Curran Clare: Electronic Identity Verification Bill — In Committee 
Text is incorporated into the Bound Volume 
Curran Clare: Electronic Identity Verification Bill — In Committee 
[Sitting date: 13 November 2012. Volume:685;Page:6529. Text is incorporated into the Bound Volume.] 
CLARE CURRAN (Labour—Dunedin South) 
: 
 I would like to take a call in the Committee stage of this bill the Electronic Identity Verification Bill. Part 1 is talking about the principles that lie behind this bill and it is important to take a minute to think about what they are. They are about security of information they are about privacy of individuals’ information and they are also about having confidence in the system. 
As we have discussed in this House a number of times Labour supports this bill and we support the intent behind it. It is not a majorly controversial bill but what is controversial is the adequacy of information management systems in Government agencies—whether the public thinks that those systems are secure whether individuals’ information is actually kept private and whether there is public confidence in the system. I put to you today in this Committee that I do not think we can have any confidence right now that right across the Government agencies there are adequate systems in place to ensure that those principles are being upheld. 
The bill actually talks about secure channels of information for individuals using the internet it talks about accessing services from approved agencies and it talks about containing minimal personal information. I think in the current context all of those phrases should be ringing warning bells. I think one of my colleagues actually tweeted today in relation to the Government’s management of the economy and jobs and described it as an omnishambles which I thought was a very apt term. But I thought it was just as apt if not more apt in relation to this issue which is essentially about the adequacy and the security of individuals’—of citizens’—private information in Government agencies and how that is being accessed. 
That is what this bill is about so I think in terms of providing a recipe for confidence in the ability of the Government to deliver a secure verification service of any kind that today that is a bit of a joke. I wonder how the Government members can sit across there with straight faces and debate this bill while they have got enormous holes in IT systems—across at least four of their main agencies—that concern the privacy of New Zealanders’ information. I would also say that I think the confidence of the public in these systems has been shaken if not lost. 
In defence of the bill this service has been in place since December 2009—so it is not as if it is a completely new service that is being introduced—so that people can authenticate their identities and their interactions with the Department of Internal Affairs but in a very limited capacity. This bill is going to expand the availability of that service to all members of the public and allow more agencies to use the service to identify their clients and I think that is where the warning bells should currently be ringing until—until—it can be demonstrated that the public of New Zealand can be reassured that this system is going to provide the security that is required. That is why Labour introduced a member’s bill into the ballot last week titled the Electronic Data Safety Bill which goes to the very heart of this issue. 
I know that other colleagues are going to reference some of the other agencies that have been affected but recently as we all know a member of the public was able to download more than 7000 documents from the Ministry of Social Development’s network through the Work and Income self-service kiosks. Those documents included very sensitive information such as medical invoices about children in the care of Child Youth and Family personal information about people receiving benefits the names of people being investigated for benefit fraud the name of a person who had committed suicide and pay rates for individual contractors employed by the Ministry of Social Development. Those things are very serious. Previous breaches have occurred in other agencies. We know they have occurred in the Inland Revenue Department we know they have occurred in ACC and we know they are occurring currently in the Novopay system through the Ministry of Education. Previous breaches in other agencies have highlighted the need for a systematic inquiry into the adequacy of information management systems in all Government agencies which is what this bill seeks to address. 
So by all means let us put this bill through the House but before we do that let us have a bit of a look at the adequacy of information management systems across all Government agencies so that the people of New Zealand can be reassured. Let us put in place and make sure that there is an adequate system for information management across all Government agencies that they have robust protocols that they are resourced adequately with the correct level of skills and that that management system has a governance that transcends the individual agencies and then let us look at bringing this particular bill through the House. 
I would say that the big issue for us to be discussing right now is the culture. This is a culture issue around privacy and security in the Government agencies. It is the responsibility of the Government to ensure that that culture is the right culture to ensure that the privacy and security of information can be assured. That is what needs to be changed within the public sector if we are going to stop these sorts of things happening. 
Just going back to the Ministry of Social Development kiosk debacle the thing is that we know that the report showed that the issue was known about back in 2009 and that people were reminded a number of times about it. The report that was commissioned was good but we need to be assured that the ministry is actually going to take note of all the recommendations that have been made and of all the security-related issues that have been identified. The issues that were identified in 2009 were paid lip-service to essentially. They still pressed ahead with the kiosks. They called the network issues an acceptable risk. But if there was proper IT governance and accountability it just simply would not have happened. That accountability and governance need to happen at the highest possible levels. The project should not have progressed until it had been signed off by somebody senior who was an accountable professional and who could make damn sure there was a proper elevation structure in place that did not proceed with those issues unresolved. That is what the problem is. 
If we are looking at introducing and widening another system which is what we are debating today then where is the accountability on it and where is the accountability on the other side of the House around all of these issues at the highest possible level not just in one agency but across all of those agencies? It has been put to me by the industry that as with every other profession and vocation there is professional accountability. It is imperative that the Government is involved in ensuring that there is a minimum level of experience education and ethics for senior professionals who are in a position to sign off major projects and then holds them professionally accountable for those standards in the same way as in every other field. 
I would like to put it to you today that although this bill is supported by Labour it is raising warning bells again around another system that is being put in place without the appropriate measures behind the system that is being widened. In at least four major agencies across this Government there are serious systemic problems and they need to be addressed.