Williamson Maurice: Urgent Debates — Social Development Ministry—Security of Private Information 
Text is incorporated into the Bound Volume 
Williamson Maurice: Urgent Debates — Social Development Ministry—Security of Private Information 
[Sitting date: 16 October 2012. Volume:684;Page:5827. Text is incorporated into the Bound Volume.] 
Hon MAURICE WILLIAMSON (Minister for Building and Construction) 
: 
 I can say I think with a reasonable amount of credibility that I am one of only a few members in this House who made my living developing computer systems before I came to Parliament. Yes it was actually prior to the internet coming to New Zealand. 
Hon Lianne Dalziel 
: I was going to say I thought you were a bit old. 
Hon MAURICE WILLIAMSON 
: Even so there were communication systems on the airline system that allowed people to hack into the mainframes of stuff we developed. Whenever an issue like this occurs I think the Minister has in the words of that great Led Zeppelin song “two paths you can go by”. You can either try to hide obfuscate the issue justify what happened and so on or you can do what I think Minister Bennett has done absolutely admirably and that is to be open admit there is a serious issue actually move heaven and earth to try to identify what the issue is and fix the matter urgently. I want to say to the member Chris Hipkins who has just finished his speech that his facts were wrong. Yes Minister Bennett on Monday was alerted that there was a risk to information. But that alert did not say where it was or what it was but just that it was an unknown risk that needed some identification. 
Chris Hipkins 
: But what did she do? 
Hon MAURICE WILLIAMSON 
: The member has just now played beautifully into my hands because the Minister got KPMG to start trolling through the Ministry of Social Development’s systems to find what it was that could be the risk and where it could lie. I am told that KPMG did not come back to the Minister until Sunday identifying that it was the kiosks. For that member to be standing in this House today and saying that the Minister knew back on Monday and let a whole week of all this exposure go on without her doing anything is just factually incorrect. What the Minister did was to get KPMG immediately. It can happen to any one of us. Just about every Minister in the Government has departments that have information held on their departments’ computers. 
 God knows on 5 March next year Statistics New Zealand one of my ministries will collect incredible information in the census about individuals. I have gone out of my way to ensure that that stuff will be protected and kept safe and that no individual records will be made available. But Minister Bennett did exactly what she should do. And I want to say to members on the other side of this House that it is quite possible that these sorts of security breaches occurred while they were Ministers. It is quite possible that people would have been into the systems and seen information but it did not quite get to be as exposed in those days because there were not things like bloggers around who felt it was really neat to get some coverage for blogging that stuff. 
Hon Trevor Mallard 
: When we were Ministers? 
Hon MAURICE WILLIAMSON 
: Yes. Blogging came into fashion only just towards the end of the Labour Government. Blogging has been around only 4 or 5 years now. It was not around in the early 2000s. I want to remind this House that we did not even have the internet in New Zealand 20 years ago. It came in only in 1993 and we are in 2012. So it is not yet 20 years for the internet. 
So Minister Bennett did exactly the right thing. When you come to be the Opposition there are again two paths you can go by. You can start screaming and yelling and blaming the Minister because she allowed a security breach in a computer system or you can actually demand that she take action to identify what the issues were to make sure they are being fixed immediately and that any security holes in the system are being closed off and to identify a regime that will prevent any such failures in the future. And again I believe that is what Minister Bennett has done beautifully. She has actually gone in to identify what matters are at risk in the system and so on. If it is any member of this House’s advocacy that the Minister should know there is a security hole in some hardware/software networking then I tell you that you are wrong. I tell you that you are wrong because I can tell you that it occurs even at the highest echelons of information technology—for example Microsoft probably the world’s biggest developer of information technology systems has every now and then had to put out an announcement that it found a security hole in its Internet Explorer or it found a pinhole in the back of some internet protocol of one particular product and it has had to put out a fix otherwise people would be able to breach the firewalls and breach the internet protocol and so on. So to any member of this House prepared to get up and say that Minister Bennett should have somehow been crawling underneath the computers pulling out all the internet cables and the ethernet plugs and checking the IP addresses and what protection there was I say that what Minister Bennett had to do was rely on her department giving her an assurance that when it brings a system into the market place like it did it puts those protections in place. 
But these sorts of things can and will happen again. They will happen even when there is another Government in this country in years to come as more and more information gets put online as more and more sophisticated systems are out there and as more and more sophisticated hackers find ways to go through some form of a click-box server in the Ukraine come back via a pinhole in the firewall somewhere and pick up stuff. What does that mean? Well we could actually shut up shop and not put any information on the internet at all. We could go back to parchment and quill pens and go back to the old days and I am sure there are some people around who think we should do that. But the rest of the world is moving on to putting its information on to information systems where they have phenomenal value where people can go and read stuff and so on. But having said all that there will always be risks. I hear I think it was Chris Hipkins say that we should have got the Government Communications Security Bureau in but even the Government Communications Security Bureau will not be able to identify every hole in every piece of software wherever. Only when that hole or that security risk is found should the actual Minister the department the computer people KPMG and whoever else move heaven and earth to fix it and that is what has gone on here. I actually ask all members of this House especially from the Opposition to be a bit careful about what they are advocating. I am happy for them to advocate that Ministers should step up to the mark and demand to find out how this happened. I am happy that she steps up to the mark and demands that immediate action is taken to close off the loop in it. I am happy that she demands— 
Hon Lianne Dalziel 
: Leadership on privacy! 
Hon MAURICE WILLIAMSON 
: I am hearing something from Lianne Dalziel about privacy. Paula Bennett like every other member of this House believes truly in the need for privacy for individuals. No one in this House wants privacy breaches of information to be out. This was a failure of an information technology system. I look at stuff that I have rolled out of my ministry. I look at things like SmartGate and the taking of photos as you come through customs and whether there may be a breach in that. I have asked and asked I have been assured and I have gone and had a look at it and I am quite confident that there is not. But if anyone ever identifies a breach in that I can assure you that like Paula Bennett I will move heaven and earth to close down the risks to shut down that system and reopen it only when I am confident that we have found that particular bug. 
But I finish as I began: big issues can occur even across the most sophisticated developers in the world and huge companies with billions of resources have identified those risks. Well the Ministry of Social Development got this wrong Paula Bennett has said so and Paula Bennett is fixing it. I think we should be very proud to have a Minister of her calibre. 
The debate having concluded the motion lapsed.