By Adam Ray
The Ministry of Social Development's chief executive says it was "slack and sloppy". Social Development Minister Paula Bennett says it was "atrocious".
They're talking about a privacy breach involving thousands of documents, some of them sensitive, that were downloaded from a Work and Income kiosk.
A report on the breach released today blames staff at the ministry, and says they should have told senior managers.
The WINZ information kiosks are still shut three weeks after the security flaw was made public.
“From a management point of view there seems to have been slack and sloppy internal processes and follow-up,” says ministry chief executive Brendan Boyle.
A review found ministry staff had a series of warnings about kiosk IT security, and it appears to clear senior managers of blame.
“At heart of this was the failure to determine the problem, and then escalate it to people who could make the decisions,” says Mr Boyle.
The first warning came after IT firm Dimension Data tested kiosks last April and found they should be separated from the ministry’s network.
Last November welfare advocate Kay Brereton twice told the ministry that private details could be accessed. But MSD staff didn't follow up on the warnings, and blogger Keith Ng found he could download thousands of files from a kiosk - including invoices with sensitive details of eight children and two adults.
“In the case of these people we will be working on how to best respond on a case-by-case basis,” Mr Boyle says.
Mr Ng's decision to return the files limited the impact of the breach, but he says it's not just the kiosks that need attention.
“It’s not as much the kiosks that are the problem, it’s that they didn't treat the security issue with the kiosk seriously,” Mr Ng says.
Four staff at the Ministry of Social Development are under employment investigation because of the breach, but Mr Boyle would not confirm who they were.
“They are across a range of roles within the ministry.”
Welfare advocate Chis Zack from Action Against Poverty says it shouldn't be blamed on mistakes by a few ministry staff members.
“I think the report highlights a cavalier attitude towards privacy that stems from Paula Bennett's cavalier attitude,” he says.
Ms Bennett says she'll respond to any privacy concerns and the review will lead to changes.
“I think that it shows to us that there really was an atrocious process and the process was not followed through.”
The Ministry of Development is still planning to get the kiosks working again - once it's sure they're finally safe.
3 News