Reti ShaneDr SHANE RETI (National—Whangarei): Three thousand two hundred stolen user names and passwords—that's what David Clark has kept quiet. David Clark has quite simply put out the welcome mat to hackers and said Come on in. The door is open." When they come in what are they going to do? They're going to destroy our health system and they're going to take patient data. I need to tell this story but first let's set the background. It's a background with this Minister of decreasing cyber-competence and increasing cyber-risk. Earlier this year I revealed that Lakes District Health Board had been under cyber-attack 2 million times per day and poor Bay of Plenty District Health Board had been under cyber-attack 1 million times per day from Russia and the Ukraine. This Minister knew nothing about this. He simply doesn't care about cyber-security. So that's 3200 stolen user names and passwords associated with 60 New Zealand health organisations—why didn't the Minister tell us this? Well on 19 December last year on his watch he received a memo from the Ministry of Health and the purpose to this memo was "to brief you on the possibility that up to 60 organisations within the New Zealand health and disability sector may have been or may still be at risk due to the exposure of leaked credentials on the internet." So what happened? Well at the end of last year 1.4 billion stolen user names and passwords were put on the dark web. The Ministry of Health became aware of this and made a search through it to look at what New Zealand organisations might be involved particularly in the health space. They determined that there were 3200 New Zealand user names and passwords belonging to 60 health organisations in New Zealand. Denise Lee: That's a lot.Dr SHANE RETI: That's a big number I agree. They quantified the risk and they said this: "Within this context the primary risks facing the ministry are a malicious actor accessing online services and impersonating a member of the MOH staff." They talked about mitigating the risk. They said "For a large amount of what we do it's OK because we have two-factor authentication. However there are four national programmes that we have that are public facing that do not have two-factor authentication." That includes the Pay Equity web portal and the In-Between Travel web portal to name some of them. The risk here is obvious. Two-factor authentication is something you have and something you know. It's a standard security measure. Something you have: you have a cellphone; something you know: a password—a very important security measure. In fact this month in Cyber Smart Week the Government very correctly said that there are four important cyber-measures and one of them is two-factor authentication. So here we are—last year we had these four Ministry of Health servers that do not have two-factor authentication. They are at risk with these stolen credentials. Let's jump forward a year. Have they been fixed because we'd sort of hope having pointed them out that they'd be fixed. Well I asked the Minister these questions and in fact there is no evidence at all that any of those four servers have been fixed. It's actually worse than that. There are actually 10 times more systems now—a year later—under David Clark that do not have two-factor authentication. A written question asked him "Minister Clark. How many sector and internet facing IT services does the Ministry of Health operate that do not require two-factor authentication?" What he said was "I am advised that the Ministry of Health operates 39 IT Services that do not require two-factor authentication." A year later he doesn't get it. He doesn't get that we can be attacked by air land sea and cyber and he's putting New Zealand data at risk.Why are there nearly 10 times more publicly facing IT programmes that are not controlled? How many of the stolen credentials were used to hack New Zealanders' data? I think these are reasonable questions for the ministry to ask. And why does the Government-recommended two-factor authentication not apply to David Clark? Why does it not apply to the Ministry of Health? It applies to the rest of us; why does it not apply to him? Here are the actions we need: we need him to fix two-factor authentication on those 39 public-facing programmes we need him to reassure Pay Equity users and In-Between Travel users that their data has not been hacked and we urgently need to review cyber security across the health sector and David Clark and his ministry are not the people to do it quite clearly. CERT NZ are well-qualified. They should take this task up. Shame on you David Clark. You're getting worse and not better. You're putting us at risk. Thank you Mr Speaker."