Data Leak: Police are Scrambling

Since my post yesterday you may have seen media pick up on the issue following us going public and blowing the whistle on what is a major data leak from the Police.

We can now confirm that the firearm database breach has revealed that 37,125 owners have registered 280,000 individual newly prohibited items.  Information made available includes full contact details, firearm licence number and bank address details.

Since my last email, the Police originally tried to downplay the significance of the leak telling media that the system had been taken offline immediately because of a “potential privacy breach”.  They told media that “Immediately upon being made aware of the issue (the data breach) the platform was closed down…”  

But that’s not true.  At least one of the people who called to tell us of the open accessibility had first called Police to report it.

When COLFO tested by logging in to the insecure portal it was still open, even though the issues had been raised. We know it was long enough to make the “immediately” claim incorrect. 

In response to the Police’s claims, we released screenshot images of the leak (with private information redacted) and more information as our lawyers worked to verify the reports we were receiving about the extent of the problem. We reported on the supporter who had found records of 280,000 notifications.

We did not deliberately drip-feed information. We were working carefully to verify what we said. We were not prepared to make allegations without checking. 

Shortly after noon yesterday the Police announced a stand-up media briefing for 2pm. But just before 2pm it was cancelled. It was held instead at 5 pm.

We think the reason is simple. We had released more facts to the media in the meantime. We suspect that they made it impossible for the Police to run the earlier line they had planned (that there was “nothing to see here”).

Our legal and political advisors in Wellington say that our update almost certainly sent the Police back to their media bunkers. They would no longer be able to dismiss our concerns.

The events of yesterday make an absolute mockery of earlier claims by the Police to the Select Committee that they could be trusted to keep a firearm registry secure.