Lee Vandervis email data breaches
Simon Hibbert made this Official Information request to Dunedin City Council
This request has an unknown status. We're waiting for Simon Hibbert to read a recent response and update the status.
From: Simon Hibbert
Dear Dunedin City Council,
I see that Councillor Lee Vandervis uses his personal vandervision.co.nz domain for his council correspondence.
I note the specific email address lee[at]vandervision[dot]co[dot]nz is associated with three data breaches.
Please inform
1) What is the arrangement here and how it it emerge
2) Were any security issues flagged when this arangemnt arose? Please provide copies of any correspondence regarding this issue, specifically including written letters and electronic email
3) What due diligence did the council perform to ensure the integrity of council IT systems in this arrangement? Please provide costs for any external advice sought
Yours faithfully,
Simon Hibbert
Sent request to Dunedin City Council again.
Oliver Lineham (FYI.org.nz volunteer) left an annotation ()
Emails to the DCC official information address have been bouncing and retrying for a few weeks (looked like they had misconfigured it to forward to another address). I have just forced a resend and it appears to have delivered OK now.
- Oliver (admin)
Karen Anderson left an annotation ()
Just noting that re-sending the request starts the clock again.
I don't believe the DCC deserves that given the continual problems with LGOIMA's (especially those using fyi.org) and the never-ending problems with what it calls *improvements* to communications that it then uses to justify failing to do whatever it is supposed to have done.
Sent request to Dunedin City Council again, using a new contact address.
Oliver Lineham (FYI.org.nz volunteer) left an annotation ()
Hi Karen,
Resending does reset the due date shown here, and I don't have a way to change that sorry. Our displayed due date is not definitive or affect legal obligations. I recommend checking with the calculator on the front page of https://www.ombudsman.parliament.nz/.
What matters is when the request was "received" by the agency, which is when it enters the "designated information system". Our logs show DCC's email server accepting our emails for delivery. Between 1 and 60 minutes later we receive two bounce messages. Whether this counts as "received" would be up to the Ombudsman.
I raised the problem with DCC on 20 March, who said they are looking into it. We have received more bounce messages and not received any update. Since I have not had any update from them, I have switched to their general contact address, not their published LGOIMA one. So far it has not bounced.
Oliver
Karen Anderson left an annotation ()
Hi Oliver, thanks for responding.
I too contacted the DCC (on 22 March) and was informed the DCC was working with fyi to solve the problem. (As if the problem was at fyi end!)
I just checked and all the email validators I used are reporting that officialinformation@dcc.govt.nz is responding with a 451 (temporarily unavailable) so it appears nothing has been corrected.
I will try to find time to raise this again this week - the more voices, the faster the action.
In the mean-time, thank you for manually sending the requests on.
From: Lauren Riddle
Dunedin City Council
Kia ora Simon
I am writing in response to your information request, received on 22 March
2024, for information in regard to Councillor Lee Vandervis’ use of a
personal email address for Council correspondence. Our response to your
questions (restated below) are:
1) What is the arrangement here and how it it emerge
Cr Vandervis has used his [1][email address] email
address since 2004, when he first became an elected member of the Dunedin
City Council.
2) Were any security issues flagged when this arangemnt arose?
Please provide copies of any correspondence regarding this
issue, specifically including written letters and electronic email
We have undertaken a search of our records but have not
found any information or correspondence about any security issues
flagged. We have robust IT security systems in place and confirm that
there is no issue with the integrity of the IT system.
3) What due diligence did the council perform to ensure the
integrity of council IT systems in this arrangement? Please provide costs
for any external advice sought
Councillors do not have access to Council IT systems
regardless of whether they have a DCC or private email address. They only
receive emails from our mail server. We confirm that our search has not
found any costs for external advice on this matter.
I trust that this responds to your information request.
Lauren Riddle
Mana Whakahaere Kairuruku / Governance Support Officer
Governance Group
P 03 477 4000 | DD 03 474 3428 | E [email address]
Te Kaunihera a Rohe o Ōtepoti - Dunedin City Council
50 The Octagon, Dunedin
PO Box 5045, Dunedin 9054
New Zealand
[2]www.dunedin.govt.nz
[3]DCC - Annual Plan 2024
--------------------------------------------------------------------------
If this message is not intended for you please delete it and notify us
immediately; you are warned that any further use, dissemination,
distribution or reproduction of this material by you is prohibited..
--------------------------------------------------------------------------
References
Visible links
1. mailto:[email address]
2. http://www.dunedin.govt.nz/
3. https://au-api.mimecast.com/s/click/v6P2...
Oliver Lineham (FYI.org.nz volunteer) left an annotation ()
Just to close off the comments above: the issue has been resolved by DCC's IT provider. Although it initially took a few weeks, they were very helpful this week and we have confirmed through testing that the problem is resolved.
Despite the bounces we saw, I believe this should not have stopped the messages being delivered to the people who needed to receive them. But this is not something I can be certain of.
Things to do with this request
- Add an annotation (to help the requester or others)
- Download a zip file of all correspondence
Karen Anderson left an annotation ()
The *last* date to respond to this request is today. If the DCC fails to respond I would urge you to immediately lodge a delay complaint with the Ombudsman.
Link to this