Top Scoops

Book Reviews | Gordon Campbell | Scoop News | Wellington Scoop | Community Scoop | Search


MCH privacy breach: 'Somebody has to be held to account'

Ministry for Culture and Heritage privacy breach: 'Somebody has to be held to account'

Craig McCulloch, Deputy Political Editor

One of the victims of a serious privacy breach has hit out at the ministry responsible, saying he feels it is more concerned with protecting itself than him.

Culture and Heritage Ministry chief executive Bernadette Cavanagh said her "number one focus" was providing support to those affected. Photo: RNZ / Charlotte Cook

The Ministry for Culture and Heritage yesterday revealed it had mistakenly exposed the sensitive details of about 300 mostly young people online.

Life coach Anaru Barton told RNZ that ministry staffers had alerted him over the weekend that some of his information had been compromised.

"They said the breach wasn't a problem, really, it was just a third party using information."

Mr Barton said it sounded like the ministry was trying to downplay the mistake and was looking after the organisation "more so than looking after me".

"Breaches of privacy are obviously quite serious.

"This is the government we're talking about. They should know the laws more than anybody about privacy and making sure information is secure."

He said it was "unsettling" to think that copies of his birth certificate and driver's licence could be in the hands of fraudsters.

"I don't know how many people, or who, or where my information has gone," Mr Barton said.

"My trust levels for giving anything to the government now are pretty low.

"Somebody has to be held to account for this."

The ministry had not advised him what steps he could take to protect himself, he said.

"Basically, all they've asked me to do is respond to an email ... and give them consent to work on my behalf."

On Monday, the ministry's chief executive Bernadette Cavanagh told Morning Report: "I have asked for an independent review to thoroughly look at what happened and make sure this does not happen again and can I also just say how sorry I am to the individuals that are affected, this is completely unacceptable and we are doing everything we can to help them through it...

"We have been in touch with Google and some of the other big search engines and have asking them to remove cached images wherever possible and we will keep doing that work with other partners across government to try to get those images offline."

"Can I just say how sorry I am to the individuals that are affected, this is completely unacceptable" - Bernadette Cavanagh duration 3:58
from Morning Report

Click a link to play audio (or right-click to download) in either
MP3 format or in OGG format.

But it was still possible that the information could be accessed online.

She said all of the ministry's websites were being checked for security.

Technology commentator Paul Spain told Morning Report the website used was a basic Word Press model.

"I think it does come down to poor practice and not really considering what sort of data that they were storing and what's an appropriate place to store it.

"I know there have been suggestions from the head of the Ministry of Culture and Heritage that this is a coding error, that doesn't really sit right with me ... this appears just to be a standard Word Press website, a lot of organisations use this type of website, but it's not the sort of place you should be storing very confidential information such as people's passports and personal identification."

"The cat's out of the bag now, it's a lesson to be learned, and not just by government" - Technology commentator Paul Spain duration 3:26
from Morning Report

Click a link to play audio (or right-click to download) in either
MP3 format or in OGG format.

He said while most of the information was gone from the internet, the question was who had accessed it while it was online.

"This could be a problem for them for months if not years to come because others are now able to impersonate them and they could do all sorts of things when they [can] pretend to be someone else."

Mr Spain said the issue couldn't be put right.

"The cat's out of the bag now, it's a lesson to be learned, and not just by government ... this is a challenge right across the country ... everybody wants to see a copy of your personal identification and in many cases there are not good robust processes for how that information is stored."

Privacy Commissioner John Edwards said the breach had the potential to undermine confidence in people's interactions with the government.

It was hard to know how far the information had been shared, he said.

"It has the potential to undermine confidence in people's interactions with government" - Privacy Commissioner John Edwards duration 3:57
from Morning Report

Click a link to play audio (or right-click to download) in either
MP3 format or in OGG format.

John Edwards. Photo: Supplied /
Office of the Privacy Commissioner

Whether people were in any kind of danger depended on the type of documents uploaded and how fast people could get replacement documents, he said.

Identity theft was one of the risks, but so was fraud and personal security in some circumstances.

"I understand that this was a third party provider who had been commissioned to provide this functionality so one thing that I think is quite important is that this does not necessarily indicate a lack of security across all government platforms, which I think generally is of a very high level."

Ms Cavanagh said the third party provider hadn't been involved in any other websites.

Replacing documents

On Sunday, Ms Cavanagh said her "number one focus" was providing support to those affected.

"We're taking whatever measures we possibly can, whether that be giving them new documents, new passports, new drivers' licences.

"And also trying to provide support and advice ... that they might be able to take to be a bit more sensitive and cautious now that their information has been unfortunately published."

All those affected had been offered replacement documents free of charge, Ms Cavanagh said.

Those included passports and drivers' licences.

The ministry had also created a "one stop shop" webpage with information for those affected.

Ms Cavanagh told Morning Report many of its questions for her would be answered by the review into the breach.

No confidence

National MP Nicky Wagner told RNZ the error appeared to be "a mixture of carelessness and naivety"

She said the public's faith in the government's ability to keep information safe would be disappearing fast.

"I have no confidence and I can't expect the public to have confidence. This is appalling."

The government's chief digital officer, Paul James, acknowledged the error would dent public trust.

"Every day, government holds, protects, transacts millions and millions and millions of pieces of personal information and does so safely and securely.

"However, when we don't get it right, it clearly has an impact on trust and confidence."

Mr James said he would write to all public chief executives to remind them of the required standards and to confirm they were complying.

© Scoop Media

Top Scoops Headlines


Gordon Campbell: On The Harry/Meghan Affair, And Iran

Those “Meghzit” headlines seem apt, given how closely Britain’s January 31 exit from the European Union resembles the imminent departure from the Royal Family’s top team of Prince Harry and Meghan Markle. For young Iranians, the accidental downing of the Ukrainian airliner is just the latest example of the deadly incompetence and dishonesty of their leaders... More>>

Gordon Campbell: On The Iran Aftermath

So, evidently, you can get away with murder. It looks as though a further escalation in the ongoing war between Iran and the US has been avoided – mainly thanks to Iran NOT responding in kind to the recklessly unhinged behaviour by the United States. Given the massive outpouring of public grief in Iran over the murder of Qassem Soleimani, some reciprocal action by Iran was necessary, but (so far) it has been almost entirely symbolic in nature... More>>

Gordon Campbell: On The Aussie Bush Fires And Suleimani

In popular culture, Australia is often portrayed as Western civilisation’s last unspoiled frontier, or as its final refuge from planetary disaster. In Nevil Shute’s best-selling 1950s novel On The Beach for instance, Melbourne served as the backdrop ... More>>

Gordon Campbell: On The Best Music Of 2019

This was a year where so many of the highlights came from female musicians. But amid all that richness, there was one standout album... More>>

Gordon Campbell: On Scotland’s Renewed Independence Battle

Brexit has always been very much an English obsession... So while it isn’t surprising that Boris Johnson won the election, he might also have lost the United Kingdom in the process. More>>

Analysis: Dotcom Appeal For Surveillance Data Dismissed

Kim Dotcom’s Appeal against the decision allowing the GSCB to withold information as to communications illegally intercepted by them has been dismissed by the Court of Appeal of New Zealand. More>>



  • PublicAddress
  • Pundit
  • Kiwiblog