communicate” and escalate the matter to Benedict. On Clarence’s part, he had in mind a few possible explanations, namely, that the queries were run by internal staff that there was an ongoing auditor that it was a security incident. “Worried” that they were unable to identify the source of the queries, Clarence agreed that they should inform Benedict to seek his advice. At around pm on 9 July 2018, Serena, Clarence, Ernest and Wee called Benedict, informing him of the unusual activity detected on the SCM database, that no records had been extracted, and that IHiS staff had stopped the SQL queries on 4 July 2018. Serena and Clarence also informed Benedict that there were no ongoing audits or penetration testing. 562. Benedict was of the view that they should have informed him earlier. He informed Serena and Clarence that he would inform IHiS CEO Bruce and Director CSG Kim Chuan, and also asked fora meeting to beheld the following day to discuss matters further. 28.5 Informing Bruce, Kim Chuan and Prof. Kenneth 563. While Benedict felt that the information he received was “still quite vague”, he was of the view that he ought to escalate the matter to Bruce. Benedict called Bruce on 9 July 2018 immediately after speaking to Clarence and Serena, Some support for this can be found in Clarence’s conditioned statement, in which he states that “I do not recall seeing any of the logs at the meeting, as we were focussed on gathering the information from the various teams”.
