Faafoi Kris: Electronic Identity Verification Bill — In Committee 
Text is incorporated into the Bound Volume 
Faafoi Kris: Electronic Identity Verification Bill — In Committee 
[Sitting date: 13 November 2012. Volume:685;Page:6543. Text is incorporated into the Bound Volume.] 
KRIS FAAFOI (Labour—Mana) 
: 
 Thank you very much Mr Chair for offering me the chance to speak to Part 3 of the Electronic Identity Verification Bill. As I said in my contributions in Part 1 and Part 2 it is absolutely fundamental that if we are going to roll out this Igovt system and expand it out through what is already existing the public need to have 100 percent confidence in the security and the monitoring and also the consequences if the laws—as they stand or as they are proposed—are transgressed. There are grounds for serious concern within the public because of the number of recent glitches in the security of private information that we have seen in a number of Government departments. Of course there has been most recently Novopay where the private details—[ 
Interruption 
] Yes “No pay” I should say. There have been instances when the private details of teachers have been forwarded on to schools where they do not work. There was a case with ACC where the details of over 6000 individuals were sent to one individual. There has been the case of the Inland Revenue Department and 7000 individuals affected there and then of course we had the Ministry of Social Development and the cases of the kiosks where one individual was able to access quite a lot of sensitive information. I do want to talk about that in respect of Part 1 and Part 2 and especially around access and then the provisions in clauses 56 to 60 I believe which cover the penalties if someone is found to improperly access information that is held within this realm. 
During Part 2 I did ask the Minister in the chair for some assurances given the concerns that would be out there in the public at the moment around security about whether or not the Government departments involved in this legislation have done enough to assure the New Zealand public and the Minister that the information involved is safe. I also asked the Minister in the chair what level of monitoring is going to be carried out given the fact that I believe in the case of the Ministry of Social Development there were some flags raised about 6 months—or a year I think it may have been—before the issue was highlighted in the media. Nothing was done publicly at least from the time that that was raised privately until the issue was raised by citizen journalist Keith Ng. I think if it is still possible to get a reply from the Minister in the chair the Minister for the Environment about the level of monitoring that would be good. 
I mentioned Keith Ng and I also want to ask the Minister in the chair whether there was any talk or any possibility—because Part 3 sets out the offences of accessing the information and the penalties—that in the case of Keith Ng there might be some kind of protection for people who like a blogger or a citizen journalist are accessing this information because they believe there is a potential gap in security. They might believe that the only way for them to find out whether or not there is a gap in security is to do what Keith Ng did which was to go into that Work and Income office and access the information to see whether he could access it. But from my reading of the bill as it stands there does not seem to be any protection for anyone who with good intentions and no malice goes in to access this kind of information. 
That is just something I want to throw out there because given the nature of the area we are talking about—and we are talking about digital storage—the expertise for these kinds of things as we have seen in the last couple of months to try to test it or hack the information does not necessarily rest within the Government departments. They could not find the security gaps or the security lapses that had existed for some time. It took someone external to test the system to see whether there were some gaps. So we have got a case where there may be a third party who comes in who may have a little bit of knowledge about a potential threat to the security of the system and who does what Keith Ng has done which was to go in access that information and with no malice actually go to the authorities and to the media about a potential security lapse. I am just wondering whether the Minister in the chair could elaborate as to whether because of the nature of this—and I am no technology guru—the expertise in this area might not lie within the Government departments. It might lie with those who are more technically advanced than those within the department. If they do test it and find a lapse in security I ask whether or not there will be some protection within the law as it stands now to protect that person because they have actually done the public a good service by highlighting the issue of a security lapse. Hopefully as the Minister in the chair has taken one call to answer a question from Denis O’Rourke it would be good if I could potentially get a reply to that question. 
There are some penalties both monetary and also in terms of imprisonment that are contained within clauses 56 to 60. If someone commits an offence that is set out in clause 56 they are liable for a term of imprisonment not exceeding 10 years a fine not exceeding $250000 or if it is an organisation a fine not exceeding $1 million. I think Denis O’Rourke talked about the level of penalties within clause 58(4) and he was answered by the Minister but I have since that time had a chat to my colleague the chair of the Government Administration Committee Ruth Dyson. She said that during the select committee process which was some time ago I understand the level of punishment and the penalties that are contained within the bill were debated and the members of the select committee thought that it was appropriate to have the level of punishment as it is set in the bill as it stands. Also clause 58 looks at an issue that I highlighted in the debate on Part 2 which was around access. It relates to offences relating to improper access to the information that is held on the service database. That also carries penalties of imprisonment for an individual of a term not exceeding 2 years a fine not exceeding $50000 or for an organisation a fine not exceeding $200000. So I guess that does answer some of the questions that I posed in the debate on Part 2 around the monitoring and what kinds of penalties would be carried out if someone was found to be improperly accessing the database. 
In terms of improper access there is serious concern. Again I just want to highlight the concerns that there will be out in the community about the level of security around private information. It is a serious concern. It is a real concern. As many people have pointed out the journey of this bill might have been slightly different if it had happened in the context of recent events. I think there would have been much more scrutiny around the protections that the Department of Internal Affairs and other agencies could offer around the security of information given we have had a series of serious blunders I guess you could call them around the security of private information from the Government in the last year or two. So I just want to reiterate that public confidence is absolutely essential to making sure that the Igovt roll-out and expansion beyond what is already in place is a success. There is concern amongst the community because of the glitches at Work and Income ACC the Inland Revenue Department and the Ministry of Education with security of private information recently. 
I would like the Minister in the chair to potentially answer some of the questions that have been posed. I just remind the Minister in the chair about maybe that one issue of the likes of citizen journalists or bloggers who may expose glitches in this system having some protection from prosecution—[ 
Interruption 
] Yes whistleblowers. If they do highlight glitches in the current system I ask whether or not they potentially have any protection—if they with no malice do highlight some shortcomings of the current system.