They have blanket-refused Official Information Act (OIA) requests, arguing it would only help attackers to make public what concerns or risks have come up.
The severity and duration of the Waikato attack has woken the public up to the threat, especially now patients’ personal data is on the dark web, possibly up for sale to identity thieves.
RNZ is seeking to find out what the country’s 20 district health boards (DHBs) have been doing — and could be doing — about the threat.
RNZ has asked for copies of minutes from DHB risk and assurance committee meetings, and others, over the past three years around cybersecurity developments, risks, attacks and funding.
Also asked for was any review of cybersecurity, and for any recommendations or help DHBs received, including from key agencies CERT (the Computer Emergency Response Team) and the Government Communications Security Bureau (GCSB).
The DHBs individually refused, but all used the same wording:
"District health boards are committed to the prevention, detection and investigation of cyber threats," they said.
"On behalf of the community, it is very important that we protect information about our cybersecurity strategies and methods as much as possible to ensure criminals do not use that information to hinder or bypass our security controls."
One option they did not take was to release documents but blank out sensitive parts, which is standard OIA practice.
They would also not provide their responses to director-general of health Ashley Bloomfield’s letter last year asking them to invest more in data and digital.
This letter followed a damning nationwide stocktake that found a $2billion-plus deficit in DHBs’ IT investment, and after clinicians wrote to the Government saying, essentially, "invest in digital or trouble lies ahead".
Speculation has swirled around how the Waikato DHB’s systems were breached. An independent inquiry has been promised once services are fully restored. It remains to be seen how public its findings will be.
The Waikato DHB’s own review in 2019 found weaknesses in its large number of apps — over 700 — and unsupported databases.
The Privacy Commissioner’s Office said it was watching to see if cybersecurity at DHBs was up to the level that met their obligations to protect patients’ privacy.
It has not so far issued any compliance notices to the boards.
The health ministry withheld from RNZ its new principles for prioritising DHB spending on IT — promised last year. These principles were still being worked on, it said.
A 2017 briefing showed health boards were not part of a programme to boost information security run by the SIS spy agency, called PSR.
RNZ is asking the SIS if that is still the case.
Other information gaps include:
- An annual report was not done last year by the National Cyber Policy Office in the Department of Prime Minister and Cabinet; it blamed this on Covid. The next report will be out at the end of 2022.
- The national Cyber Security Emergency Response Plan is still being updated and due at the end of the year.
- Cyber operations assurance plans provided to the Government Chief Digital Officer have not been made available.
