4. Question No. 4—Arts Culture and HeritageHon NICKY WAGNER (National) to the Minister for Arts Culture and HeritageQuestion No. 4—Arts Culture and Heritage4. Hon NICKY WAGNER (National) to the Minister for Arts Culture and Heritage: Does she stand by all her policies statements and actions around cybersecurity and the Tuia 250 data breach?Rt Hon JACINDA ARDERN (Minister for Arts Culture and Heritage): Yes including my statement that what has occurred here is very disappointing" and my endorsement of the work that the ministry is doing to establish how this occurred via the Tuia website.Hon Nicky Wagner: Did she seek assurances that private information held by the ministry would be kept safe?Rt Hon JACINDA ARDERN: Forgive me for a moment if I speak to the different delegations that do exist here. The website in question for Tuia was commissioned I believe in February of 2019. So as the member will probably already know it was not developed by the Ministry for Culture and Heritage; it was contracted to be delivered by a private provider. That was done in February. Some months later the additional requirement for them to be part of the process of recruiting individuals to be part of the flotilla around the country was added thereafter. The ministry is now looking at whether or not—Hon Gerry Brownlee: Unbelievable.Rt Hon JACINDA ARDERN: If the member doesn't want detail on this then don't ask a question. The ministry is now looking at whether or not the contract was adequate around these issues. What I do want to point out is that I don't have the specific delegation for Tuia but I am responsible for the ministry as a whole but not to that level of detail.Hon Nicky Wagner: Did she seek assurances about the ministry's data security in general in light of the early release of the Budget information in May?Rt Hon JACINDA ARDERN: Yes. Again however I point out that this was not relevant to the ministry's own website and functions. It was a site contracted by a private provider that was specific for Tuia 250. It is not a Ministry for Culture and Heritage website. Dr Shane Reti: Were children's private cellphone numbers also part of the Tuia 250 data breach?Rt Hon JACINDA ARDERN: I can't speak specifically to the nature of some of the information. I will point out that the majority—of course we've already made public that it's involved licences passports and we consider it to be very very serious. What I would point out of course is that the profile yes has affected a portion who are under 18—the majority over 18—but again when it comes to the specifics around phone numbers I would say that would be a question relevant to the ministry itself.Dr Shane Reti: Did the breached data also include details for an alternative contact person; if so have all of these people also had their data breached?Rt Hon JACINDA ARDERN: I can't speak to what individual information was contained on every form. What I do know of course is that efforts were made by the Ministry for Culture and Heritage to bring in other Government departments over the weekend. They created a call centre to contact every individual involved and managed either to successfully speak personally to those involved or to have done so since through leaving call centre numbers to liaise directly. Where there has been data via ID like licences or passports they're offering support to renew those documents if they wish to have them cancelled. Of course this is a very serious situation; the ministry is taking it very seriously. It's not something that is being taken lightly at all in the action that's been taken.Hon Nicky Wagner: How far does her disappointment get us when the personal information of 302 young people is most probably now for sale on the dark web?Rt Hon JACINDA ARDERN: Seriously enough that our focus has been on those individuals and that is why the ministry moved very quickly to remove the website in question to liaise with Google to try and remove any indexed information and to contact them all individually and offer support to replace that information. The ministry is of course—as I am—incredibly disappointed by what has happened here but is doing what it can to remedy the situation as well.Hon Grant Robertson: Is this the first ever data breach of a Government agency in history?Rt Hon JACINDA ARDERN: I have to acknowledge that no it's not. We all have to lift our game. I'm reminded that in 2012—[Interruption] Again the members will remember that in 2012 the Ministry of Social Development (MSD) self-service kiosk allowed 7000 personal files of MSD clients to be accessed. We all have to do better and I'm sure that side of the House would well remember that.Hon Paula Bennett: In that 2012 MSD cybersecurity blunder did the Minister actually front with the chief executive and take responsibility and then know the details and ensure it never happened again?Rt Hon JACINDA ARDERN: I can't speak to what the member did personally at that time but I can say Mr Speaker that I would never weaponise people's personal information either.Hon Gerry Brownlee: Is that comment allowed to stand?SPEAKER: Well there was a comment that was drowned out by a barrage of noise from my left which I didn't hear well enough to rule out.Hon Gerry Brownlee: I raise a point of order Mr Speaker. Now Mr Speaker the physical contortions of your face would have led me to believe that you did hear it and it was an unacceptable statement and should be withdrawn.SPEAKER: Order! The member is going to start by withdrawing and apologising and then he will re-put his point of order.Hon Gerry Brownlee: I withdraw and apologise. There will be a Hansard record of what has just been said. It will I think based on your past rulings not meet the test of what should be an acceptable answer or comment in this House and I think it would be appropriate for the Prime Minister to withdraw the comment.Hon Chris Hipkins: The question from the former Minister asked the Prime Minister specifically to comment on the actions of the former Minister; therefore that gives the Prime Minister some licence to do so.Hon Gerry Brownlee: That would be fine if that was an absolute fact but it's not.Hon Simon Bridges: I raise a point of order Mr Speaker. SPEAKER: Speaking to this point of order the Hon Simon Bridges.Hon Simon Bridges: I want to ask you when you go back and watch the replay of today as you do to reflect on the Prime Minister's various comments over question time and whether it is in fact—SPEAKER: Order! [Interruption] No. Order! The member will resume his seat. I'm trying to deal with a specific case here—all right?Hon Simon Bridges: And I was adding to that.SPEAKER: Well no you weren't; you were talking about a general question.Hon Simon Bridges: I raise a point of order Mr Speaker. SPEAKER: As long as it's related to the point of order currently before the House and not a new one.Hon Simon Bridges: Yes it is Mr Speaker of course. The point of order that has been raised is in relation to the Prime Minister's words and I am asking you when you reflect on that after and watch the tape to go away and look at what she says and whether or not actually she is getting an easy ride.SPEAKER: Oh well I think I know what the member is trying to do and I'm not going to grant him his wish."