COI Report – Part IV Page 172 of 425 27.9 Arranging to meet Woon Lan on 9 July 2018 543. It appears that by Friday 6 July 2018, Woon Lan had come to know that something was amiss, and asked Ernest on 6 July 2018 fora meeting the next day, 7 July 2018, to inform Serena of what was going on. Ernest had declined to meet on 7 July 2018 because he was “too stressed to work that weekend”. In recounting this exchange with Woon Lan to Benjamin over TigerConnect, Ernest told Benjamin that he “told (Woon Lan) not 2 kajiao me ind wkend cos I stressed up. Dun wanna meet on Sat.” In his oral evidence, Ernest explained that his stress arose from his mother being admitted to the Accident and Emergency Department of a hospital on the night of 6 July 2018. A meeting was instead scheduled for pm on 9 July 2018. 27.10 Assessment of IHiS’ incident response from 5 to 8 July 2018 544. Based on Ernest’s replies on TigerConnect and the evidence he has given in the course of the Inquiry, it is clear that by 6 July 2018 at the latest, Ernest had himself come to the view that they were facing a security incident that should be reported. However, Ernest wilfully delayed reporting on 6 July 2018 because he felt that additional pressure would be put on him and his team once the situation became known to management. In his own words, once the matter was escalated to management, “there will be no day no night”. Thus, he procrastinated and as a result remediation efforts were unnecessarily setback by several days. 545. Wee’s silence on the issue of reporting during this period is also deeply unsatisfactory. Based on his evidence regarding the meeting at am on 5 July 2018, Wee remained oblivious to the significance of events, viewing the unauthorised logins to Citrix Server 2 using the SA. as not something of concern, and failing to see any link between such unauthorised logins to Citrix Server 2 and the SQL queries discussed on 4 July 2018. Once again, he displayed his characteristic passivity and aloofness. 546. There is also no evidence of Ernest or Wee providing any significant degree of leadership in sharing information and coordinating investigations and
