Ardern Jacinda: Urgent Debates — Social Development Ministry—Security of Private Information 
Text is incorporated into the Bound Volume 
Ardern Jacinda: Urgent Debates — Social Development Ministry—Security of Private Information 
[Sitting date: 16 October 2012. Volume:684;Page:5813. Text is incorporated into the Bound Volume.] 
JACINDA ARDERN (Labour) 
: 
 I move  
That the House take note of a matter of urgent public importance 
. Every single New Zealander has a right to feel concerned about this massive breach of privacy that has occurred within the Ministry of Social Development. This is by far the worst breach of privacy that I have seen not just as a member of Parliament but as a citizen. I would bet that every single member in this House would be severely challenged to find a breach more serious than this one. But there is actually some competition for that title. In recent times we have seen breaches by both ACC and the Inland Revenue Department—serious breaches. In fact ACC in particular grabbed the headlines for a long period of time and I expect that this breach will do the same. This time we add the Ministry of Social Development to that list. 
Unlike ACC where specific information was sent to an individual claimant this breach is different. In this breach any member of the public could have walked and did walk into a Work and Income office and accessed a publicly available kiosk to view the personal and private information of some of our most vulnerable New Zealanders. It is utterly astounding that that could happen in this country but it points to a cavalier approach to privacy and to the protection of information by this Government. 
The buck has to stop somewhere. It is all well and good for Ministers time and time again to stand up and call these issues operational. But the protection of information held by the Government goes to the heart of people’s trust in the State. This cannot be left as an operational matter to public servants. This is a matter very much at the heart of what the Government must be doing and must be held to account for. But we saw today the level of accountability that this Minister wants to take. She was quick to say this was an operational matter and we will come to whether or not that is a fair claim. 
But first let us review the background of what has happened in this incident. Recently an individual who wished to stay anonymous encountered an issue with Work and Income kiosks. Let us be clear about the vulnerability in the system. This individual did not hack into Work and Income systems. Unlike what the Prime Minister and at times the Minister have implied they did not need to know what they were looking for to find this information. They needed to know only how to use a mouse and click it as little as three times. They literally clicked on “open file” in Microsoft Office in order to access this vital and key information. Linking a public Work and Income kiosk system to the main database of the Ministry of Social Development is unforgivable in this day and age. Even the most lay of people when it comes to IT issues would understand that that would be a risk and would put vulnerable people at risk. 
The individual who discovered that issue contacted the Ministry of Social Development—it took several days for the Ministry of Social Development to respond to the original call—and the main query they had was like Facebook or Google whether it gave any kind of remuneration for vulnerability testing of systems. The Ministry of Social Development responded last Wednesday but in the intervening period Keith Ng a blogger and an investigative journalist had been approached by this individual. Keith took a look himself. What he found was devastating. 
Let us start at the top. Firstly there was contractors’ information: full names hours worked pay rates and pay details for all Ministry of Social Development contract workers including for media trainers—probably coming in handy at this present time. 
Secondly there were doctor and radiology invoices with full names of candidates for adoption foster parents and Limited Service Volunteer candidates—some of our youngest and most vulnerable on Government support. In others there were invoices from doctors in radiology for X-rays of children in care and protection with their full names and their chief complaint—the cause of their abuse. Some of these were X-rays for injuries and broken limbs. 
There was debt collection information. The Ministry of Social Development debt collection unit uses Veda Advantage for its debt collection needs and when it invoices it includes a list of people who owe it money. 
 But then there are the invoices that relate most specifically to our most vulnerable children. There were phone bills from Telecom for Child Youth and Family homes and care and protection facilities. Although some of this information may be publicly available what would of course not be known is who resides there and the phone logs that were made to those addresses. There were pharmacy invoices including prescriptions that identified not only children in Child Youth and Family care but also the medication they are taking including antidepressants and in some cases cancer-related medication. There were legal bills which in some cases included historical claims against Child Youth and Family—obviously in some cases for abuse. 
The availability of this information is an indictment on this Government and it has to be said on this Minister. She may claim as she has done in the House today that this was an operational matter but in 2009 she wrote a letter to Bill English as part of her review finding value for money within her Government department as all departments did. When she wrote to Bill English she said the following: “Whilst the Ministry has a strong focus on reducing its national office numbers there are also substantial plans to automate frontline services for clients through the use of online and other IT solutions.”—a specific reference to the use of kiosks in Work and Income offices. She went on to say: “I will be monitoring the progress of these plans regularly with the Ministry’s Chief Executive.” Quite clearly the Minister did not do that. She did not monitor the automation of those services. She did not even follow what the Ministry of Social Development had done in terms of review. 
