Heads must roll

November 20th, 2012 at 4:00 pm by David Farrar

David Fisher at NZ Herald reports:

The security review into problems at the public computer kiosks run by the Social Development ministry raised identical problems to those exposed by a blogger 18 months later.

Keith Ng’s discovery of private information sitting on publicly-accessible hard drives was an almost exact match for the April 2011 report by a security company hired to find problems.

The security-assessment.com report found the connection between the corporate computers and public kiosks – planned for MSD offices across the country – was dangerous.

“This lack of separation means that the kiosk terminal has the same level of authority and access as corporate MSD employees.”

It went on to say it created an “inherent level of risk as it could allow for a member of public to gain access to MSD network resources and services”. …

The type of information at risk was also revealed in the April 2011 security report. It raised concerns about medical information, drug testing results and recorded calls to MSD’s helpdesk as being openly available.

It recommended taking “urgent” action to restrict access.

“A malicious user with access to the operating system of the kiosk is able to gain access to sensitive information kept with the MSD network including medical and drug test results,” it stated.

The review into the problem, released three weeks ago, showed senior managers were not told about the problem.

The April 2011 report was ignored until Mr Ng revealed the holes in MSD’s system.

The staff who were aware of this report and did nothing, clearly must be goneburger – subject to natural justice.

But that does not mean more senior managers are exempt. They may not have known of the recommendations in the report, but were they aware of the fact a report was commissioned? Or were they totally in the dark as to the fact there had even been an issue with the kiosks?

And even if they were totally in the dark, then the question for the senior managers is whether they had a risk reporting framework in place, which required risks such as those identified in the security report to be recorded in a risk register which is reviewed by senior management. If they did not have a comprehensive risk reporting framework in place, then they should consider their own positions.

It is possible that MSD did have a comprehensive risk reporting and mitigation framework in place, and the four staff involved just ignored it. If that is the case, then liability may stop with those staff directly involved. We won’t know until the disciplinary processes are concluded and the full report on what nothing happened is released.


How safe is ballooning?

January 9th, 2012 at 1:00 pm by David Farrar

Stuff reports:

A prominent Canterbury balloonist and friend of the pilot of the balloon at the heart of Saturday’s disaster in the Wairarapa has cautioned against speculation over the cause of the tragedy.

Martyn Stacey, of Methven, was also at pains to stress that the sport is safe.

Stacey, the Aoraki Balloon Safaris operator and Balloon Aviation Association of New Zealand president, was a close friend of pilot Lance Hopping, who was killed along with 10 passengers in a fiery crash in Carterton early on Saturday morning. …

“It’s a shock to the whole community. What we’ve got to reiterate now is that ballooning is safe. People have to understand that ballooning is a major tourist operation.”

The deaths have been a major international story. They even made the Drudge Report which gets 30 million views a day. It was reported in UK and Australia also. The reality is that no one will be wanting to book a balloon ride in New Zealand for some time. In fact, it may damage the practice internationally for a period of time.

My flatmate has a voucher for two to do a balloon ride in the Wairarapa. Even though I’ve done one before in Egypt, I’m like “Don’t invite me to go with you”. It is a bit creepy thinking that if she had redeemed them this weekend, it could have been her up there.

In another close call, I’m horrified to see this video of a bungee cord snapping over crocodile infested waters.

I wondered where this happened, and it was at Victoria Falls over the Zambesi, where I spent Christmas Day. I saw several people bungee from that bridge, and almost did one myself. As I had done a bungee before at Skippers, I didn’t feel the need to do a second one.

Horrified to see the cord snap, or somehow not be secured correctly. A miracle the young girl survived. She had to swim to shore with the cord still tying her legs together.

Anyway going back to the ballooning:

There had been only three fatal balloon accidents in New Zealand in the past century, he said.

“You’ve got more chance of drowning or being run over by a car.”

I’m not sure that is the case. It’s like when people say elephants kill more people than sharks. What is a better comparison is how much time do people spend in the vicinity of elephants compared to swimming with sharks, and what is the fatality rate.

I’m not sure how many people balloon a year, and for how long, but to compare to road deaths, you need to compare per (say) million hours of an activity.

In NZ let’s say three million people spend 10 hours a week driving. That is 30 million hours per week, or 1,500 million hours per year. If 300 people die in car crashes then that is 0.2 deaths per million hours.

Now I have no idea how many people balloon in NZ every year. So I’ll guess some figures just so one can do a potential comparison. Please note these are not actual figures, and I am not saying ballooning is or is not more safe than driving. Just showing what a proper comparison would be.

Let’s say there are 50 ballooning operations in NZ. Also assume each goes up once per day (tends to be sunrise) with 10 people in them, and they stay up for an hour. That is 500 person hours a day which is 3,500 a week and 175,000 person hours a year.

Now if car fatality rate is 0.2 deaths per millions hours (or 1 death per five million hours), then you would expect one ballooning death around every 30 years, for ballooning to be safer than driving.

How with three accidents in the last century that could suggest they are of equal risk. But only if just one person died in each accident, and that is unlikely.

It would be great if someone somewhere (maybe an insurance company) calculated and published the fatality incidence rates for everything from driving to cycling to bungee jumping to ballooning to rafting to safari touring on a per (million) hours basis. That would be an interesting comparison.