UPDATED: Another privacy cock-up

UPDATE #2 - Keith Ng has named his source:

So. The guy who tipped me off is Ira Bailey. He was one of the Urewera 17. He currently works as a system administrator, has a young child, and is not interested in being the media limelight. That’s why he asked for anonymity.
He did not have any special access to the system – he just had half an hour to kill at a WINZ office. He plugged in his USB drive and it didn’t appear, so he had a poke around the system to find it – and found the giant vulnerability instead.
He called MSD to ask if they had a reward system for reporting security vulnerabilities. This is not unusual practice, and it’s certain not blackmail. Google and Facebook, for example, both pay for vulnerability reporting. It gives them a opportunity to close holes discretely, without causing embarrassment for their company.
MSD didn’t know what to do with his request, and it got slowly bumped up the food-chain.
Ira didn’t hear back from them, so he talked to me instead. I put him in touch with an experienced hacker. This hacker told us that government organisations in NZ don’t really pay for vulnerability reports, and that they were likely to either respond poorly or not at all.
MSD called Ira back two days later. They told Ira that they don’t pay for vulnerability reports. Ira told them he’d been talking to a journalist and the conversation didn’t go anywhere after that.
At this point, it was clear that Ira was not going to get paid for it, but that it could still be an important story. He showed me the vulnerability – the only condition was that his name be kept out of it. He wasn’t interested in being in the limelight.
The rest, I’ve already blogged. We have since both deleted all the material from our computers, and Ira assured me it’s all gone, and I’ve assured the Privacy Commissioner of this.
Since he called MSD and left his name and number, it was always likely that they’d out him as a diversion. We had hoped that it wouldn’t get to that, but it has, which is why I’m writing this now.
Should he have reported the vulnerability, free of charge? Yeah, that would have been the selfless thing to do for the public good. But asking to be compensated for his troubles is not unreasonable, either. After all, it’s not as if the people MSD ended up relying on – KPMG – did it for free.

******************************

UPDATED: MSD's response has been swift, doubtless at the behest of the Minister. MSD's CEO Brendan Boyle has announced an urgent and independant inquiry:

Ministry of Social Development Chief Executive Brendan Boyle says the security breach uncovered yesterday is serious.
"What's occurred is simply unacceptable," Boyle told reporters in Wellington this afternoon.
"I will be engaging an independent organisation to conduct an independent review so that I can understand what's happened and whether further action must be taken to safeguard client information," he said.
The terms of reference for the investigation will be drafted in the next 24 hours and Boyle said he wants an interim report completed over the next two weeks.
The investigation will initially examine the specific breaches around the kiosk, and if this  shows a broader independent review into ministry systems is needed, this will also be commissioned," Boyle said.
He is also establishing an internal taskforce to support the review and will be in close contact with the Privacy Commissioner throughout, he said.

******************************************

There's been another privacy botch from a government department. And it's MSD is in the gun this time; the Dom-Post reports:

The Social Development Ministry (MSD) has closed computer kiosks in Work and Income offices and launched an investigation after a major security flaw was exposed.
Freelance journalist Keith Ng reported on his blog that he was able to access thousands of files on the agency's servers from computers at self-service kiosks in a Wellington WINZ office.
He said he walked into a WINZ kiosk and was able to open files included sensitive case notes, names of children in care and up for adoption, foster parents, lists of people who owned MSD money, details of contract workers and how much they were paid, and the name of a person who had attempted suicide.
MSD deputy chief executive Marc Warner issued a statement  last night saying  "MSD is very concerned about this and an urgent investigation is underway.
The ministry had been alerted to the security flaw late yesterday and took immediate steps to secure the system, he said.
Ng had stated he accessed client information through WINZ kiosks at two Wellington sites, Warner said.
"We have closed all kiosks in all sites across the country to ensure no further information can be accessed.
"They will not be reopened unless and until we can guarantee they are completely secure and we have obtained independent assurance from security experts.
"We understand the maintenance of public confidence in our ability to protect people's information is vital.
"I want to give the public an assurance that we are doing everything possible to fix this and our people have been working overnight.
Ng had given an assurance that he would pass all the information to the Privacy Commissioner this morning and had guaranteed that none of the information would be given to anyone else or placed in the public arena, Warner said . 

Keith Ng has exposed a very significant flaw here. And he has handled it well, ensuring that none of the information he has discovered gets into the public domain. By alerting MSD, but carefully avoiding the release of any personal information into the public domain he has played this well. Others may have been less responsible.

This is a serious breach by the MSD, and should not be trivialised. MSD's initial response has been to shut down the internet kiosk's whilst it conducts an inquiry into how privacy settings could have been so lax. We are sure that Paula Bennett will have a "please explain" waiting for her Chief Executive this morning.

Government departments should treat personal information with the highest possible levels of security. At first glimpse it seems that the MSD's standards have fallen well short of what could be reasonably expected. Their response and that of Paula Bennett will be watched with interest.