The Ministry of Social Development has taken years to implement a policy on using fake social media profiles. File photo. Photo: RNZ / Rebekah Parsons-King
The Ministry of Social Development (MSD) will permanently ban staff from using fake profiles on social media sites to spy on beneficiaries in fraud investigations.
RNZ inquiries have revealed the ministry secretly used the fake profiles for years, before suspending the practice in 2021 when parliament was asked about it.
But a policy that bans the practice only fully kicks in from next month.
"We accept that the policy has taken considerable time to finalise," MSD told RNZ.
Internal papers show the ministry knew by 2017 that the use of fake profiles was a "misleading" practice, and that it was breaking social media platforms' own rules, but judged the risk was worth it to get hold of personal information.
"This practice does not currently break any New Zealand laws," said a 2017 report newly released to RNZ under the OIA. "Currently the MSD Acting Security Intelligence Manager accepts the risk of using fake profiles to hide the identity of the analyst."
But by 2021, independent reviewers were telling the ministry the practice "can be viewed as deceptive and underhanded".
"The use of pseudo or skeleton social media profiles is of particular concern," they said.
They found the controls were "ineffective" - not all the information gathered online of people who were not targets was being blurred out, which appeared to be "unnecessarily invasive and a potential intrusion of privacy on the general public".
The papers showed the ministry paused the practice in June 2021, after a question in Parliament was asked about pseudo profiles.
It had already been using the fakes for years by then.
The practice persisted throughout the course of several inquiries and a 2018 crackdown across the public sector, aimed at rooting out dodgy information-gathering practices. This came after other agencies were caught using private spy firms to surveil the public.
Around this time, the Ministry of Business, Innovation and Employment was criticised over training its staff to use fake social media personas in immigration investigations.
But the Ministry of Social Development carried on with the practice.
A public inquiry in 2019 found MSD had acted improperly and breached people's privacy in gathering data without them knowing - but it failed to mention the use of fake personas.
RNZ has asked the Office of the Privacy Commissioner - which carried out the inquiry - if it knew about the practice.
The 2019 inquiry found that up to two-thirds of all investigations did not turn up evidence of fraud.
The ministry kept the use of fake personas secret from clients and the public.
"We inform clients of information we gather, and this is covered on the Work and Income website Privacy Notice. However this Privacy Notice did not include reference to the use of pseudo profiles for gathering information from social media that was stopped in 2021," spokesperson George van Ooyen told RNZ.
The fake profiles came to light in an American researcher's work this year, but it did not go into details.
Van Ooyen said MSD accepted that the 2021 internal assurance review by Ernst and Young had highlighted that "our practice wasn't up to standard".
The review said: "Ineffective controls within the intelligence unit over the use of social media for information gathering purposes not only poses an unmitigated privacy risk for the ministry, but also a significant reputational risk."
Van Ooyen said it was important to note the social media info gathering was "passive", as analysts merely logged in with the fake profiles and did not interact with others.
Only publicly available information was harvested with the fake profiles, and analysts were told not to go "fishing" for beneficiaries other than the target, the papers said.
They suggest the ministry was using fake profiles for years without any social media guidelines, which it first introduced in 2017.
Analysts were using "discreet online persona … to mitigate the risk of leaving a footprint behind, and potential identification by the person they are looking into".
"Skeleton" profiles had fake names and fake email addresses but "no profile picture will be used, no pages liked and any interaction with comments/likes will not happen".
"This will make sure the profile does not mislead anyone further than already necessary," the 2017 guidelines said.
"Analysts will not engage in misleading behaviour to collect private information. Thus, they are not collecting information through a manner that is deemed unlawful, unfair or unreasonably intrusive."
The fake personas were used to varying extents across five popular platforms - Facebook, Instagram, Youtube, Twitter and LinkedIn.
"We are currently breaking the terms and conditions for the different platforms when using a false account," its 2017 guidelines said.
But since it only risked deactivation of a profile if it were caught, the risk was "worth taking as the payoff of the information gathered would outweigh" it.
In 2018, the Public Service Commission - spurred by a public outcry - issued stricter guidelines, demanding agencies have policies and be transparent about how they gathered personal information.
It has taken MSD until now to come up with a policy. This was circulated internally in July, to be implemented by October.
Van Ooyen said the delay was due to the pandemic and having to focus on the wage subsidy scheme.
"This was a very substantial programme of work," he said.
The new policy still allows investigations to use social media, but MSD must identify itself. It can no longer use profiles on Facebook.
MSD told RNZ it did not use fake personas for its investigations into Covid-19 wage subsidies.
The newly released papers also show that MSD moved in 2022 to find out if it was complying with the public sector guidelines on information gathering issued four years before, with an independent review finding that it largely was by then.
