RNZ thrown by horns of dilemma

Radio New Zealand has just discovered that a bull will toss you no matter which horn you grasp.

The particular horns it found itself upon belonged to the dilemma over whether it should broadcast material obtained illegally.

This was not another Rawshark data dump from Cameron Slater’s Dirty Politics email server. It related to material placed on the Dark Web by a group of international cyber extortionists.

Specifically, it was a series of Waikato District Health Board documents that had been released onto the Dark Web in retaliation for the DHB’s refusal to pay a ransom to hackers who had crippled five hospitals’ IT systems in May.

At the end of June RNZ revealed it had “been shown screenshots of what appears to be a link to a directory of sensitive information”. The list suggested it included data on patients and staff, but the state broadcaster did not reveal any of the actual content.

A month later it did exactly that in a story about a child who was kept in hospital simply because Oranga Tamariki could not find a suitable placement. RNZ disclosed in the story that its source was “documents posted online by the cyber attackers who targeted the DHB”.

There is no doubt that the story about the child’s situation was a matter of public interest. Oranga Tamariki later apologised and admitted it was “unacceptable”. The Minister for Children, Kelvin Davis, wants the case fully investigated.

No sooner had the story broken, however, than the Privacy Commissioner, John Edwards, issued a statement expressing his concern over the reporting of illegally-obtained private information. He is weighing up whether to complain to the Broadcasting Standards Authority and the Media Council.

So, here’s the dilemma. RNZ has grasped the public interest horn to justify use of the information while the Privacy Commissioner’s hand is firmly on the horn that says the broadcaster crossed several ethical boundaries.

It boils down to this: Does the public interest trump ethical obligations?

The RNZ story argued that the circumstances in which the child was placed – 67 days in a Waikato hospital for no clinical reason but solely because the child welfare agency had failed to find a suitable placement – justified both quoting extensively from a report included in the Dark Web data dump and accessing other files to verify it.

There certainly is a public interest in the failings of a state agency charged with the care of some of society’s most vulnerable members. The plight of the child, which culminated in a Police-escorted exit from hospital that was described by one staffer as “the most distressing discharge of her pediatric career”, is undoubtedly egregious.

In revealing the story, however, the media organisation entered what is perhaps the most sacrosanct area of privacy – personal medical records. All health information about individuals in this country falls under the Health Information Privacy Code and is treated as ‘medical in confidence’. It mirrors doctor/patient confidentiality and means that a person’s health information won’t be disclosed unless consented to or authorised by that person or through statutory authority (such as record sharing between health agencies). It was a very big step for RNZ to cross the line on medical records.

The story also related to a child in care – which is subject to strict limitations on publishing anything that might lead to the child’s identification. Newsroom is currently facing charges alleging such a breach during its investigations of Oranga Tamariki. Is it possible that the child in the Waikato Hospital can be identified?

The story also relied on stolen property as its source. The files had been unlawfully obtained by breaching computer security and accessed from a place that was beyond the reach of authorities that could have demanded their removal i.e. the Dark Web.

The public interest can be a strong defence that is recognised by both regulatory bodies and the courts. None sees it as outranking all other considerations. Rather, it is a matter of deciding where the correct balance should be struck.

That is the case with the RNZ story. It does have a strong case for a public interest defence, but it is not watertight. It was yet another example of the systemic failures of a government agency that has attracted complaints and a growing list of issues revealed by investigative journalists. However, this story did not publicise the plight of the child so that it might be released from hospital and placed in appropriate care. That had already happened. Nor was it a matter on which authorities had not acted. The DHB had asked for a review of the child’s care.

There is no dispute that the information had been unlawfully taken from the DHB. This was acknowledged in the RNZ story. However, there is no universal prohibition on the use of such material. The Media Council’s Statement of Principles allows for the use of information obtained by dishonest means if “there is an overriding public interest, and the news or information cannot be obtained by any other means”.

That was the justification used in the news media’s republication of the content of Cameron Slater’s emails hacked by the individual known as Rawshark and used by Nicky Hager in his book Dirty Politics.

Is the DHB material in the same league? Rawshark was a whistleblower. As far as we are aware, there was no financial gain to him (assuming it was a male) in hacking the emails. The purpose was to expose attack politics. The purpose of the assault that crippled the Waikato DHB’s computer systems was entirely pecuniary. It was an extortion bid and the hackers began feeding material onto the Dark Web in an attempt to force the board’s hand.

That, I believe, is a significant distinction. The DHB files were put on the Dark Web in order that they become public and embarrass – and scare – the DHB. Media use of the material serves that purpose. The message is clear: Don’t pay up and you’ll have more to deal with than disrupted services.

When the leaks were discovered, the GCSB’s National Cyber Security Centre (NCSC) said “malicious actors can monitor what is being said in the media, and this can influence their behaviour.” This surely was a message to media to be very careful, about their use of such material. The DHB issued a similar plea.

