By Lloyd Burr
An initial report into the major privacy breach at the Ministry of Social Development last month has slammed its security systems, saying they “woefully underestimated” the risk of hacking.
It also reveals that Dimension Data, the IT company the ministry had contracted to test and penetrate its systems, had identified the loophole but no action was taken by ministry staff.
Today's report is the first of two into the blunder which saw 7,307 private files downloaded by blogger Keith Ng at the ministry’s self-service kiosks on October 15.
Of these files, 1,432 contained personal information from clients and 10 had highly sensitive information for eight children and two adults. Mr Ng was able to access details of children in foster care, foster parents, lists of debtors and the name of a person who committed suicide.
More than 500 files belonging to the Christchurch Earthquake Recovery Authority were also accessed.
Hundreds of kiosks were shut down, and Social Development Minister Paula Bennett commissioned Deloitte to conduct the inquiry.
MSD chief executive Brendan Boyle says insufficient work was done to the security and information protection systems when the kiosks were rolled out.
“It is clear from the analysis that a number of people within the ministry’s IT function were aware of the kiosk security weaknesses and the risk posed to the access to the ministry’s network,” the report states.
“Appropriate follow-up action was not taken to remediate the weaknesses, either within the project team of the IT security team.”
The report says the ministry’s response to the issues was “inadequate” and public confidence has been eroded.
Four staff members are under investigation following the ordeal, but it is not known what role they played in the breach.
The report says only Mr Ng and associate Ira Bailey accessed the files and there was no widespread breach, based on download similarities across the network.
The ministry’s chief executive Brendan Boyle says the report is damming and his staff seemed to be “slack and sloppy” with their internal processes.
“I’m gutted and disappointed that we have let people down,” he says.
The report recommends separating the kiosk network from the ministry’s main network, both physically and logistically, as well as creating appropriate firewalls to prevent a repeat of the breach.
The kiosks remain closed and will do until they are secure, Mr Boyle says.
A second report examining the ministry's culture, capabilities and processes, will be released later this year.
The Green Party has accused Ms Bennett of passing the buck, saying she needs to take responsibility for the "disgraceful and repeated breaches of privacy by herself and her ministry".
“The minister promised to keep a close eye during the introduction of the kiosks, but the Deloitte report shows that in the final business case there was no discussion of security risks," says spokesperson Jan Logie.
"This is symptomatic of a ministry that doesn’t understand the importance of keeping confidential the private information it holds."
Labour's social development spokesperson Jacinda Ardern says Ms Bennett needs to stop calling the breach an 'operational matter' because public confidence in her department is not 'operational'.
3 News