Even the ministry itself undertook external reviews which found vulnerabilities that this Minister did not even know about. How can she claim that this was an operational matter when she told her own Minister of Finance she would monitor it and clearly she did not? She has claimed that it is “disturbing” that her department did not act on vulnerabilities that were identified by an IT analysis. I find it disturbing that she did not act. I find it disturbing that she did not know of such a flaw in her own system. 
But let us come to what was happening within information and communications technology within the ministry generally. Let us be clear. The systems were developed in-house. It was not a contracted activity originally. It was done in-house by her staff and by her team and the systems were rolled out in 2010. At almost the same time Treasury was asking Government departments to save $130 million per annum on information and communications technology costs. Something had to give and quite clearly it did. 
There were also contractors involved—this is true. There has been some suggestion that those information and communications technology contractors themselves failed. In fact the ministry implied that in some of its media conferences yesterday. But now it has retracted and stated that it is not sure or can no longer be confident that the ministry even followed up on a report from Dimension Data in April last year which the ministry paid it $10000 to complete. It did not even follow up on the flaws that that company identified. Dimension Data raised issues with the Ministry of Social Development. The ministry paid it $10000 to do that and then did nothing to follow up the problems it identified. That is an absolute outrage. The fact that this problem could have been prevented and was not is an absolute outrage. 
It was not just an information and communications technology company paid by the ministry that found this problem. It has also been raised by a beneficiary advocacy group. Over a year ago it raised with the Ministry of Social Development issues with its system. There are two options. Either the ministry did not act on that information or it simply did not know what it was meant to be looking for. Either way it is an epic fail and this ministry has shown that it cannot be trusted with the personal private information of vulnerable individuals. 
But there is another matter that the Minister has referred to in the past week that has now been drawn into this debate and that is the issue of the White Paper for Vulnerable Children. The children affected by this breach will in most cases be the very same children the Minister wants to protect through her white paper which has been totally undermined by this incident. The Minister’s plan hinges on a database of vulnerable children being established and information shared. She herself acknowledges that faith in the system is critical for this database’s success. In the white paper she said: “While there is much to gain from better information-sharing about vulnerable children and their families there are also associated risks including a possible reluctance to use services if there is a perception that information will be shared”. We have more than a perception that information will be shared. We have a perception now that information will be severely compromised. 
She went on to point out that a similar system in the UK was dumped in 2010 in part because of concerns about the security of the system. She states that on the basis of this experience there are four key elements required for this system: social—and in that she lists “trust within and between agencies”—a legal framework resources and finally “Technical—system capability is part of the solution but trust (that personal information will be shared when necessary and with the right people) should underpin computer system design …”. She herself has identified the very issue that could bring down the key element of her white paper and it has already happened before she has even started. Two of the four elements that she says are needed no longer exist. 
 It is key that we do something to support and assist young children in this country and to prevent young children in this country from being abused but the Minister has undermined her own ability to achieve that and must rebuild the faith in her department’s ability to hold and use information appropriately. But can this Minister do it herself with the record she has? Not only was external testing not followed up and not only were public complaints not followed up but the culture that she presides over through her own leadership is highly questionable. 
It was not that long ago that the Privacy Commissioner was directly involved with this Minister over the release of personal details of someone on Government support. She was willing to release someone’s private information in order to deflect from the bigger issue around her leadership of welfare at that time and she was unrepentant even saying she would do it again. She has assured the House that she has not given the personal information of the original informant around the vulnerabilities of her system to the media. But we can be utterly forgiven for asking. The Ministry of Social Development advised her office of Ira Bailey’s name on Wednesday. On Thursday the Minister’s own political adviser looked at Ira Bailey’s LinkedIn profile. On Sunday the story broke. On Monday the  
New Zealand Herald  
suddenly had the name of that individual and when so few people knew his identity it is absolutely right that the Opposition asks in order to figure out whether or not the Minister was trying to detract from what is the most pertinent issue here and that is her ministry’s utter incompetence in dealing with the information of vulnerable New Zealand citizens. 
Members of the public will make their own judgment as to whether or not this Minister and her department can be trusted with the information of our most vulnerable citizens. But this Opposition will continue to hold that Government to account for what is clearly a systemic issue and a massive massive failure.