Wellington Scoop
Network

Security breach on government website: “completely unacceptable error”

bernadette-cavanagh

Report from RNZ
Hundreds of young people have had their sensitive details exposed online – including passports, birth certificates and drivers’ licences – due to a security breach on a government website.

At a media conference in Wellington this morning, Ministry for Culture and Heritage chief executive Bernadette Cavanagh (above) apologised for the “completely unacceptable” error and launched an independent review into what went wrong.

Roughly 300 people – most aged between 16 and 20 – had provided the information to the ministry as part of their applications to take part in Tuia 250 commemorations marking 250 years since the James Cook landing.

Ms Cavanagh said their details were uploaded to an external website without sufficient protections and could have been found through a simple Google search.

“Frankly, it was a mistake, it was a coding error, the right protections weren’t put in place,” she said. “I’m just so sorry this happened.”

Ms Cavanagh said she was ultimately responsible for the breach, but confirmed she had not offered her resignation. She said it was too early to say whether anyone would lose their job.

“I have asked for an external review to see what went wrong in this case and to ensure that the ministry’s processes around gathering and storing information is robust.”

The ministry was alerted to the breach on Thursday by the parent of an applicant who had discovered their driver’s licence had been used fraudulently to try and purchase concert tickets online.

Government ministers were immediately notified and all information was removed from the site by that evening. The website was shut down on Friday.

Personal identification documents that have been compromised include:

228 passports (209 NZ, 19 international – Australia, Brazil, China, US, Canada, South Africa, UK, and Denmark)
55 driver licences
36 birth certificates
6 secondary school IDs
5 NZ residential visas

Ms Cavanagh said some cached copies of the material could still be found online, but the ministry had approached Google and other search engines to request it be taken down. All applicants had been contacted and offered replacement documents at no cost, she said.

Situation ‘alarming’, parent says

Since the Tuia 250 website has been shut down, its Facebook page has been busy with people asking if their data had been breached and what the next steps would be. One Facebook user commented: “I’ve been contacted about my personal information being shared with a third party? Could someone please explain this to me.”

A helpline with the number 0800 624 669 and website has been set up to support people who are impacted by the breach. A helpline operator said they had not been very busy. They said the helpline number may change tomorrow.

The mother of an applicant – who did not want to be named – told RNZ the whole situation was “alarming”.

“Even the phone call and the email we got about it seemed dodgy. It was hard to tell if it was genuine,” she said.

She said the error was heightened by the majority of the applicants being young Māori and Pasifika people.

“Unfortunately, it looks like a present day example of a colonialist institution once again being neglectful of the taonga of Te Ao Māori, in this case, their identity. It is a huge fail, sadly.”

paul-james

Speaking at the media conference, government chief digital officer Paul James said he would write to all public chief executives to remind them of the standards and policies and to confirm they were complying. He said it appeared the Tuia 250 website had not been configured according to the required security standards.

“It’s a really significant breach and it’s definitely regrettable.”

Ms Cavanagh confirmed the ministry had commissioned an outside company – which she would not name – to develop the website. She said the company had not been used for any other website.

Tuia – Encounters 250 (Tuia 250) is an initiative marking 250 years since the first onshore meetings between Māori and Europeans. The Voyage Trainee programme is an opportunity for New Zealanders to sail aboard the vessels in the Tuia 250 Voyage during October to December.

Tuia 250 Ki Totaranui is expected to be less of a celebration and more a commemoration of history that had impacted all New Zealanders.