Urewera 17 member first to discover WINZ privacy failures

It's been revealed the first person to discover major privacy failures at Work and Income's self service kiosks was one of the Urewera 17.

The New Zealand Herald reports Ira Bailey - an IT analyst - went to the Ministry of Social Development with his discovery.

He admits he told the ministry last week that there was a security issue, before he went to the media.

The Ministry's chief, Brendan Boyle, says the department was contacted by a man who asked for a reward in return for pointing out the loophole in the system.

But Mr Bailey says he simply asked if there was an incentive payment for people who pointed out security breaches.

When he was told there'd be no payment, he took his discovery to blogger Keith Ng instead - who revealed the breach on his Public Address website.

The ministry says there are no plans to lay charges against Mr Ng, but it's too early to say whether Mr Bailey will be charged.

Every 'I' will be dotted and every 'T' crossed when it comes to making sure new systems to protect at risk children are safe and secure, following the privacy breach.

There are concerns what the scandal will mean for the Social Development Minister's new information systems she plans to put in place to stop child abuse.

Paula Bennett says those are completely different systems and will be developed in conjunction with the Privacy Commissioner.

She admits the massive privacy breach set alarm bells ringing.

"I will be making sure that every check and balance is put in around it. I won't be relying on one source of information, I'll be taking it from a range of experts in that area."

There's a suggestion that planned reforms for protecting vulnerable children may be compromised by the privacy errors.

The Government's looking to set up a national database to collate information on at risk children

But Labour leader David Shearer says revelations WINZ self service kiosks could be used to access confident information are a real problem.

"This raises real issues for us of whether a database can be created with the sufficient control and oversight that would enable people to have confidence that their details are not being able to be accessed by unauthorised people."

A political expert says the Minister for Social Development and WINZ will maintain some credibility for facing up to the privacy breach so quickly.

Massey University associate professor of politics Grant Duncan says this is one of the worst privacy breaches seen and it's good it's being taken seriously.

"The one saving grace here is that both the minister responsible and the chief executive of the Ministry are both clearly taking the matter very seriously and urgently are seeking an investigation so we can get to the bottom of this."

Mr Duncan says this is a systematic lack of security, not an accident like ACC.

"It's one of the worst privacy breaches I think we've seen. It makes the exposure of a list of names from an ACC file look relatively minor by comparison."

He says this will damage the public perception of WINZ, but by admitting the fault and taking responsibility they've put themselves in a better position.

The Royal College of New Zealand General Practitioners says more secure security systems.

President Harry Pert says this is one in a number of privacy breaches and it should instigate a change.

"And I think it's just reminding us yet again of the importance of having very secure systems and being able to audit those systems on a regular basis to make that information is kept secure."

Mr Pert says a number of patients will be very upset to know their privacy has been breached.

"Patients have a right to expect that their health information will be kept private and secure and I think they would be very concerned to find out that it hasn't been kept in that manner."

He says the Government needs to reflect on how it manages private information so these breaches don't continue to occur.

Auckland University Professor Clark Thomborson says it's hard to explain exactly what happened.

He says either an IT firm gave the system a passing mark or told WINZ to shut it down and were ignored.

"It was a poor system and to be honest the thing that bugs me the most about this is that I think WINZ is quite exposed to internal fraud."

Mr Thomborson says problems like this are endemic and are due to the fact New Zealand's population has increased but we still have an island economy.

Photo: NZ Herald