Hipkins Chris: Urgent Debates — Social Development Ministry—Security of Private Information 
Text is incorporated into the Bound Volume 
Hipkins Chris: Urgent Debates — Social Development Ministry—Security of Private Information 
[Sitting date: 16 October 2012. Volume:684;Page:5825. Text is incorporated into the Bound Volume.] 
CHRIS HIPKINS (Labour—Rimutaka) 
: 
 The very last sentence that the member who just spoke Peseta Sam Lotu-Iiga said was absolutely true. This is about the confidence and trust New Zealanders can have in their Government. There are some questions that all New Zealanders will be asking around this release of private information. How did it happen? Who knew or should have known about the situation? When did they find out and when they found out what did they do about it? Those are very legitimate and reasonable questions for every New Zealander to be asking. 
So how did this happen? It actually starts back in 2009. There is a paper trail that starts back in 2009 when Bill English wrote to Ministers in the incoming National Government and asked them what they were going to be doing to save money. One of the questions that he asked them was around what they were doing with regard to staff numbers. Of course let us consider that in context. The context is that at the time the unemployment rate was going up the economy was in a downward spiral and there was clearly going to be more demand on Work and Income staff to provide front-line services. 
 What was Paula Bennett’s response to that? Paula Bennett’s response to that was to say—and I am quoting directly from a paper that Paula Bennett has signed off—that “Whilst the Ministry has a strong focus on reducing its national office numbers there are also substantial plans to automate frontline services for clients through the use of online and other IT solutions.” i.e. the kiosks in the office. She stated: “I will be monitoring the progress of these plans regularly with the Ministry’s Chief Executive.” So how did this begin? How did those kiosks come to be in the Work and Income offices in the first place? The Minister made a conscious decision in the context of rising unemployment that rather than employ more people at the Ministry of Social Development to deal with that challenge and to provide support to the people who were going to be coming into the Ministry of Social Development and into Work and Income offices she decided that she would put computer terminals in the offices instead. It was a conscious decision by the Minister that resulted in this problem. 
Who knew or should have known is the next question that we then come to. Who knew or should have known? Should the Minister have known about this? When they decided to implement this IT solution by putting kiosks in the front-line offices with access to databases did the Government Communications Security Bureau get asked about that and did it provide advice to the Government? If it did not why not? That is actually its job. That is what the bureau is there for. Members of this House all have electronic devices that have restraints placed on them by Parliament on the advice the Government Communications Security Bureau. This is its job. It proactively goes in looks at the IT systems of Government departments and places requirements and restrictions on the use of those IT systems. So when it did this when the Government decided on Paula Bennett’s direction—it is in her letter here—that it was going to put kiosks in Work and Income’s offices rather than employing staff to deal with people and to allow people access to its IT system did it get the bureau involved and did it check to make sure that its system was going to be robust? If it did not then Paula Bennett has some serious questions to answer about that because she is the Minister responsible and this system was implemented under her direction. It was her initiative. She is responsible for it. 
The next question then becomes “When did they find out?”. Taking aside how we got here when did they find out and what did they do about it? The kiosks were rolled out in 2010 and they were told in April last year that there were potential vulnerabilities within the system. So the question is what happened then? What happened then? When the Government found out there were potential vulnerabilities in the system what happened then? That was April last year—that is a year and half ago—so why is it that this problem was not identified and fixed at the time? Beneficiary advocates reportedly told the Ministry of Social Development 1 year ago that there were issues with this problem. Again why was it not looked into at the time? Why was it not fixed at the time? 
On Monday last week the Ministry of Social Development became aware of the problem—on Monday last week. It took it until Wednesday to tell the Minister that there was this problem. That is a problem in itself. Taking 2 days to tell the Minister that there had been a serious breach of privacy is not good enough. That is the first problem. So Paula Bennett found out on Wednesday. It was Sunday when a blogger released all of the information online before it became public. I want to know what Paula Bennett was doing for the 4 days in between. What did Paula Bennett do last Wednesday when she found out about this and why was it that people could still access that on Sunday? That is simply not good enough and the public of New Zealand should be able to expect better from Ministers in this Government. 
What did Paula Bennett do? Did she have her officials into her office straight away to find out what was going on? Did she contact the Government Communications Security Bureau at that point knowing that this is the bureau’s fundamental job? Did she contact it at that point? I will tell you what: if Ministers find out that their departments’ databases containing private information about New Zealand residents and New Zealand citizens have been accessed inappropriately and they do not immediately require some action to investigate what is going on and to make sure the problem is shut down then they are negligent. They are totally and utterly negligent. Paula Bennett found out about this on Wednesday—last Wednesday. Yet Sunday when it became clear on the blogs was the first the public knew about it—late on Sunday night. Paula Bennett had that information for 4 days and what did she do? What inquiries did she launch? What steps did she take to make sure that databases were shut down or sealed off until she knew that they were secure? Four days is a long time. A hell of a lot of information can be accessed in that time and a heck of a lot of damage can be done in that time—4 days. 
It is now over a week since the Ministry of Social Development found out about this situation and we are debating it in Parliament the public having found out about it only yesterday a week after the ministry was first informed about it. Why is that? Why did it take a week before the public found out about it? In that week were any of the people whose information was accessed informed that their information had been accessed? If information for example was accessed—and I am only going on reports here—about children living in safe houses what steps were taken as soon as the Government knew that that information had been accessed? What steps were taken to protect those people? 
These are legitimate questions that the Government must front up and provide answers for. This is not good enough. This is a serious breach a release of information involving some very vulnerable people and for the Government to take a week to reveal that to the public is simply not good enough. For the Minister to sit on this information for 4 days is simply not good enough. The public is entitled to expect better. 
To come back to the very first point that I made and to pick up Sam Lotu-Iiga’s point this is about trust and confidence in the Government and if its handling of this situation is any guide to go by the public cannot have any. They cannot have any trust and confidence that the Government will take their private and personal information treat it carefully and responsibly and make sure that it is not released for purposes that it was not collected for. Trust and confidence in the Government will be seriously eroded by this not just by the fact that it happened not just by the fact that it happened because of Budget funding cuts not just because the Government sat on it when it found out about it but because the Government when it did find out about did not do what it should have done. It has been negligent and the Minister has been negligent in her handling of this situation—full stop.