Reti Shane; Dean JacquiDr SHANE RETI (Deputy Leader—National): Thank you Madam Speaker. It is very disappointing to find ourselves in this situation. Without doubt we can do better with cyber-security. I'm very concerned that it's been in this Government's hands that we've had some of the biggest cyber-security breaches ever. In fact part of the problem probably lies right at the very top because it turns out the Prime Minister has data breached more young people's data than any other Minister in the past 10 years. It was called Tuia 250—the Prime Minister's own portfolio arts culture and heritage and what happened there was there was a website inside the ministry that initially was intended to display information; that was its purpose. It was for those who wanted to go on the Tuia 250 waka—you'd be able to upload passports and driver's licences and it turned out your rifle licence as well. And they didn't change the permissions from display only to upload fundamentally is what happened. Although actually in the details there what really happened was there was someone inside the ministry who was advised—this is what the report tells us—that they had a conflict of interest giving the tender documents for that piece of work to someone who they'd worked with and that was ignored. So there were some very unsatisfactory dealings in that. Regardless with Tuia 250 the Prime Minister data breached more young people's data than any other Minister in any Government in the past 10 years. And when you have that from the top that filters down as a laissez-faire attitude towards cyber-security.That's a real shame that might well contribute to where we are here now. We've been very very constructive as an Opposition towards helping bring the Government towards what might be a more cyber-secure environment. When David Clark was the Minister of Health we were putting this to him—remember we actually had a spokesperson for data. I was privileged to have that under Bill English. So I was asking David Clark—and I won't give you the written parliamentary question (WPQ) numbers but I'll just read them—is the Minister up to date with cyber-security in his ministry? Does the Minister have any concerns for cyber-security in his ministry? Does the Minister have responsibility for cyber-security in this ministry? Will the Minister take action if DHBs come under cyber-attack; and if so how quickly will the Minister act and how will the Minister act? I won't go through the wide range of answers to these questions but there were probably 50 to 60 questions which we were putting to the ministry to try and understand—so this would be the end of 2017—what some of the holes might be so that we could help to get a more secure environment so New Zealanders could believe that their information their data was secure in Government hands. That was our purpose. We were asking the health Minister: will he update the Prime Minister on his ministry's cyber-security testing and cyber-security protection? I would think probably 30 to 40 questions. Is the ministry fit for purpose in their data policies? And then there is one WPQ that I posed: how can the Opposition spokesperson for data help the ministry be more cyber-secure? So if you really want to see an episode of collaboration from us to the ministry once we realised that there was a weakness there there it is right there in a WPQ for anyone to see.Yet here we are today finding ourselves with what may be the single biggest cyber-security event in New Zealand—certainly in the Government sector. And we're all wondering why when several years ago we were saying to the ministry what are your backup policies? What is your policy for power down? Questions like: how often do you back up from archive? Now that might seem like a simple question. So everyone archives to a backup; that's fine. How many times do we actually bring that archive back into real data to show that it's worked? Well a month or so ago—in fact just after the cyber-attack—I asked Waikato DHB exactly that: when was the last time they did a full restore from archive? And the answer was over a year ago—over a year ago. You need to be doing these sort of restores at least yearly. Major organisations know this. They know that if you're not actually testing your archive how do you know that when you need it—and goodness knows we've needed it here now—it's secure? And yet for Waikato DHB it was more than a year since they have tested their restore capability from backup.This would seem like simple stuff. I do want to have a shout-out to the poor folks at Waikato DHB having in a previous life been responsible for designing and implementing electronic health records and rolling them out. This is an invidious position to be in. You know you think about the laboratory results that you need in real time—radiology even some of your outpatient clinics when you're doing or calculating chemotherapy. There's a large number of attributes that you take into account for how many milligrams if you like per kilogram this person needs and a wide range of attributes; that's all done in a computerised way. I recall my head of division in Boston when we'd go for funding to the head of medicine. Every year we'd go through this funding cycle. And my mentor Professor Charles Safran would say to the head of medicine Our department—the informatics department—can kill more people more quickly than any surgeon could in this hospital. All we've got to do is mess around with the oncology formulas all we've got to do is give faulty information—not through our own choosing but if we mess up the IT we will kill more people in this hospital than any other mechanism." Needless to say we usually got the funding we were asking for after we had that sort of conversation. But I make my point how critical information technology and informatics is in a hospital system.I think there are a number of questions that Waikato DHB need to answer. We were very interested had the DHB actually asked because the media was sort of saying—look they'd asked for IT funding and it hadn't been approved. So I posed that in a WBQ: what IT system upgrades or purchases if any have been requested by Waikato DHB in the past five years? And the information came back there actually weren't a lot. So it didn't look like Waikato DHB had actually put their hand up to a lot of information technology. There's some questions we've got around public cloud workloads software at Waikato DHB. Why has it been reported at almost certain risk with severe impact? How do we explain that? The ISCV the IntelliSpace Cardiovascular software had been reported as a highly probable risk with severe impact. What was being done about that? The data warehouse upgrade at Waikato DHB in the past 12 months had been reported as a possible risk with significant impact. Who kept their eye on that ball? The "cat 3-5 off shelf applications workplan 16_7" at Waikato DHB had been reported as highly probable risk with severe impact. Who was watching that? And so it goes on and on across a number of applications. Who was watching that at Waikato DHB?And when they needed to do the migration from Windows 10 what they had done which was correct was they closed down their external perimeter so that if you had a personal email and you went out to Outlook or Gmail you couldn't get across the external perimeter. But because they were struggling with the migration to Windows 10 they actually relaxed that external perimeter. I'm really hoping that if this was a phishing attack and it did come across the Waikato DHB external firewall it didn't come across when those relaxations were in place.So we have a number of questions that we want to pose to Waikato DHB. We understand that they will have a review process or an inquiry however that may be. But what we really need to do—and I think this is not just symptomatic of the health sector which I have maybe a closer view of but across all of Government—can I strongly encourage several things. I've always been of a view that cyber-security reporting should stand right alongside workplace safety reporting as a direct report to a board every quarter just like we report workplace health and safety. It is that important. Remember we can only be attacked in four ways: air land sea and cyber and we need to elevate the importance of cyber-security across all of Government. We have some expertise; we'd be happy to collaborate with Government to get this right. Certainly anything we can do to help Waikato DHB fix their problem any way we can just reach out and we'll do that. But we have to lift our collective level of responsiveness and funding to cyber-security across all of the Government sector.Can I just comment that the $385 million that's been touted in the Budget very little of that's for cyber-security. I challenge the Minister to say how much of that is for cyber-security. It's for the national health information platform. If you really dig down into the Budget documents that's where the money's going. Oh and by the way in the same breath can we maybe have an explanation why the National Oracle Solution failed under this Government and they handed it to the Ministry of Health despite Treasury saying "Don't do that. They're not capable. They don't have capacity to do that."? So it's a wider story. I want capacity in the Ministry of Health I want that higher level of security and I want that lifted right up to the chief executive level and I think if we do that we might be starting to get close to really giving some credence and some support to cyber-security. Thank you Madam Speaker.ASSISTANT SPEAKER (Hon Jacqui Dean): I call Jamie Strange—five minutes."