Turei Metiria: Urgent Debates — Social Development Ministry—Security of Private Information 
Text is incorporated into the Bound Volume 
Turei Metiria: Urgent Debates — Social Development Ministry—Security of Private Information 
[Sitting date: 16 October 2012. Volume:684;Page:5818. Text is incorporated into the Bound Volume.] 
METIRIA TUREI (Co-Leader—Green) 
: 
 The revelations of this massive breach of privacy and information and communications technology security failure at the Ministry of Social Development are a very clear indication of both a ministry and a Minister that are prepared to cut corners with scant regard for the privacy of the most vulnerable New Zealanders in this country. We would have thought that all of the Ministers of this National Government learnt the lessons from the debacle that we have seen at ACC and that they—Paula Bennett in particular—would call in their chief executive officers and chief information officers and seek assurances from their own people that nothing similar could possibly happen in their departments and that if there were problems they would take immediate action to remedy them. Some of those Ministers might have done that but it is certainly clear that Minister Bennett did not. Minister Bennett learnt nothing from Minister Collins in the ACC breach from the Inland Revenue Department breaches nor even from her own disgraceful behaviour in breaching the privacy of two women—two mothers—who just happened to have the gall to disagree with her policy. This is the example that Minister Bennett has set for her ministry. This is not an operational issue; this is a leadership issue. This is a breach far worse than ACC where human error was a significant factor. 
I just want to reflect on some of the things the Minister has said today and in her answers to questions. She talked about how the Ministry of Social Development has breached the public trust and that New Zealanders should be able to trust that no information will ever be revealed intentionally or by error. She talks about how she is so extremely disappointed and how she is committed to a process that is upfront and transparent. But where is her statement her commitment to zero tolerance for privacy breaches? Where has she locked down and made sure that there will be no such breaches? 
She could not do that because she has no credibility when it comes to privacy issues because she herself released private information of beneficiaries that she got I understand from the computer in her very own office. She got it from that computer in her office and released private information about the incomes of two women who were solo parents on the DPB who then suffered very severe public consequences in terms of people who verbally attacked these women and frightened them in terms of the protection and security of their children. Paula Bennett breached the Privacy Act and was found to be in breach by the Privacy Commissioner. Did she apologise to those women? No she did not. She did not say sorry to the women whose privacy she breached. In fact did she guarantee that she would never do such a thing again having been found to be in breach? No she did not. She did not guarantee that information held by her and her ministry—private information—would never be released. 
And now she has the gall to stand in this House and say that she is extremely disappointed with these failures that she wants to be upfront and transparent and that no information should ever intentionally be released. Well this is the Minister who is leading the privacy breaches in her own ministry. She has set the standard for the Ministry of Social Development that it is OK to release any information you like to not care for the protection of that information and to have no respect for the people whose information is kept and that has led to the kinds of breaches that we have seen—not just this recent Ministry of Social Development breach but also the continual leaks that appear to be coming from her office. She should at least now have a zero-tolerance policy. She does not which means that all the things that she said in this House today mean nothing and can guarantee nothing for New Zealanders. 
This is a systems failure of gargantuan—enormous—proportions. The front door to the Work and Income office was left wide open and anyone—anyone—could walk in and access personal details about the location of vulnerable children in the care of Child Youth and Family. And the ministry knew that there was that vulnerability. It knew in 2011 18 months ago—more than that—that there was a problem with this information being accessible and it did not do anything about it. 
I think one of the most shocking revelations has been around the information of vulnerable children that has been available. The Minister has gone on and on about protecting vulnerable children. She has gone out and stigmatised beneficiaries in the process of her supposed desire to protect vulnerable children. She has harassed people over the issue of vulnerable children and is punishing people through punitive welfare reforms to justify protecting vulnerable children and yet her own ministry and her own process are unable to protect even the addresses of the children who have been removed from abusers. The addresses and private information of children who have been removed from abusive households have been available potentially to those abusers. Somebody described this as a potential shopping list for paedophiles. That is the risk that Paula Bennett has put vulnerable children under. She has exposed them to that risk. And has she committed to zero tolerance of any privacy breaches? No she has not and has herself been guilty of putting other children—the children of other beneficiaries—at risk themselves. 
This is an information technology security failure that is so huge that there has been some analysis from Daemon Consulting. Matthew Poole is talking about the fact that the entire Work and Income New Zealand network and probably the entire New Zealand Ministry of Social Development network should be considered to be fully compromised not to mention the Canterbury Earthquake Recovery Authority and the Families Commission because some of that data was also available through the kiosk. Every server and workstation should now be considered to be accessible and controllable by people who are not employees of Work and Income or the Ministry of Social Development. 
Bizarrely even passwords were available on that information. Those passwords were stored as plain text so anybody who has access to that file has access to the passwords of who knows how many other computers or files. Minister Bennett in answer to a question today said that the reason why this vulnerable kids information database will not be as vulnerable as the current system is that it will be password protected. Well not if they keep the passwords as plain text on a system that is so accessible at this point by who knows whom. That information that system will not be at all secure until the entire system at the Ministry of Social Development has been secured and who knows how long or what cost that will take. 
Personal information may have been downloaded false information uploaded and existing information altered. There is a very high risk—even higher now—of internal fraud within the Ministry of Social Development as a result of this privacy breach. The Minister has tried to downplay some of the risk in these circumstances. She talks about data and information but actually we are talking about people’s lives being affected here if there is serious information interference such as people who are being convicted or accused of fraud people who may be accused of overpayments on their benefits and people who may lose access or entitlement to their benefits possibly because false information has now been placed on the Work and Income files and there is no capacity to tell whether or not that is the case. All of those files are now compromised. It is not just a matter of data; it is a matter of whether those people will suffer the consequences in their daily lives of this failure—the most vulnerable New Zealanders who do not deserve this kind of treatment. Of course it is no surprise that it has happened on Minister Bennett’s watch because she has as I have said already demonstrated scant— 
Charles Chauvel 
: It was inevitable it would happen. 
METIRIA TUREI 
: Well my colleague from Labour said it was inevitable that it would happen because of her scant regard for privacy and I think he is probably right. 
Today we have also had a revelation from the Ministry of Social Development’s chief executive Brendan Boyle that in April of 2011 the ministry was informed about the flaws in the information system. Minister Bennett did not take that seriously and nothing happened. Just last week when Ira Bailey approached the Ministry of Social Development and did tell it that there was another failure in the system—a whole information security hole at the ministry—what did it do? Nothing. The ministry looked at him; the ministry investigated him. It did not bother to investigate his concern that there was a security breach in the information. It did not bother to go out and find the breach and now it has been revealed to the whole public. The ministry can take full responsibility for that failure to check when it had been told time and time again that this risk was present. 
It has also been revealed that Ira Bailey’s name was leaked to the media and again Minister Bennett has taken no responsibility at all for the consequences of the leak. In fact she is so blasé about privacy breaches she said today she is not going to bother to find out whether or not her office leaked that name. That is her attitude. Her attitude is one of disgraceful disregard for the rights of New Zealanders. She does not deserve to be the Minister for Social Development if that is the kind of leadership that she is showing to New Zealanders. Thank you.