By Elias Hazou
SEVERAL months after leaving the Central Bank of Cyprus (CBC), former deputy governor of the CBC Spyros Stavrinakis may still have had access to classified data of the European Central Bank (ECB), the Sunday Mail has learned.
Documentation seen by the Sunday Mail shows that Stavrinakis was included on the list of CBC staff with access to the Darwin system – the ECB’s intranet.
Darwin contains sensitive information, such as national banks’ interest rates, ECB policy and working documents, upcoming stress tests and quality reviews of balance sheets of banks under supervision.
Despite having left the CBC in April 2013, Stavrinakis – among CBC officials with access to information tagged as ‘Secret’ and ‘Confidential’ – remained on this list until at least November of the same year, documents reveal.
The Central Bank has denied that Stavrinakis had access to Darwin for months after he left the post.
“According to the CBC IT department, Mr Spyros Stavrinakis’ access to CBC IT systems (including Darwin) was deactivated on 18 April 2013, a few days after … the President revoked his appointment as deputy governor,” CBC press officer Aliki Stylianou said on Friday.
“The ECB has confirmed that the audit logs to the Darwin platform show that his last access to the platform was a few days before deactivation of his account, although his name might have remained visible in the system for some time after the revocation of his appointment.”
But, according to information obtained by the Mail, it was not until early November 2013 that then-CBC governor Panicos Demetriades notified the ECB in writing that Stavrinakis – who had left the CBC some seven months earlier – was being taken off the list of officials with access to Darwin.
Only the governor of the CBC can authorise persons’ access to Darwin. Additionally, the governor must notify the ECB as to which CBC staff members are added or removed from this list. Moreover, the ECB periodically and regularly requests national central banks to keep it updated on their lists.
It’s also understood that the log-in passwords for Darwin users are updated every two months.
In correspondence between the ECB and the CBC in late October 2013, the former provides the latter with the list of CBC officials entitled to access to Darwin at that point, and asks the CBC to confirm and/or update this list.
In another twist, the Mail learns that despite Demetriades’ November notification to the ECB about removing Stavrinakis from the list, Stavrinakis’ account was not deleted until early December.
This raises questions as to whether up to that point Stavrinakis had remote access to his Darwin account.
It was not immediately clear whether Stavrinakis’ removal from the list automatically denied him access to the system as well.
Another question that begs an answer is why other CBC staff who were users of Darwin – and must have therefore known that Stavrinakis was on the list and/or had access until November – did not take it upon themselves to notify either the CBC or ECB.
The Mail contacted Stavrinakis, who said only that any questions on the matter should be referred to the CBC.
It’s understood that in order to log in to Darwin, a person must first use a device that is a random-number generator. That random number is then used, along with a user’s password, to log in.
CBC staff are required to relinquish any laptops, tablets, smartphones or any other devices once they stop working for the bank.
Stavrinakis, a senior CBC director, was appointed deputy governor by former president Demetris Christofias just two weeks before the February 2013 presidential elections.
President Nicos Anastasiades rescinded the appointment a month after winning the elections, effectively sacking Stavrinakis.
Both Stavrinakis and central bank governor Panicos Demetriades appealed the decision.
In late November 2013 the Supreme Court rejected the appeal.