van Velden BrookeBROOKE VAN VELDEN (ACT): Thank you Mr Speaker. I move That the House take note of a matter of urgent public importance. Today we learnt that significant personal information is now available on the dark web. The information I'm referring to is coming from the ransomware cyber-attack that hit the Waikato DHB six weeks ago. The information that can be found on the dark web is patient files correspondence and financial information. This is of a huge concern not only to those people who may be affected but to all New Zealanders who expect a high degree of privacy when it comes to their own personal information and especially when that information is held by Government departments. This is an ongoing incident that has been occurring for six weeks and it has been labelled as the biggest cyber-attack in New Zealand history." At the first point of the cyber-attack the Waikato DHB went down. People who had serious cancer scares people who are undergoing radiation therapy have had to have their treatment moved across New Zealand from the Waikato to Wellington and Tauranga. That is of huge concern not only to those patients who are undergoing serious treatment but to their whole care for their whānau and their family who immediately needed to move from their towns from the care and wraparound support that they had to a new town to receive their care. But it also is of a huge concern to those near-400000 New Zealanders who reside in the Waikato whose information could be at risk and found now online when they never thought it would. So my thoughts firstly go to those people who have been affected—to those people who are undergoing therapy in areas where their family can't reach out and provide that wraparound support when they thought they could in their moments of vulnerability to those people whose information has been breached. This harm is going to be ongoing for a lot of people.I think we need to ask "What is it the Government has been doing and what should they be doing?" I want to recognise that the Government has put in place a dedicated response team to find out more information about how this cyber-attack was able to happen. The Ministry of Health has also put in place a dedicated response team to see what they could do to improve. But I think we all need to ask the question "Is there more that the Government could have been doing?" The answer is simply "Yes."In 2020 we had a review into the district health boards and we looked into their assets. There were some striking points of information that we need to take more note of. It said that the DHBs were lacking vital IT infrastructure networks and security. We had "outdated" "not adequate … to manage increased cyber security issues." We also had "significant risks to services from a lack of system capacity and resilience." This should be of huge importance to all New Zealanders to know that our DHB's assets were inadequate.On 30 May the Ministry of Health reportedly abandoned an effort to secure DHB computer system upgrades citing budget constraints. Now the Government also has failed to follow through on its cyber-security strategy. We were supposed to have annual reports on our cyber-security in New Zealand so that we could protect ourselves from cyber-security breaches but once again these didn't happen because of cited budget constraints. So what are the Government's priorities when it came to the Budget? The Budget constraints did not stop many many stupid projects over these last few years where it could have been prioritising cyber-security. If you think of the $3 billion that we spent on the Provincial Growth Fund that $3 billion could have helped these budget constraints for the DHBs for their cyber-security. You know we've put aside a billion dollars for light rail—which everybody knows is going to be a failure—when that money could have gone to cyber-security to protect New Zealanders' vital private information.We've also had the Government prioritise billions of dollars for "fees-free" which they themselves admit is a failure. That money could have gone to protect New Zealanders' private information. Think about all of those things that we could have put aside to fund this vital infrastructure. Now of course we have the Minister of Health acknowledging that there are problems with our health system and so we've got a health system reform under way and we've put aside millions to do that but we're going and turning up the whole system without asking that question of "How do we make sure that we get the basics right first?" We need to be looking at cyber-security infrastructure technology making sure that our private information held by Government departments is kept secure.We knew that this could have happened—cyber-security isn't new. Threats have been happening for years now and increasing but the Government didn't prioritise our needs as New Zealanders. There have been a range of breaches when it comes to cyber-security where the Government has failed. We had a Reserve Bank breach not that long ago; we're still looking for more information about what the outcome was on that inquiry. We had the NZX go down in February; we still are looking for more information on what happened there and what the Government's response will be. This type of crime is increasing and I want to make this very clear: this is not something that's come out of the blue: cyber-security threats are increasing around the world not just in New Zealand. We've been seeing this happening in Ireland—their health system went down this year too. We need to make sure that we don't erode the trust in Government by not putting in place the priorities that vital infrastructure that we need to make sure that our information is secure. Because if you look at a range of priorities that this Government has decided to spend time on this will be of a huge concern to those people. One example that springs to mind are people who have been told that their private information will be kept on a firearms register because they have access to firearms. Think of that security threat to those people to think that the New Zealand Government and our health system can't keep our health information secure when the Government is asking for more access from other people's information. We need to know—we need that assurance that our information is to be kept private for our own security reasons.It's also not good for business confidence. Why would you bring your business here when you know that the Government might not have your back when it comes to cyber-security? You know there are so many aspects of our society that fail when things go down; it can't be that we can have an entire DHB that's set aside to create health systems for an entire population of New Zealand go down. What would happen if our infrastructure—our transport sector—went down and they had a cyber-security attack? We've seen it with the Reserve Bank we've seen it with the NZX—it could be that a whole range of our other Government agencies go down because of a cyber-attack. We need to know that the Government is prioritising this area.So it raises the question of "Well what could we actually do better?" We need to be making sure that if we are having a cyber-security strategy we're actually reporting on it. The ACT Party would start by making sure that we're actually writing the annual reports that this Government says it would. We need to be making sure that we're having a culture of openness and transparency when it comes to the inquiry into how this happened and what we could do better. We need to know as New Zealanders that access to that information is made publicly available so other businesses entities other areas that work in New Zealand know what went wrong and how they can protect themselves. Because this doesn't just happen to Government agencies it happens to small businesses and some of our large corporates too. We need to know why they were targeted how they were targeted and how we can keep our other New Zealand businesses safe.We as the ACT Party believe that we need to have a better IT strategy in New Zealand in particular for our health system. Our priority there in the health space is making sure that we have a national integrated IT strategy where we are actually having a focus on keeping information safe. So we would tender out to the experts to people who have expertise in the area of cyber-security and keeping large documents and files of information private. In asking them to do those jobs for us making sure that we're setting robust performance standards including on security issues this is how we should be looking as a country—not putting in place priorities for spending billions of dollars where we don't need to but getting right back to those basics so that New Zealanders know that their information is safe that they can go about having access to healthcare systems when they need them that they're not going to go down. Knowing that we are keeping their information secure but we're looking after them first. Thank you."