Gordon Campbell | Parliament TV | Parliament Today | News Video | Crime | Employers | Housing | Immigration | Legal | Local Govt. | Maori | Welfare | Unions | Youth | Search

 


MSD releases independent report into IT security breach

MSD releases independent report into IT security breach and confirms no widespread privacy breach

02 November 2012.

The Ministry of Social Development today released the independent report by Deloitte into the security breach of Work and Income kiosks.

Ministry of Social Development Chief Executfive Brendan Boyle says the report is damning around MSD’s failure to separate public kiosks from a network containing corporate files.

“However I am very pleased to report that there has not been a widespread privacy breach. Investigations have determined that there is no evidence that the Kiosk breach went beyond that of Keith Ng and his associate Ira Bailey.

“Both men have cooperated with the Deloitte investigation and with the Privacy Commissioner. They have handed the information over and promised they have not shared that information with anyone else.

“I’m sorry that this matter has created concern amongst people who have information stored with us. However, it is good that we are able to reassure people today,” said Brendan Boyle.

“The report found insufficient work was done by the Ministry to ensure appropriate security was placed around the protection of information at the time the kiosk infrastructure and services were designed and built.

“While independent testing done on the kiosks was sound, the Ministry’s response to the security issues identified was inadequate.

“The review found the Ministry’s response to the issues raised by Keith Ng and Ira Bailey was sound, prompt and considered.

“In terms of people’s privacy we are extremely fortunate that the risk of harm from this is extremely low because there were only two people who looked at a limited number of the invoices. Both men have returned all the information and assured us and the Privacy Commissioner that they have not distributed it to anyone else.

“Around 1,432 of the 7,300 odd items did contain some personal information such as a person’s name and/or date of birth and some description of the medical and legal services that were purchased.

“Of all the items downloaded the invoices relating to 10 individuals contained highly sensitive information.

“In the case of the eight children and two adults whose invoices contained highly sensitive information – we will be working on how best to respond to these individuals. This approach is in accordance with the Privacy Commissioner’s guidelines.

“In announcing the independent review I said that what had occurred was completely unacceptable and I continue to hold that view.

“The review finds security issues were identified and raised on a number of occasions, including by Dimension Data, but staff woefully under-estimated the risk of a malicious attack.

“In doing so they appear to have failed to take the necessary steps to ensure the Ministry safeguarded people’s personal information.

“I’m gutted and disappointed that we’ve let people down.

“Of particular concern is that risks and concerns which were identified do not appear to have been escalated to the right people.

“The Deloitte report confirms that staff members in leadership positions were not alerted to these issues and therefore had no opportunities to exercise appropriate judgement.

“The report makes it clear there were risk and governance processes in place, however these were not appropriately used.

“Questions must now be asked about the adequacy of these processes and whether this was an extraordinary series of events, or whether it raises broader issues about the appropriateness and effectiveness of the Ministry’s wider information systems security.

“This will all be considered in the second phase of the Deloitte independent review, which will include consideration of our policies, governance, capability and culture.

“This second phase review will be completed later this month.

“In the meantime I can confirm that at this stage four employment investigations are being undertaken by an independent barrister.

“These investigations need to run their course before I determine the next steps.

“I can assure people that the employment investigations will be thorough and people will be held to account for their conduct,” concluded Brendan Boyle.

Read the Independent Review of Information Systems Security - Deloitte (PDF 569.44KB)

Factsheet: Privacy Process following Work and Income Kiosk Security Breach

ENDS

Scoop copy of report: independentreviewdeloitte.pdf

Factsheet below

--

Privacy Process following Work and Income Kiosk Security Breach

Introduction

The Ministry of Social Development has completed a thorough investigation into private information which was recently accessed at two Work and Income kiosks in Wellington.

The Ministry understands that the public is concerned by this breach and that some MSD clients will have questions around whether their information was accessed.

In terms of peoples’ privacy we are extremely fortunate that the risk of harm from this is extremely low because there were only two people who looked at a limited number of the invoices. Both men returned all the information and have not distributed it to anyone else.

Around 1,432 items did contain some personal information such as a person’s name and or date of birth and some description of the medical or legal services that were purchased.

Of all the items downloaded the invoices relating to 10 individuals contained highly sensitive information.

In the case of these 10 people we will be talking with the professionals who work with them to see if they should be informed and if so, how best to do this.

This approach is in accordance with the Privacy Commissioner’s guidelines.

What happened?

On Monday the 15th of October the Ministry of Social Development received a USB containing 7,307 items downloaded from two kiosks.

A team led by the Ministry’s Chief Legal Advisor then put in an intensive effort to analyse these items and categorise them based on the amount of personal information contained in them, and the sensitivity of that information.

What did this team find?

Information on the USB related to corporate data. Most were invoices with no client details. However as outlined above around 1,432 items did contain some personal information.

Of all these items, invoices relating to10 individuals contained highly sensitive information.

Was there a privacy breach?

Yes, in the sense that two individuals accessed people’s information that was of a personal nature.

In the majority of cases, we have assessed the impact of the breach to be low as Keith Ng and Ira Bailey have assured us that the information was not further distributed and they have not retained copies.

In the case of the eight children and two adults whose invoices contained highly sensitive information – we will be working on how best to respond to these individuals. This approach is in accordance with the Privacy Commissioner’s guidelines.

