Radio New Zealand has just discovered that a bull will toss you no matter which horn you grasp.
The particular horns it found itself upon belonged to the dilemma over whether it should broadcast material obtained illegally.
This was not another Rawshark data dump from Cameron Slater’s Dirty Politics email server. It related to material placed on the Dark Web by a group of international cyber extortionists.
Specifically, it was a series of Waikato District Health Board documents that had been released onto the Dark Web in retaliation for the DHB’s refusal to pay a ransom to hackers who had crippled five hospitals’ IT systems in May.
At the end of June RNZ revealed it had “been shown screenshots of what appears to be a link to a directory of sensitive information”. The list suggested it included data on patients and staff, but the state broadcaster did not reveal any of the actual content.
A month later it did exactly that in a story about a child who was kept in hospital simply because Oranga Tamariki could not find a suitable placement. RNZ disclosed in the story that its source was “documents posted online by the cyber attackers who targeted the DHB”.
There is no doubt that the story about the child’s situation was a matter of public interest. Oranga Tamariki later apologised and admitted it was “unacceptable”. The Minister for Children, Kelvin Davis, wants the case fully investigated.
No sooner had the story broken, however, than the Privacy Commissioner, John Edwards, issued a statement expressing his concern over the reporting of illegally-obtained private information. He is weighing up whether to complain to the Broadcasting Standards Authority and the Media Council.
So, here’s the dilemma. RNZ has grasped the public interest horn to justify use of the information while the Privacy Commissioner’s hand is firmly on the horn that says the broadcaster crossed several ethical boundaries.
It boils down to this: Does the public interest trump ethical obligations?
The RNZ story argued that the circumstances in which the child was placed – 67 days in a Waikato hospital for no clinical reason but solely because the child welfare agency had failed to find a suitable placement – justified both quoting extensively from a report included in the Dark Web data dump and accessing other files to verify it.
There certainly is a public interest in the failings of a state agency charged with the care of some of society’s most vulnerable members. The plight of the child, which culminated in a Police-escorted exit from hospital that was described by one staffer as “the most distressing discharge of her pediatric career”, is undoubtedly egregious.
In revealing the story, however, the media organisation entered what is perhaps the most sacrosanct area of privacy – personal medical records. All health information about individuals in this country falls under the Health Information Privacy Code and is treated as ‘medical in confidence’. It mirrors doctor/patient confidentiality and means that a person’s health information won’t be disclosed unless consented to or authorised by that person or through statutory authority (such as record sharing between health agencies). It was a very big step for RNZ to cross the line on medical records.
The story also related to a child in care – which is subject to strict limitations on publishing anything that might lead to the child’s identification. Newsroom is currently facing charges alleging such a breach during its investigations of Oranga Tamariki. Is it possible that the child in the Waikato Hospital can be identified?
The story also relied on stolen property as its source. The files had been unlawfully obtained by breaching computer security and accessed from a place that was beyond the reach of authorities that could have demanded their removal i.e. the Dark Web.
The public interest can be a strong defence that is recognised by both regulatory bodies and the courts. None sees it as outranking all other considerations. Rather, it is a matter of deciding where the correct balance should be struck.
That is the case with the RNZ story. It does have a strong case for a public interest defence, but it is not watertight. It was yet another example of the systemic failures of a government agency that has attracted complaints and a growing list of issues revealed by investigative journalists. However, this story did not publicise the plight of the child so that it might be released from hospital and placed in appropriate care. That had already happened. Nor was it a matter on which authorities had not acted. The DHB had asked for a review of the child’s care.
There is no dispute that the information had been unlawfully taken from the DHB. This was acknowledged in the RNZ story. However, there is no universal prohibition on the use of such material. The Media Council’s Statement of Principles allows for the use of information obtained by dishonest means if “there is an overriding public interest, and the news or information cannot be obtained by any other means”.
