Transport data centres dire
Leaked report reveals state of government agency’s tech setup, writes Tom PullarStrecker.
The New Zealand Transport Agency should re-watch The Italian Job, the leaker of a damning report into the agency’s computer centres says.
It is nearly 50 years since the 1969 original movie popularised the idea of hacking by depicting daring British robbers breaking into a computer room and messing with Turin’s traffic lights to pull off a heist.
But the computer centres that control New Zealand’s traffic lights, road signals and traffic cameras were labelled insecure, unsafe and rubbish-strewn in the leaked report.
The study into the New Zealand Transport Agency’s (NZTA’s) four data centres was conducted by consultant Resultex for the agency in 2015 and the NZTA said improvements had since been made.
But the whistleblower said the underlying issues had yet to be properly addressed.
The 38-page report singled out an NZTA data centre by the Auckland Harbour Bridge as the worst of the facilities and said the site was not suitable to house any ICT facilities.
Garbage was strewn across the floor, water had leaked through a large hole in the ceiling, and the lack of an emergency power-off button meant that if someone was electrocuted there would be no way to quickly turn off the electricity, Resultex said at the time of its inspection.
Security controls at all four centres were rudimentary, Resultex found. Three of the data centres could be broken into through a single door or papered-over window and none had dedicated security staff, it said.
At the NZTA’s Wellington facility, Resultex found eight to 10 orange/ red warning lights on different servers ‘‘indicating system error of some type’’.
Neither site was suitable because of seismic and other risks, it said.
Resultex ranked the standard of the facilities as between 0.4 and 1.5 out of five on the Uptime Institute’s scale for data centres.
The NZTA should be scoring at least a ‘‘3’’, it said.
A source said that after receiving the report NZTA had decided to move as much as possible of its information technology to the cloud, and had set up a programme to manage that.
But the project had been canned following management changes without the fundamental problems identified by Resultex being addressed, he said.
NZTA spokesman Andrew Knackstedt said a range of improvements had been made to address the issues identified in the report.
‘‘In particular, security and health and safety measures have been reviewed and strengthened at all four data centres.’’
The agency did not respond to the question of whether they had since been independently reassessed. The NZTA was evaluating moving some functions currently provided by the data centres to the cloud, Knackstedt said. ‘‘The data centre report is one component being considered as part of the agency’s direction and investment priorities.’’