Privacy Commissioner's Guidelines

Will you be contacting other people affected by this breach?

We have, already begun contacting people who have approached the Ministry to ask if their details were accessed.

We will not be making contact with anyone else who had some or part of their information downloaded. Their information was not widely distributed meaning any risk to them is low.

What CERA information has been accessed?

Of the 7307 items downloaded this included 533 CERA invoices. CERA will determine the level of harm or risk and decide whether those suppliers / individuals need to be contacted.

What if my information has been accessed?

Anyone who is concerned that their information has been accessed can contact the Ministry of Social Development on 0800 559 009.

The Privacy Act allows anyone who feels they may be affected by a privacy breach to make a complaint to the Privacy Commissioner.


ENDS


© Scoop Media

 
 
 
 
 
Parliament Headlines | Politics Headlines | Regional Headlines

 

PARLIAMENT TODAY:

  • Govt Probed Over Health & Safety
  • Questions and Answers 28-05-15
  • Week in Parliament 22-05-15
  • Saturday Sitting
  • House Rises At Midnight
  • Telco Levy Bill Passes
  • Telco Levy Bill Completes First Reading
  • Social Housing Bill Passes Under Urgency

  • Labour Party: McCully Doesn’t Deny Bribe In Saudi Sheep Scandal

    “In Parliament today I asked Murray McCully directly: Why is he the first Minister in history to back a multi-million dollar facilitation arrangement which in other jurisdictions is called a bribe? says Labour’s Export Growth and Trade spokesperson ... More>>

    ALSO:

    Welfare: Closure Of Relationships Aotearoa

    The Aotearoa New Zealand Association of Social Workers (ANZASW) Chief Executive Lucy Sandford-Reed is concerned about the closure of a national service which provides a wide range of services to rural and urban communities throughout New Zealand. More>>

    ALSO:

    TPPA: University Of Auckland Warns Of Negative TPP Impact

    The University of Auckland May 20, 2015 University of Auckland Warns of Negative TPP Impact With the Trans Pacific Partnership (TPP) negotiation drawing to a close, the University of Auckland has expressed serious concerns about its potential implications. ... More>>

    NZ Flag: Flag Referendum Gets Hit Hard In New Poll

    The latest Campbell Live text poll confirms it is time for the Prime Minister to listen to the public and shelve his flag referendum, says the New Zealand First Leader Rt Hon Winston Peters. More>>

    Gordon Campbell: The Government’s Belated Moves On Property Speculation

    Is it a property tax on capital gains or a capital gains tax on property? The Jesuitical distinctions in the government’s spin about its latest moves on property speculators are all about whether the government can claim that it jumped, or confess that it ... More>>

    Grant Robertson:
    Key Can’t Just Be Prime Minister For Parnell

    John Key must show New Zealanders in next week’s Budget that he is more than the Prime Minister for Parnell, and is also the Prime Minister for Pine Hill, Putararu and Palmerston North, Labour’s Finance spokesperson Grant Robertson says. In a ... More>>


    Labour Party: More Regional Jobs Go In Corrections Reshape

    News that 194 Corrections staff are to lose their jobs will have ramifications not only for them and their families but for the wider community, Labour’s Corrections spokesperson Kelvin Davis says. Prison units at Waikeria, Tongariro and Rimutaka ... More>>

    ALSO:

  • NZ First - Prison Job Losses to Send Money Offshore
  • TPPA: ‘Team Obama’ Regroups On Fast Track, Still Not Deliverable

    ‘After yesterday’s stinging and unexpected defeat for the Obama administration’s attempt to advance Fast Track legislation in the US Senate, Senate leaders have worked up a compromise they think will get them past this blockage’, according to Auckland ... More>>

    NZ Government: 5,500 More Doctors And Nurses In Our Hospitals

    Health Minister Jonathan Coleman says a record number of doctors and nurses are working in District Health Boards across the country. More>>

    Controller and Auditor General: Katherine Rich Conflict of Interest Decision

    We are writing to you about a matter that has been raised with us by members of the public. More>>

    ALSO:

    Budget 2015: Andrew Little On The 2015 Budget

    Speaking to the Chamber of Commerce, the Labour opposition leader attacked the government’s approach to economic issues facing New Zealand. He said they have been “more than reckless in their complacency” and “the next week’s budget will do nothing ... More>>

    Defence Force: NZDF Building Partner Capacity Mission Personnel In Iraq

    NZDF Building Partner Capacity Mission Personnel in Iraq The New Zealand Defence Force Building Partner Capacity training mission contingent is in place at Taji Military Complex in Iraq. The Chief of Defence Force Lieutenant General Tim Keating says the ... More>>

    PM Press Conference: ACC Levy Cuts Announced

    In a press conference this afternoon in Wellington, ACC Minister Nikki Kaye proposed $500 million worth of ACC levy cuts. More>>

    Quakes: New Process For Red Zone Crown Offers

    Canterbury Earthquake Recovery Minister Gerry Brownlee has announced a process to give everyone a say on the Crown offers to owners of vacant, commercial/industrial and uninsured properties in the Residential Red Zone. More>>

    ALSO:

    Get More From Scoop

     

    LATEST HEADLINES

     
     
     
     
     
     
     
     
     
    Politics
    Search Scoop  
     
     
    Powered by Vodafone
    NZ independent news