Privacy commissioner learnt about 'serious' breach from the media | Stuff.co.nz
Privacy commissioner learnt about 'serious' breach from the media
Jonathan Killick
13:47, Aug 01 2023
Te Tari Pūreke launches firearms registry
Play Video
The police firearms registry, Te Tari Pūreke/Firearms Safety Authority launched on 24 June, 2023.
The Privacy Commissioner is “frustrated” to have learnt about a “serious” privacy breach through the media, relating to the email addresses of 147 firearms owners being spilled.
In July, it was reported that the email addresses of licence holders were to sent to each other after a list of addresses was pasted in the carbon copy (cc) address field, rather than as in the blind carbon copy (bcc) field.
Privacy Commissioner Michael Webster said his office wasn’t formally notified of the breach by Te Tari Pūreke / Firearms Safety Authority until the following day.
Police launched the register of the country’s estimated 1.1 million firearms, via the authority, in June.
“This [breach] is frustrating, given the significant known risk of email address errors and the opportunity the new authority had to design in system guardrails,” Webster said.
“We understand the police sent out an email to affected people within minutes of the serious breach occurring. But this was an avoidable serious privacy breach.”
Privacy Commissioner Michael Webster. (File photo)
ROBERT KITCHIN/STUFF
Privacy Commissioner Michael Webster. (File photo)
Mr Webster said it was his hope the establishment of a special purpose Firearms Safety Authority would contribute to community safety – and secure management of firearm owners’ personal information is an important part of that.
“I will be asking Te Tari Pūreke to provide me with assurance that they have implemented robust systems and processes across the authority to protect the sensitive personal information they hold.”
Director superintendent Richard Wilson told Stuff the email which contained the email addresses was a generic message asking the recipient to update their address, and did not contain any further personal information.
“Te Tari Pūreke confirms that on this issue being identified internally it immediately ceased emailing groups, and it sent a follow-up email to the 147 recipients asking them to delete the previously sent message.”
Grant Fletcher one of New Zealand’s foremost experts on gun law. (File photo)
SUPPLIED
Grant Fletcher one of New Zealand’s foremost experts on gun law. (File photo)
Wilson said police notified affected firearm owners within 9 minutes of the breach, and spoke to the Privacy Commissioner’s office later in the afternoon. Police later made a formal notification following that discussion.
He said an independent security expert had been brought in for advice and staff would not be sending bulk emails without authorisation from a manager. “New technology” would also be implemented soon.
Wilson emphasised that the breach did not come from the firearm registry system, rather it had come from use of the police email system.
Grant Fletcher, one of New Zealand’s foremost experts on gun laws, said the privacy breach was “not even remotely close to being good enough”.
“All firearms users are entitled to have their details protected, as are all users of government services,” he said.
Fletcher said people were already hesitant about putting personal details into the system when it was launched, because there had been similar data leaks overseas which resulted in those gun owners being sent death threats.
“This leak has just further eroded their trust. People are furious... The entire firearms’ community are shaking their heads at this.”
Police have been contacted for further comment.
Jonathan Killick
13:47, Aug 01 2023
Te Tari Pūreke launches firearms registry
Play Video
The police firearms registry, Te Tari Pūreke/Firearms Safety Authority launched on 24 June, 2023.
The Privacy Commissioner is “frustrated” to have learnt about a “serious” privacy breach through the media, relating to the email addresses of 147 firearms owners being spilled.
In July, it was reported that the email addresses of licence holders were to sent to each other after a list of addresses was pasted in the carbon copy (cc) address field, rather than as in the blind carbon copy (bcc) field.
Privacy Commissioner Michael Webster said his office wasn’t formally notified of the breach by Te Tari Pūreke / Firearms Safety Authority until the following day.
Police launched the register of the country’s estimated 1.1 million firearms, via the authority, in June.
“This [breach] is frustrating, given the significant known risk of email address errors and the opportunity the new authority had to design in system guardrails,” Webster said.
“We understand the police sent out an email to affected people within minutes of the serious breach occurring. But this was an avoidable serious privacy breach.”
Privacy Commissioner Michael Webster. (File photo)
ROBERT KITCHIN/STUFF
Privacy Commissioner Michael Webster. (File photo)
Mr Webster said it was his hope the establishment of a special purpose Firearms Safety Authority would contribute to community safety – and secure management of firearm owners’ personal information is an important part of that.
“I will be asking Te Tari Pūreke to provide me with assurance that they have implemented robust systems and processes across the authority to protect the sensitive personal information they hold.”
Director superintendent Richard Wilson told Stuff the email which contained the email addresses was a generic message asking the recipient to update their address, and did not contain any further personal information.
“Te Tari Pūreke confirms that on this issue being identified internally it immediately ceased emailing groups, and it sent a follow-up email to the 147 recipients asking them to delete the previously sent message.”
Grant Fletcher one of New Zealand’s foremost experts on gun law. (File photo)
SUPPLIED
Grant Fletcher one of New Zealand’s foremost experts on gun law. (File photo)
Wilson said police notified affected firearm owners within 9 minutes of the breach, and spoke to the Privacy Commissioner’s office later in the afternoon. Police later made a formal notification following that discussion.
He said an independent security expert had been brought in for advice and staff would not be sending bulk emails without authorisation from a manager. “New technology” would also be implemented soon.
Wilson emphasised that the breach did not come from the firearm registry system, rather it had come from use of the police email system.
Grant Fletcher, one of New Zealand’s foremost experts on gun laws, said the privacy breach was “not even remotely close to being good enough”.
“All firearms users are entitled to have their details protected, as are all users of government services,” he said.
Fletcher said people were already hesitant about putting personal details into the system when it was launched, because there had been similar data leaks overseas which resulted in those gun owners being sent death threats.
“This leak has just further eroded their trust. People are furious... The entire firearms’ community are shaking their heads at this.”
Police have been contacted for further comment.
