Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Massive data leak in New Zealand government servers

publicaddress.net

Post reply on HN
Print view View original

21–30 of 39 posts

Re: Massive data leak in New Zealand government servers

#21

Post by shell0x »

SoftwareMaven wrote: post #20
ams6110 wrote: post #18

Earlier quoted context omitted.

I know of one software shop locally where the dev and build machines are on a complete network island. No external access at all. If you need to google something you need to use a different computer connected to the public internet. A bit inconvenient, but not unworkable. Devs have a laptop or tablet for public browsing, and their actual work takes place on the "clean room" network.

We have a handful[1] of secure machines that are allowed to SSH into production systems. No development or other Internet activity takes place on those boxes. [1] A handful because many of us are remote. Mine is a EeePC.

Sounds good :-) Do you use Linux on this EeePC?

Re: Massive data leak in New Zealand government servers

#22

Post by boop »

Once it was clear that there was was a leak of confidencial information, he should have taken what was required as minimal evidence (a few screenshots?) and then contacted the Acting Privacy Commissioner.

Did he really need to go through files related to Doctors/Radiology, Debt Collectionn, Fraud Investigations, Care and Protection, HCN? Snooping through the servers beyond what was necessary was wrong.

The bigger story is the lack of security on the New Zealand servers. However, what he did was wrong and possible illegal IMHO.

Re: Massive data leak in New Zealand government servers

#23

Post by SoftwareMaven »

shell0x wrote: post #21
SoftwareMaven wrote: post #20

Earlier quoted context omitted.

We have a handful[1] of secure machines that are allowed to SSH into production systems. No development or other Internet activity takes place on those boxes. [1] A handful because many of us are remote. Mine is a EeePC.

Sounds good :-) Do you use Linux on this EeePC?

Of course. It's kind of a requirement at KSplice[1]. :)

1. http://www.ksplice.com/

Re: Massive data leak in New Zealand government servers

#24

Post by boop »

boop wrote: post #22

Once it was clear that there was was a leak of confidencial information, he should have taken what was required as minimal evidence (a few screenshots?) and then contacted the Acting Privacy Commissioner. Did he really need to go through files related to Doctors/Radiology, Debt Collectionn, Fraud Investigations, Care and Protection, HCN? Snooping through the servers beyond what was necessary was wrong. The bigger sto…

In addition, the author claimed he spent a week preparing the story. Yet he only contacted the Acting Privacy Commissioner yesterday. He blog was published before the government had a chance to fix the issue. I find this irresponsible.

Re: Massive data leak in New Zealand government servers

#25

Post by ppog »

boop wrote: post #22

Once it was clear that there was was a leak of confidencial information, he should have taken what was required as minimal evidence (a few screenshots?) and then contacted the Acting Privacy Commissioner. Did he really need to go through files related to Doctors/Radiology, Debt Collectionn, Fraud Investigations, Care and Protection, HCN? Snooping through the servers beyond what was necessary was wrong. The bigger sto…

Going that extra mile was necessary to make this a big story instead of having it brushed under the carpet. It seems that the leak was known about as much as a year ago (http://www.nzherald.co.nz/nz/news/article.cfm?c_id=1&obj...), MSD were informed, but nothing was done because there was no media firestorm. By showing what was exposed, Keith Ng made the horrific impact of the leak understandable to the public and media and greatly increased the likelihood that something will get done.

Re: Massive data leak in New Zealand government servers

#26

Post by robocat »

jl6 wrote: post #10

This is the main reason I'm skeptical of central government databases. Not because of the miniscule chance of them enabling a police state, but because of the very great chance that the data will not be properly safeguarded.

I think private databases will be the biggest risk over time. Private entities share private formation across national boundaries.

Currently: facebook, telecommunication companies, Skype, gmail. Scary: Data aggregation services. Near future: face and iris databases.

Re: Massive data leak in New Zealand government servers

#27

Post by robocat »

boop wrote: post #22

Once it was clear that there was was a leak of confidencial information, he should have taken what was required as minimal evidence (a few screenshots?) and then contacted the Acting Privacy Commissioner. Did he really need to go through files related to Doctors/Radiology, Debt Collectionn, Fraud Investigations, Care and Protection, HCN? Snooping through the servers beyond what was necessary was wrong. The bigger sto…

I think he has done this exactly right.

This department clearly doesn't value security (multiple levels of deep failure) and the only way to make it important is political pressure via the public and the media.

Only by revealing the breadth of the failure, and doing so publically, could any effective change occur.

It is obvious they could (and did) shut down or secure the kiosks quickly.

If he took a week to consult legal, decide best course of action, make up his mind on risking his neck, or WHATEVER, that is his right and fine by me.

Armchair criticism is easy. Kieth has taken a ballsy action as an individual and he gets my respect.

Re: Massive data leak in New Zealand government servers

#28

Post by lostlogin »

jvdh wrote: post #14

This is easily the biggest databreach that I have ever seen. I sincerely hope no one noticed this before, this has the potential to have a severe impact on so many lives in New Zealand.

They seem to have been warned multiple times, here is someone saying they warned the department a year ago. http://m.nzherald.co.nz/nz/news/article.cfm?c_id=1&objec...

Re: Massive data leak in New Zealand government servers

#29

Post by jstr »

boop wrote: post #22

Once it was clear that there was was a leak of confidencial information, he should have taken what was required as minimal evidence (a few screenshots?) and then contacted the Acting Privacy Commissioner. Did he really need to go through files related to Doctors/Radiology, Debt Collectionn, Fraud Investigations, Care and Protection, HCN? Snooping through the servers beyond what was necessary was wrong. The bigger sto…

He did a public service. What he did is (according to lawyers) not illegal. See http://www.nbr.co.nz/article/keith-ng-facing-possible-two-ye....

Re: Massive data leak in New Zealand government servers

#30

Post by yogar »

lostlogin wrote: post #19
stfu wrote: post #13

Earlier quoted context omitted.

But but but, I thought building a central health-care database is such a brilliant idea and saves so much money!11

The health data base is very well protected from what I know. And access is strictly monitored. If patient notes are viewed by someone who does not need to view them, they face harsh discipline. I recall a case from when I used this database a long time ago. In terms of high profile issues with it, the current eel-in-arse story is going to result in action and this is being done via the systems user tracking. http://…

If they are monitored and if unauthorized access is prevented by "harsh discipline". then they are not protected. Protection is proactive not reactive.
Post reply on HN