Curran Clare: Questions for Oral Answer — Questions to MinistersText is incorporated into the Bound VolumeCurran Clare: Questions for Oral Answer — Questions to Ministers[Sitting date: 10 April 2013. Volume:689;Page:9209. Text is incorporated into the Bound Volume.]9.CLARE CURRAN (Labour—Dunedin South) to theMinister of Justice: Was an outside person able to gain access to Ministry of Justice data which showed plain text passwords to a secure database and a payment gateway?Hon JUDITH COLLINS (Minister of Justice): A hacker was able to view a configuration page on the Private Security Personnel Licensing Authority website a view that included two passwords. The passwords were completely unusable by that hacker and could not provide an outside person access to any private information. The website access is isolated and there are layers of protection that control access to other ministry systems. There was no privacy breach. No private or financial information was able to be accessed. This is not a member of the public inadvertently finding information. It would require some very deliberate action by people with very good IT skills.Clare Curran: Did the Ministry of Justice shut down parts of its website due to security concerns yesterday?Hon JUDITH COLLINS: Yes the ministry did in fact take the Private Security Personnel Licensing Authority website off-line while it checked the member’s assertions that she provided to me and the ministry yesterday. I also understand that there was quite a large amount of Twitter conversation between her and the hackers over the weekend.Clare Curran: Can she rule out—[Interruption]Mr SPEAKER: Order! I have called Clare Curran and she will be given the opportunity to ask her supplementary question.Clare Curran: Can she rule out categorically that there was a breach of privacy as a result of the security holes in the Ministry of Justice website that were identified yesterday?Hon JUDITH COLLINS: That is the information I have and I think that that also concurs with the information that the member sent to me yesterday.Alfred Ngaro: What assurance can she give New Zealanders that the Ministry of Justice website is secure and that personal and private information is not at risk?Hon JUDITH COLLINS: When the site in question was built in 2011 it was tested by external IT security experts and was found to be secure. At the end of 2012 the platform the site is on was also tested by external IT security experts and was found to be secure. As a precaution the ministry has shut down the site to ensure that it knows precisely what these external hackers have done and to ensure that any identified weakness is fixed. External experts have also been engaged to check the site to ensure it is secure.Clare Curran: Will she carry out an independent security review to ensure that the ministry’s systems are all patched to the most recent secure versions and to ensure that there are no other gaping holes such as the one identified yesterday?Hon JUDITH COLLINS: There was no gaping hole. However if the member had bothered to listen to the answer that I have just given our colleague Mr Ngaro she would have heard that in fact external experts have again been engaged to check. And I wish she would not come down here with these pre-prepared questions and listen to the answers that she is given.Clare Curran: Supplementary—[Interruption]Mr SPEAKER: Order! I cannot hear the member because of the noise coming from her own colleagues.Clare Curran: Has she her office or her ministry been in contact with the whistleblower who has made their contact details available to her and who did the right thing by bringing this serious security hole to the attention of the Government and the public; if not why not?Hon JUDITH COLLINS: The ministry and I do not deal with hackers and we do not deal with burglars.Clare Curran: Point of order. [Interruption]Mr SPEAKER: Order! I think I have a point of order is it?Clare Curran: Point of order.Mr SPEAKER: Point of order—and it will be heard in silence.Clare Curran: I seek leave to table a letter from the Minister to me yesterday afternoon received at 12.34 p.m. noting my advice that I was willing to produce to the ministry the details of person X.Mr SPEAKER: Leave is sought to table that letter. Is there any objection? There appears to be none. It can be tabled.Document by leave laid on the Table of the House.Clare Curran: I seek leave to table an email from me to the Minister providing those details.Mr SPEAKER: Leave is sought to table the email from the member to the Minister. Are there any objections? There appears to be none. It can be tabled.Document by leave laid on the Table of the House.Clare Curran: I seek leave to table a redacted version of the screenshot of the unprotected page of data provided to me by a whistleblower who accessed a secure part of the Ministry of Justice website by clicking a publicly available link.Mr SPEAKER: I think we have got enough information. Is there any objection to that being tabled? Yes there is.