Clark DavidHon Dr DAVID CLARK (Minister for the Digital Economy and Communications): Mr Speaker thank you and I acknowledge the member Teanau Tuiono. Apologies to him. I was not trying to take his call. I had the wrong information in front of me and I do want to acknowledge his contribution. I also though do want to start with a few contributions relating to Melissa Lee's contribution in the debate earlier. The member seems to be confused about the difference between policy and operations and this is a confusion that she brings to this conversation every time I have engaged in a debate with her where she announces that it is my responsibility as the Minister for the digital economy to be responding to individual cyber-attacks. That's not quite as she would present it. The Minister for our intelligence services leads responses where they are matters of national concern and that is of course Minister Little. As we saw he led the debate today giving useful updates and information on the Waikato situation. So I just want to put that on the record for Melissa Lee just as she returns to this debate. The point of possible confusion arises because the Computer Emergency Response Team (CERT) agency which does have an operational angle and supplies information to smaller enterprises that may not be of a national scale does fall within my responsibility and so she will see that at times I will be answering on behalf of that agency or in relation to matters that it is concerned with which do have an operational aspect. So I'm just wanting to clarify that and make it clear and obviously the difference between policy and operations is made really clear in an example like the police where the Minister is responsible along with colleagues for setting the direction of the police but the police do the arresting. There is an important distinction there I think we could all agree. The member Melissa Lee also raised the issue of investment and again would have the House believe that this Government has not invested in cyber-security and of course that is plain wrong. We have to take one example invested 60 percent more—that's 60 percent more; six-zero—in the CERT agency that supports businesses and individuals who experience cyber-attacks and that's not a small investment. That's not to say that we won't need to invest more in coming years. The member highlights—rightly—the comments I made at select committee about the thousands and thousands and thousands of attacks that happen every day across the public sector and across the private sector in New Zealand and the real vulnerability. There's an article in the most recent edition of The Economist which highlights the rapidly escalating threat of ransomware and malware and other malicious uses of the internet and so we know very well that we will need to invest more in this area in the future. I think nothing could be clearer at this point. Now having said that of course what prevents these incidents from happening is often the most simple and fundamental things. We know that there will be an independent inquiry into the Waikato situation. The Minister of Health and the Minister responsible for the intelligence services Andrew Little has made clear that once the DHB's systems have been fully remediated there will be an independent inquiry to see what can be learnt to prevent cyber-security incidents like this happening in the future. So that is correct. We do want the Waikato DHB to be focused on making sure it is supporting those whose details have been leaked and that it is preserving private information in the situation it finds itself in and is focused on the outcomes for those patients both in terms of their wellbeing and their privacy as the first priority right now. But subsequently there will be a thorough and independent inquiry to learn for the whole system how we can approach these things better. We also know of course that there has been significant investment by this Government in health and in health infrastructure including as Minister Little highlighted the appropriation of $385 million in the most recent Budget to update IT systems across the health sector and those things are things which cannot be skipped over by Melissa Lee or anybody in this debate. We have found historical under-investment in many many areas in health and this is one more. This does present vulnerability and that is why this Government is investing in making sure that our systems are up to scratch. As Minister Little also highlighted no system is ever perfectly secure because in the next moment a new malicious actor may come on to the scene or a new vulnerability may be found in software or in anti-virus protections. The system that keeps those malicious actors from accessing private information needs to evolve and change and so patches are applied. It's very clear that many of our organisations are concerned about this and yet often are not acting as they could be or should be and that is something we want to see changed. Over half of the folk surveyed in a recent SearchNZ survey said that their organisation is concerned about cyber-security and 46 percent are trying to learn more about keeping their online businesses safe. Only 38 percent believed that their businesses adequately invested in cyber-security and just 34 percent believed their businesses had put a lot of thought and planning into being cyber-secure. Most concerningly under half—45 percent—have processes in place to prevent a cyber-attack. So these kinds of attacks are a real wake-up call to all of us across New Zealand both as individuals and as businesses and as institutions of a national significance across the country because often the way criminals find their way in is through suppliers of services at one level in a complex computer-integrated system through to a more significant asset further up the system. So that means it's all of us who carry responsibility. Now CERT as an agency which is often the public face of cyber-security publishes a list of 10 critical controls and I would encourage members and people watching at home to go to cert.govt.nz to dig out this list. It highlights that some of the most simple things are the things that are the best at preventing this kind of attack: patches on software systems multifactor authentication and verification—a large number of attacks where these simple things have not been done. Providing and using a password manager—giving people the tools to have a strong and unique password and configuring logging and alerting so that you can see who's in the system and doing what securing internet-exposed services where there are things that have drifted and are no longer used within a computer network so that those things are removed from the system if they present a vulnerability. Segmenting systems testing back-ups having back-ups ready to go immediately a problem is identified to replace a system thus reducing costs on the enterprise and protecting the data that is within that system if the system can be switched over to a back-up version very quickly and of course protecting from ransomware and the malicious effects of it and so on. There is a list of 10 cyber-security critical controls that can be put into place very easily. The Government of course is taking action across the board and we've been clear that we're going to join the Budapest Convention. We are involved in international cooperation on cyber-crime because these cyber-criminals generally act across borders and there's a focus for the cyber-security strategy including reporting and encouraging reporting of cyber-crime and improving sharing information about cyber-crime. We do want people to be very clear that they should not pay ransoms when ransomware is put on to a computer network. We know that those that do pay ransoms may well expose themselves to future attacks because they show then a vulnerability and a willingness to cooperate with criminals. They're likely to find their systems may be targeted again and there's no guarantee in any case that they'll get their data back if they pay a ransom. We also know that there are other things that people can be doing that I've covered that are really sensible and that are sensible steps and that can be easily accessed. So I want everybody watching this at home to think about whether they themselves are cyber-secure and have taken the steps that they can take to protect themselves from the vulnerabilities we're seeing around the world. Look I'm mindful that time is nearly elapsed and I'm wanting to just give people comfort at home that the Privacy Commissioner is doing the necessary work for the Waikato situation. We are aware that some information stolen from the DHB has made its way on to the internet and people are being supported—those staff and patients have been reached out to by the DHB. There will be a clear independent inquiry once the system is back on its feet to make sure we can learn the lessons from this particular incident.