18 Dec 2022

Swedish company apologises over security breaches at Archives New Zealand

6:42 am on 18 December 2022
Archives NZ

Swedish firm Axiell has apologised to Archives NZ for the "inconvenience" that challenges with its system caused saying it was putting in "resources globally" to fix the Collections search system. Photo: RNZ / Samuel Rillstone

A Swedish company has apologised over months of security breaches at Archives New Zealand.

Technology failings since February have exposed at least 9000 restricted records.

They have shut down the public's, historians' and researchers' ability to search the archive for days at a time.

Axiell executive vice president Maria Wasing said the company was putting in "resources globally" to fix the Collections search system, at no additional cost to Archives.

"We, of course, apologise for the inconvenience that challenges with the system have caused Archives and users," she said.

The shutdowns, slowness and incompleteness of searching, and Archives' decision in 2020 to reduce opening hours at its reading rooms, have delayed court cases relying on historical records, according to lawyers and a High Court's notes.

Official Information Act documents say Axiell knew about the "syncing" error causing the breaches but did not tell Archives, which later told Axiell off.

Wasing, however, said: "We are working with Archives at every step of the way."

The OIA reports and emails suggest fixing the system will be expensive and take a long time, well into next year.

Archives previously had put the shutdowns - three of multiple days, and many shorter ones, since February - down to "essential maintenance", before last month issuing a statement saying the tech problems had led to a potential security and privacy breach.

Investigations showed no one accessed confidential information, it said.

These breaches are in addition to an Archives data entry error that let two members of the public see three sensitive health files of individuals related to a mental health facility and to the Royal Commission into abuse, a breach discovered in September that only came to light yesterday via an OIA to RNZ.

Archives has received hundreds of complaints from users since the new Collections search system went live - without full testing due to Covid or full functionality - 10 months ago.

It has looked at reinstating the old system it dumped, Archway - not possible, it concluded - and quitting Axiell to find a whole new system, but decided to stick with trying to fix the $4 million system now in place.

Get the RNZ app

for ad-free news and current affairs