I do not believe RNZ’s use of the files was, on balance, justified.

The story was in the public interest but I am not satisfied that the broadcaster can meet the requirement that the information could not be obtained by other means.

It seems highly likely that RNZ was alerted to the child’s case when the hackers first sent it screenshots confirming they had placed material on the Dark Web. Had the DHB been approached with a general enquiry at that point, the case would probably have come to light and could be pursued without any reference to material involved in the hack. It is obvious from last week’s story that there were deep concerns among DHB staff. Had they been approached, it is odds-on that some of them would have recounted those concerns. There is no indication that RNZ reporters attempted that approach.

Nor am I satisfied that it justified examination of personal medical records. We don’t know exactly what documents RNZ read. It simply admitted that it “opened and read a small number” during what was a fishing expedition to verify the story about the child. In so doing, it at least created the possibility that personal medical records would be among the material it accessed. Use of such material must have a very high threshold. Given that the child was no longer at risk, I can’t see how this gets over the bar.

Media organisations often find themselves on the horns of dilemma. They need to weigh carefully which horn they will grasp. Occasionally they get gored.

UPDATE:  On Wednesday 4 August, the High Court granted a Waikato DHB injunction to prevent any further use of the hacked data. An agreement between the DHB and RNZ meant that, in return for destroying any copies of the material it is possession, RNZ would not be required to take down the story. In his decision, Justice Churchman stated: “In terms of where the overall justice of the matter lies, there are strong arguments to the effect that it is not in the public interest that the confidentiality of the private, personal and sensitive information in the Stolen Dataset be breached.” The decision can be found here: https://www.courtsofnz.govt.nz/assets/cases/2021/2021-NZHC-2002.pdf

Tomorrow and tomorrow and tomorrow

MediaWorks yesterday had a Macbeth moment. Burnham Wood didn’t come to Dunsinane but we can hear the opening strains of the Thane of Cawdor’s famous speech: Tomorrow and tomorrow and tomorrow.

Tomorrow is the day staff will hear the results of the company’s culture being conducted by Maria Dew QC. Originally they were to be briefed yesterday but in an email to staff on Sunday CEO Cam Wallace said the board of directors had requested more time to “process the findings and recommendations”.

Some media have reported that staff were frustrated by the delay but it may be worth the wait if MediaWorks is developing a detailed plan to implement those recommendations. Given that the company plans to publicly release the report on its website, it is vital that it also be ready to say what it is going to do about it.

Some staff have expressed the fear, according to TVNZ, that the ‘toxic culture’ that led to the review will not change. They may be wrong. Cam Wallace is a new broom who was never part of that culture. And one thing is certain: Maria Dew will not produce a report that is full of sound and fury, signifying nothing.

UPDATE: MediaWorks on Wednesday made public the review. Here is a link: https//mediaworks.co.nz/home/about/WorkplaceReview.html.

I will discuss it in next week’s commentary.

6 thoughts on “RNZ thrown by horns of dilemma

  1. Thanks Gavin. I agree that RNZ should not have trawled through the stolen material. Surely, that will only encourage hackers, possibly giving them one more string to their bow, even giving them some cover or justification for what is just criminal behaviour. It’s a dangerous form of empowerment.
    Despite temptation other media at others times have chosen a different course. In his book, Breaking News, Guardian editor Alan Rusbridger writes about the agreement he struck with the New York Times and ProPublica over the Snowden intelligence secrets dump. “The main stipulation [of the agreement] was that the NYT (and also ProPublica) wouldn’t use the archive as a bran tub to go fishing for stories unrelated to Snowden’s primary focus. I knew there were documents about Afghanistan, Iraq, even Kenya, in the archive. We weren’t going to look at that. This was about surveillance and civil liberties, not the wartime use of intelligence.” They all stuck to the agreement.

  2. On another topic, it is definitely time to stop “assuming it was a male”. The reasons are legion and it should be past time they need to be trotted out. If it’s a matter of style or grammar go with s/he, her/him, they/them. And despite what some think they/them has long been used singularly – since 1375, according to the Oxford English Dictionary:

    https://public.oed.com/blog/a-brief-history-of-singular-they/

    1. You misunderstand, Pippa. The character Rawshark in the graphic novel Watchman (from which the hacker took their identity) was a male. That is what I was referring to.

  3. Lost me. Was the assumption superfluous then? Or gratuitous?
    And just wondering what happened to my first comment … when I came in praise 🙂

    1. I referred to ‘he’ on the basis of the character but then thought it was equally possible that the whistleblower was a woman. Just covering both bases. And thanks for the other comment, which arrived later for some reason. The Rusbridger quote is a good example of the public interest test.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.