By 3 News online staff
Ministry of Social Development chief executive Brendan Boyle says an independent inquiry will be launched into the Work and Income New Zealand (WINZ) kiosk privacy breach.
The massive security breach involving the public computers inside WINZ was exposed by blogger and freelance journalist Keith Ng last night.
Mr Ng was able to access thousands of personal files, including details of at-risk children, adoption, foster parents and people owing money to the ministry.
He says he simply used publicly accessible WINZ kiosks at two different locations in Wellington, and was able to access several thousand files.
Mr Boyle says “what happened is simply unacceptable”.
Alongside the independent inquiry, an internal taskforce will be established to look into the vulnerability in the computer system.
Mr Boyle says that the ministry regularly asks firms KPMG and Dimension Data to test the vulnerability of their websites by attacking them, and will ask for the intensity of these penetrative tests to be increased.
But Mr Boyle also says that Dimension Data had already tested the kiosk computer system without discovering the security hole.
The public kiosks inside WINZ offices were first trialled in late 2010 before being rolled out nationwide.
All 700 kiosks across the country have now been shut down.
‘An early warning for future systems’
Social Development Minister Paula Bennett says she considers the breach “very serious”.
“None of this is acceptable,” she says.
The security failings were exposed following Ms Bennett’s announcement that there will be an increase in information sharing between Government agencies in future, to help protect vulnerable children.
Ms Bennett has tried to allay fears that greater information sharing will lead to further privacy breaches.
“If anything, this has given us an early warning for our future systems,” she says.
“The computing system unveiled in the white paper [on vulnerable children] will be a completely different system.”
‘The buck stops with me’
Mr Boyle says he has to take responsibility for the breach.
“The buck stops with me, I’m the chief executive,” he says.
“It’s embarrassing and unacceptable. We need to take lessons from this.”
However Ms Bennett says it’s too early to apportion blame.
“It's too early for me to say what went wrong. It's too soon for us to put our finger on it.”
Ms Bennett has apologised for the lack of security surrounding people’s personal information.
“I apologise to everyone now. These people have trust in the ministry and we’ve let them down,” she says.
“The chief executive apologies to me and I accept that and now I pass that on to the country.”
Member of public went to MSD before journalist
The Ministry of Social Development says a member of the public alerted them to “some kind of breach” last week, and tried to extract money from the ministry by threatening to notify the media.
But a beneficiary advocate says the ministry was first advised of the flaw more than a year ago.
"I went with my collectors and we had a little play on the kiosks to see what they can do, and one of the guys who was with us found out that you can get back into the MSD system," she told Radio New Zealand this morning.
3 News