That was the justification used in the news media’s republication of the content of Cameron Slater’s emails hacked by the individual known as Rawshark and used by Nicky Hager in his book Dirty Politics.
Is the DHB material in the same league? Rawshark was a whistleblower. As far as we are aware, there was no financial gain to him (assuming it was a male) in hacking the emails. The purpose was to expose attack politics. The purpose of the assault that crippled the Waikato DHB’s computer systems was entirely pecuniary. It was an extortion bid and the hackers began feeding material onto the Dark Web in an attempt to force the board’s hand.
That, I believe, is a significant distinction. The DHB files were put on the Dark Web in order that they become public and embarrass – and scare – the DHB. Media use of the material serves that purpose. The message is clear: Don’t pay up and you’ll have more to deal with than disrupted services.
When the leaks were discovered, the GCSB’s National Cyber Security Centre (NCSC) said “malicious actors can monitor what is being said in the media, and this can influence their behaviour.” This surely was a message to media to be very careful, about their use of such material. The DHB issued a similar plea.
I do not believe RNZ’s use of the files was, on balance, justified.
The story was in the public interest but I am not satisfied that the broadcaster can meet the requirement that the information could not be obtained by other means.
It seems highly likely that RNZ was alerted to the child’s case when the hackers first sent it screenshots confirming they had placed material on the Dark Web. Had the DHB been approached with a general enquiry at that point, the case would probably have come to light and could be pursued without any reference to material involved in the hack. It is obvious from last week’s story that there were deep concerns among DHB staff. Had they been approached, it is odds-on that some of them would have recounted those concerns. There is no indication that RNZ reporters attempted that approach.
Nor am I satisfied that it justified examination of personal medical records. We don’t know exactly what documents RNZ read. It simply admitted that it “opened and read a small number” during what was a fishing expedition to verify the story about the child. In so doing, it at least created the possibility that personal medical records would be among the material it accessed. Use of such material must have a very high threshold. Given that the child was no longer at risk, I can’t see how this gets over the bar.
Media organisations often find themselves on the horns of dilemma. They need to weigh carefully which horn they will grasp. Occasionally they get gored.
UPDATE: On Wednesday 4 August, the High Court granted a Waikato DHB injunction to prevent any further use of the hacked data. An agreement between the DHB and RNZ meant that, in return for destroying any copies of the material it is possession, RNZ would not be required to take down the story. In his decision, Justice Churchman stated: “In terms of where the overall justice of the matter lies, there are strong arguments to the effect that it is not in the public interest that the confidentiality of the private, personal and sensitive information in the Stolen Dataset be breached.” The decision can be found here: https://www.courtsofnz.govt.nz/assets/cases/2021/2021-NZHC-2002.pdf
Tomorrow and tomorrow and tomorrow
MediaWorks yesterday had a Macbeth moment. Burnham Wood didn’t come to Dunsinane but we can hear the opening strains of the Thane of Cawdor’s famous speech: Tomorrow and tomorrow and tomorrow.
Tomorrow is the day staff will hear the results of the company’s culture being conducted by Maria Dew QC. Originally they were to be briefed yesterday but in an email to staff on Sunday CEO Cam Wallace said the board of directors had requested more time to “process the findings and recommendations”.
Some media have reported that staff were frustrated by the delay but it may be worth the wait if MediaWorks is developing a detailed plan to implement those recommendations. Given that the company plans to publicly release the report on its website, it is vital that it also be ready to say what it is going to do about it.
Some staff have expressed the fear, according to TVNZ, that the ‘toxic culture’ that led to the review will not change. They may be wrong. Cam Wallace is a new broom who was never part of that culture. And one thing is certain: Maria Dew will not produce a report that is full of sound and fury, signifying nothing.
UPDATE: MediaWorks on Wednesday made public the review. Here is a link: https//mediaworks.co.nz/home/about/WorkplaceReview.html.
I will discuss it in next week’s commentary.