Lee MelissaMELISSA LEE (National): Thank you Mr Speaker. I'd like to begin by saying that the Minister's speech started off I thought in some ways as quite a concerted effort in trying to address the issues that were raised by myself and Ms Brooke van Velden on the exposure of personal details on the dark net as a result of the hacking that actually took place but then he changed tack and decided to actually blame the previous National Government for the failures in the health ministry. I thought he was the Minister of Health now and it was in fact the Labour Government who has been in Government for the last almost four years. It seems rather ironic that he actually hasn't answered anything in relation to the hack or what the Government is doing about it.So on the day when I found out about the Waikato District Health Board's massive ransomware attack there was language that was uttered from my lips that my mother would not be very happy with nor would my church minister. And then there was a sigh of relief thinking that had the Government in fact implemented the whole idea of not just having one district health board but one health agency it wouldn't have been just the Waikato District Health Board's reach of about 435000 people's information but it would be 5 million - plus people's information that would have been hacked. So that was in a way a bit of a sigh. And when today I heard the news that the information that was hacked has now been released as a result of us not paying the ransom—and I applaud the Government for not bowing down to the ransom of having to pay for that information and I totally support that. Having said that there were a few choice words uttered again today when I saw that it has actually been released because it is the people living in the Waikato District Health Board's catchment—whether they actually live in Hamilton or nearby areas—that'll be rather concerned that not only did the ransomware hacking mean that their surgeries could not go ahead but it is their information about their health information about their prescriptions potentially information as to why they saw a particular health provider at the district health board's mandate that they may not necessarily want made public for the whole world to see.So I actually asked Minister Dr David Clark about this issue because according to the incoming Minister's briefing he is in fact the Minister responsible and in charge of the cyber-security policy for this Government. And yet he basically decided that he wasn't responsible and said I needed to chase another Minister for that information and the person who actually rose to his feet and spoke first today from the Government's side is Minister Andrew Little and he didn't seem to have any answers. Considering the fact that cyber-security even according to the Government and I quote Dr David Clark from the Estimates hearing where he actually says there are literally hundreds of thousands if not more attacks across Government every day—if that is knowledge that the Minister who has responsibility for cyber-security has and is in fact aware that it is happening and he has responsibility over CERT New Zealand as well why did this Government not boost cyber-security resilience through their Budget process?Australia did. Australia put in place $1.6 billion announced this year in their Budget to deal with cyber-security. Every day I know members in this House would also be quite aware that we have scams and ransomware and emails that come through our parliamentary system that we have to report as well to say to our ICT people Oh I think this is actually problematic. It is actually a questionable email. I think it's actually a scam." And sometimes we actually get "Congratulations you spotted a really good one." I mean I think it's ironic that we are being aware and I think all of us need to be vigilant about the way we deal with ransomware scams and internet—Hon Scott Simpson: That's right!MELISSA LEE: Ha ha! Thank you Mr Scott Simpson. I wasn't expecting that.But the thing is that some of us are—for me personally I am even fearful of clicking any gif that friends actually send through Facebook for example or even videos that I am actually being sent through Facebook or even emails for fear that it is laden with viruses laden with scams or ransomware malware anything possible.But the thing is that these criminals who actually attack our Government departments they know the weaknesses and they know that when the Minister also says at the Estimates hearing that he hasn't actually put too much money into this area they might actually attack some other Government departments—I'm not so sure. But it's like criminals when they go out committing their actions they do it like most of us: when we go to work we prepare for it go to select committee we read our papers. When criminals go out they prepare for the job that they're doing. They go there looking for weaknesses. They know that certain Government departments do not update their databases and do not update their malware software or anything. If that is the case we need to make sure that these Government departments do what they're supposed to do. Same thing with the Reserve Bank. When the patch was actually given it never even arrived because they never updated their software. When Waikato District Health Board did not actually update their software blaming "Oh we didn't have the money." Hmm really? I'm not so sure that is in fact fact.All of us need to be aware. What has this Government done to reach out to the public in terms of awareness campaigns about malware? I know CERT New Zealand is actually in charge of that. I think for what they get in terms of the budget they do well but what has this Government done to boost the work that they're supposed to do? I don't think it's actually enough that the Minister says "We need to keep on building our cyber-security capacity." Well I don't think that Minister or this Government has actually built any cyber-security resilience and capacity when you consider the fact that the digital services area in one Vote—let's say Vote Internal Affairs—they in fact reduced the budget by $11 million. And the reasoning why they reduced that is because they said "Oh they've completed the e-invoicing system." Really? Because they've completed the e-invoicing system they reduced the budget from $55 million to $44 million.What about the response from the Government seeing that we've actually had the stock exchange we've had the Reserve Bank we've had the Waikato District Health Board we've even had the Health Research Council hacks and cyber-hack breaches that we've actually had? Why is the Government not putting their money where their mouth is saying that they take cyber-security seriously—that the Ministers actually know what they're talking about or at least have people who are experts in this field to give them proper advice?Well the Waikato District Health Board cyber-security hack means that the people of Waikato the families the businesses are probably very worried now. People who have patients' blood types—sensitive information about their health is not something that people want the rest of the world to know. These are issues for private consumption only usually for the person and their medical specialist or the doctor that they actually see. Patient and doctor privilege exists because of that private nature of the reason why people actually go and seek medical help. And when district health boards and Government departments who hold this data get hacked there should be some responsibility on the Government who actually runs this country who should have the responsibility to make sure that Government entities like the district health board do their very best to secure that data. Did Waikato District Health Board do that? I don't think so. Did this Government do it? I don't think so.Hon Dr David Clark: Mr Speaker?DEPUTY SPEAKER: It's a Green Party call. Teanau Tuiono."