Emergency Management Minister Kieran McAnulty. Photo: RNZ / Samuel Rillstone
Vital changes for disaster-proofing critical infrastructure like phones, power and roads have serious flaws, warn government officials.
Legislation was tabled in Parliament last week to try to head off a repeat of the crippling effects of another Cyclone Gabrielle.
But the bill is contentious, with industry and the Ministry of Business, Innovation and Employment (MBIE) opposed to parts of it.
At the same time a second wave of reform had begun, opening this week for consultation about the crucial regulatory side of things, almost a year after officials warned of "consequential gaps" that needed "immediate" filling.
The bill would help "ensure that some of the most consequential gaps in our regulatory settings (such as the small number of critical infrastructure entities currently required to meet centrally set resilience standards) are filled in the immediate term", they said.
Also, it was not clear what "immediate" action was being taken among the raft of agencies involve to fill the gaps, described like this:
- "No agency has responsibility for the critical infrastructure system"
- "We have been unable to set national risk tolerances and standards"
- "A number of critical sectors are not subject to regulation around their resilience at all - such as cloud service providers, data storage centres", consumer-goods supply chains, "forthcoming technologies that will support smart cities and the internet of things, all sit outside New Zealand's existing regulatory frameworks."
It was a game of catch-up for New Zealand, with other developed countries more advanced on disaster-proofing their services in the face of the growing threat of natural disasters and man-made hazards, while relying on systems that were not fit to cope.
During Gabrielle, the government did not even make clear what they should reconnect first - emergency services, hospitals or something else, the telcos said in a new report.
"Telecommunications was not prioritised as critical infrastructure during the recent events," it said.
The government said the new Emergency Management Bill aimed to modernise resilience. But it was much more about the aftermath of disaster and making Civil Defence run better, rather than the preparation beforehand.
It did not deliver the government powers to set new minimum standards for building essential services, something officials listed last year as one of three fundamentals, alongside a single central agency being in charge of critical national infrastructure system and joined-up understanding of what was missing and what was needed.
While national security officials last year said "wholesale changes" to regulations were needed, Emergency Management Minister Kieran McAnulty said it was not a "fundamental transformation" when he introduced the bill.
The legislation's focus was not on critical infrastructure resilience, but on emergency management, he added in a statement to RNZ on Thursday.
The broader "regulatory changes will not happen in the immediate term - it is important that we take the time needed to get this right", McAnulty said.
MBIE registered deep concerns about the whole two-wave approach and wanted to abandon parts of the bill, so as to launch one single big wave of reform instead, newly released papers show.
"Any increased infrastructure resilience will have cost of living implications for consumers," it said in August.
"There are also significant risks that the critical infrastructure proposals in the paper may not lead to all the outcomes NEMA (National Emergency Management Agency) is seeking, and some of the proposals could instead lead to compliance costs without any corresponding benefits to New Zealanders."
Its three key concerns covered not knowing where funding was coming from, the two-part approach risking regulatory "confusion" and fatigue, and forcing more reporting-back demands on to companies.
The bill said companies must report back annually to the government on their plans to deliver services after a disaster.
While this was "unlikely to provide meaningful information", companies did this anyway, MBIE said.
The electricity, telecommunications, and ports companies also opposed this, saying it was more red tape and costs, the papers showed.
Officials though had advised the government needed "new powers to gather information on risks and vulnerabilities".
MBIE declined to talk to RNZ for this story.
The bill was due to be introduced last October, then in February, but delayed by Cyclone Gabrielle.
There was urgency evident in the official advice to the government 10 months before the cyclone hit. They told National Security and Intelligence Minister Jacinda Ardern in May 2022 the known vulnerabilities in New Zealand's system "could result in a natural disaster or other emergency having more significant impacts than otherwise would be the case", which Gabrielle proved.
Cyclone Gabrielle. Photo: JMA
While the legislation would take time, the government has held out as a remedy to the cyclone's violence, the $6b National Resilience Plan that was a centrepiece of Budget 2023.
But there was nothing immediate about that either: Grant Robertson's office told RNZ this week "there is not a published plan currently" and "there is no published plan/programme as yet".
There was also a scoping study on standards for critical infrastructure going on, but that was not due to be finished till 2025.
Time was slipping in other ways. The bill delayed for two years the drawing up of a new list of what actually constitutes 'critical national infrastructure', to give the companies time to adapt.
NEMA was the lead agency on the legislative reform. Heading the second wave was the Department of Prime Minister and Cabinet (DPMC). It launched a $5m consultation on the regulatory reforms this week that lasts until August.
