Bennett Paula: Urgent Debates — Social Development Ministry—Security of Private Information 
Text is incorporated into the Bound Volume 
Bennett Paula: Urgent Debates — Social Development Ministry—Security of Private Information 
[Sitting date: 16 October 2012. Volume:684;Page:5816. Text is incorporated into the Bound Volume.] 
Hon PAULA BENNETT (Minister for Social Development) 
: 
 The public deserves to have full confidence that Government systems are robust and secure. We should all be able to trust that any personal information will not be revealed by human or systems error and that that information should not be accessible by any unauthorised person. From what we have learnt over the past 48 hours it is clear that the Ministry of Social Development has breached that public trust. I cannot and I will not make excuses. An independent review has been called and that needs to be given its due process so that we have all of the facts on the table. But I want to say to this House and to the public that it is not acceptable. It is being taken very seriously by this Government by the chief executive by the extended Government. I have received an apology from the chief executive and I certainly have passed that on to all of New Zealand. 
The members opposite are calling out. I am not sure whether everyone can hear them out there but I think that while we are going through the independent review I will give them some of the background on the kiosks themselves and on how long computers have been in Work and Income and members might want to note that that goes right back to the late 1990s. So I think we had better be careful as to where we jump to conclusions in terms of where some of it has actually been set up. 
There has also been a lot of misinformation and I know that a lot of people out there are worried about what has been accessed. There are few things that I think need to be set in balance. Core systems were not breached so people’s individual files as such were not accessible for the public or for anyone who was accessing that system. As the member who spoke before me Jacinda Ardern identified though a high level of personal information was accessed because of the four servers that were attached to the kiosks as such or the computers there. Of those four three were inaccessible and they could not get access to the information I am told to believe but with one of them they could. I also want to make it really clear that they could not stand in the Work and Income office and read that information onscreen. What they had to do was download it as the blogger did then take it home and convert it into a readable file. So they were not standing in a Work and Income office as such and looking at it—he converted it down and then had to take it and convert it into a file that was readable. That is the information I have had to date. 
I just want to reiterate—because we have been getting a little bit of that kind of concern as you can imagine—that at no stage was anyone able to go into the Social Welfare Information for Tomorrow Today (SWIFTT) or Cyras systems which is where we run Child Youth and Family. They are quite separate. They are password protected so only staff can access them and actually the staff have different levels of access to the information within that system as well. So the blogger was not able to do that. 
I am extremely disappointed and I do not think that this is acceptable in any way shape or form. I am going to be as upfront and as transparent as possible and I will put as much information out there as I can as we work our way through this process. I am happy to answer any questions as I can while also having respect for the processes as we go through the independent review. So just bear with me. It came to my attention on Sunday evening that the blogger had contacted a media outlet saying he had managed to get into the Work and Income systems via the kiosks. At that point I was told that all systems were going to be shut down so that there could be no further access to them so that access was not possible. The first I knew of it being the actual kiosks was at 5.46 on Sunday evening. Then as more staff worked overnight on the issue I was formally briefed when I got to Wellington about 10 o’clock on Monday morning. I think the department’s immediate response to this situation was absolutely appropriate. It took the situation very seriously and moved swiftly to contain what is very obviously a serious security flaw. We demanded answers from the department and we got a few but I think not enough to satisfy the public and certainly not enough to satisfy me. That is why the chief executive has called an independent inquiry which is going to be run by Deloitte. It is important that the investigation got under way immediately so it has already started. We should see the results of that within 2 weeks but the further results are going wider into the second phase of what should be this review. It will take more time and I think we need to do a scoping expedition first to then give the House a real time line on when we will get that back. 
What did come to light last night was that a report was done in April 2011 and from what I have seen of the report it identifies this flaw in the system. What I cannot get answers on and what I am asking the independent review to look at is why how and when it was acted on—so if it was not acted on why was it not and if it was acted on what has since gone wrong and made the information yet again available. So we are looking backwards and that will all be investigated. When we discovered that the chief executive and I wanted to put that out in a statement this morning so that we are quite clear on what we do know and what we do not know. It is been only about 36 hours now but at that stage it had been only about 24. 
I want to give some information about the kiosks themselves because I do think this is important. What they are effectively obviously are computers that people can go into. They predominantly use them to write CVs to update their CVs and to job search. So they access the internet and from that they also access Microsoft Word which is predominantly what they use to do their CVs on. Actually computers have been available to the public through Work and Income since the late 1990s. The only difference now is that we have put them throughout the offices. Technology has caught up a little bit and they look different because there is a stand that you stand at. But actually if you wanted to use that term they have been around since the late 1990s. In those early years technology was obviously different but the computers were more used for typing CVs. Over time Labour when in Government moved them more front of house so they were more easily accessible to the public. Beneficiaries were able to go in and search for jobs. They had been able to do that for years. Some were done in seminars. Most of them were able to go in separately. If you go to different Work and Income offices you will see that some of them are in a room attached and some of them are in the main body of the building where people also go for benefit advice and income. 
 This is what happened in July 2010. As I say the kiosks themselves effectively are a stand that has the computer in it and the computers have been there for some time. We rented out the kiosks which would be more front of line which means that we were having people more self-servicing rather than using up all of the time going to case managers—they could actually access it themselves. In July 2010 they were trialled in six sites and in April the ministry made a business case and made the decision to roll them out. They have rolled out more than 700 I think from memory. So 730 have been rolled out across the country but that just means we have replaced in many places the computers that are there and have put them in the stands of the kiosks. 
The Ministry of Social Development has around 1500 servers. What were visible were five of these and as I have said no core systems were compromised but I do not want to undermine that a totally unacceptable amount of personal information was available from the server that he could access. As I say that one server very much failed to have the protections that it should have. As a consequence all the servers are being looked at. We are checking all of our information and we are making sure that we know where it is and what is happening. As I said we will work our way through a process here. I cannot change what has happened and I cannot look backwards. All I can do is assure the public that I am taking it very seriously and putting the checks and balances in place so that we can make sure that we have people knowing what is happening. I can give assurances that our review will be robust that it will be transparent and that there will be a change. 
I will briefly touch on a couple of things that Ms Ardern raised in her speech. One was about Mr Bailey. The information that I have is that he contacted the ministry on Monday 8 October and he received an answer within a day and a half and he got a phone call back. As an aside there has been this kind of innuendo that she makes that my staff members were looking into him. It would be quite common for someone to google someone whose name came up. In fact he looked at her LinkedIn file as well so I suppose it is quite a common way of looking at each other’s social media. So perhaps the member could give it a go herself. [ 
Interruption 
] Exactly it is hardly the scoop of the day is it? It is quite interesting that the members over there think that it has been leaked and everything else where I think in fact we need to concentrate on what the issues are that are most important here. That is that people’s personal information was unacceptably contacted. They should not have had access to that level of information and that is the fact. I can see Lianne Dalziel yelling out over— 
Hon Lianne Dalziel 
: You should offer your resignation. 
Hon PAULA BENNETT 
: Well should we talk about who should give their resignation? That member had to when she lied in unison which was the actual reality of it so I suppose she has personal experience of what that means to lie but I have not. I have been absolutely factual with this House and that is where it sits. I can understand her anger but she needs to calm down and have a bit of a look in the mirror—have a bit of a look in the mirror—if that is where she wants to look. As I said I think this is unacceptable. [ 
Interruption 
] 
The ASSISTANT SPEAKER (H V Ross Robertson) 
: Order! 
Hon PAULA BENNETT 
: I am going to stand up and be counted for it and I think that is reasonable. We will make sure that we are getting to the bottom of this situation and ensure that the public know about it.