TSTT’s epic $24M cyber flop

TLDR:

• The Telecommunications Services of Trinidad and Tobago (TSTT) approved a total of $24 million for cybersecurity between March 2022 and November 2023.
• Despite the approved funds, TSTT fell victim to hackers in October 2023.
• Documents obtained by the Sunday Express reveal that all cybersecurity expenditure requests were approved during this period.
• The approved funds exceeded the actual amount spent by the Networks and IT team, suggesting a possible discrepancy between requested and utilized funds.
• The Communications Workers’ Union previously accused TSTT’s former Chief Financial Officer of neglecting cybersecurity funding, but documents contradict these claims.

The Telecommunications Services of Trinidad and Tobago (TSTT) had a budget of $24 million approved for cybersecurity between March 2022 and November 2023, according to official documents obtained by the Sunday Express. The documents show that the Expenditure Committee consistently approved every cybersecurity expenditure request submitted by TSTT’s Networks and IT department. Despite this, TSTT was still victimized by hackers in October 2023.

The approved funds appear to have exceeded the actual amount spent by the Networks and IT team, suggesting a possible discrepancy between what was requested and what was utilized. The documents also contradict claims made by the Communications Workers’ Union, which accused TSTT’s former Chief Financial Officer, Shiva Ramnarine, of neglecting crucial cybersecurity funding.

TSTT established the Expenditure Committee in 2020 to manage the spending of the state-owned telecommunications provider. The Committee had no knowledge of any unapproved expenditures and raised concerns about potential personnel manipulating fabrications of unapproved spending. Additionally, the committee examining the Nelson Exchange shutdown found that all maintenance expenditure requests related to the Exchange were promptly approved over the past three years.

Although TSTT had approved cybersecurity funds available, the actual amount spent appears to be less than what was allocated. The organization’s former CFO, Shiva Ramnarine, declined to comment when contacted, and his lawyer redirected all questions to him. The TSTT chairman stated that Ramnarine’s departure was not related to the cyberattack and that the company had honored all contractual obligations to him.