"THE CROWN'S DIGITAL TOHU: How a Rogue Neoliberal Government Sold the Whakapapa of a Nation to the Highest Unvetted Bidder" - 22 March 2026
They couldn't steal the land fast enough, so they handed your children's data to strangers they never even looked in the eye
Mōrena ano Aotearoa,
Help me to get rid of this government at the end of the year by being informed about what is really going on.
While Christopher Luxon's National-ACT government preaches fiscal responsibility and security to the public, a damning Treasury quarterly report has revealed a rotting truth beneath the polished PR: government data — your health records, benefit files, housing information, the digital whakapapa of every person in Aotearoa — is being held by unvetted offshore third parties that no one in Wellington can name, has checked, or will take responsibility for.
As revealed by RNZ, when this scandal was exposed through an Official Information Act request, the GCSB Director-General took 120 working days to respond — six times beyond the legal limit — and then used his three pages to explain precisely why he would say nothing. This is not a cyber security gap. This is colonialism with a keyboard.
The Deep Dive Podcast
Listen to a lively conversation between two hosts, unpacking and connecting topics in the sources of this essay
The Metaphor: The Pātaka Raped by Strangers
Imagine the most sacred pātaka in your kāinga — the storehouse where the whakapapa of every whānau member, every birth, every health record, every movement is kept. The Crown was given the keys to that pātaka as a matter of trust. Not unconditional trust — trust bound by Treaty, by covenant, by the weight of obligation across generations.
Now imagine that Crown handing those keys to strangers in distant rooms — strangers they never vetted, never interviewed, never looked in the eye. And when you ask "who are these people and what are they doing with our taonga?", the spymaster in Wellington takes 120 working days to respond — six times past the legal deadline — only to offer a three-page apology and refuse to name a single name.
That is not negligence. That is the colonial infrastructure performing exactly as designed: extract, obscure, deny, apologise, repeat.
The Evidence: What Treasury Told Ministers and What the GCSB Then Buried
As revealed by RNZ, the GCSB's own Treasury quarterly investment report — covering the three months to December 2024 — confirmed that government agencies had raised alarm bells about
"vendors who had offshored some services without their prior approval, meaning government data was being managed or held by unvetted third parties."
Let that settle: without prior approval. Your data. Offshore. No one you can name. No one who was checked.
GCSB Director-General Andrew Clark — a man paid handsomely from public money to protect the public — took 120 working days to respond to an OIA request, compared to the statutory 20. He then refused to identify the problem vendors, refused to identify the agencies that raised the alarm, and refused to disclose the specific risks — this last refusal on the extraordinary grounds that the GCSB "does not hold this information in the manner or format requested." The data is floating in offshore servers and no one at the Crown's own cyber security command knows where it is.
The Treasury report also confirmed what every systems engineer already knew: New Zealand government agencies are dangerously concentrated in their dependence on a handful of US Big Tech cloud providers, with low competition and poor service delivery creating systemic risk across the entire public sector. One cyber incident at one of these vendors, and the digital infrastructure of Aotearoa collapses like a rotten pou.
The Tikanga Violation: Why This Is Not Just a "Cyber Security Issue"
To understand why this strikes at the heart of tikanga, the Western mind must first understand a foundational truth: in te ao Māori, data is not metadata. Data is whakapapa.
As Te Mana Raraunga — the Māori Data Sovereignty Network — has stated clearly: data is a living taonga, subject to Māori governance, carrying the collective identity not just of individuals but of hapū and iwi across time. The Waitangi Tribunal has affirmed that Māori data is a taonga; that Māori have sovereignty over Māori data; that the Crown holds Treaty obligations to protect and govern that data under tikanga frameworks.
When a Western corporation loses your credit card data, it is a privacy breach. When the Crown hands Māori data — health records, benefit data, housing records, taura whiri — to an unvetted offshore third party, it is an act of desecration.
It violates:
- Tapu — the sacred protected status of whakapapa information
- Kaitiakitanga — the guardianship and protective stewardship the Crown was obligated to exercise
- Mana — the dignity and self-determination of whānau who never consented to offshore exposure
- Rangatiratanga — the guaranteed right of Māori to determine what happens with Māori information
As Dr Karaitiana Taiuru — Aotearoa's foremost AI and data ethics expert — has documented in his 2025 State of the Nation report, a critical disparity exists between established Māori data governance frameworks and their practical implementation, with many government entities under-resourcing Māori data initiatives while simultaneously expanding surveillance infrastructure. The Crown knows the framework. It chooses to ignore it.
Three Examples for the Western Mind: Quantified Harm, Named Names, Clear Solutions
Example 1: The Health Data Exposure — When Your Whakapapa Becomes a Product
In January 2026, the ManageMyHealth data breach exposed the patient data of tens of thousands of New Zealanders — including Māori health records held within centralised digital systems. Māori are disproportionately represented in public health data because colonisation created the conditions — poverty, overcrowding, environmental degradation — that forced whānau into ongoing Crown health dependency.
The harm: When health data sits on unvetted offshore infrastructure, it is subject to the laws of the country where the server sits — not New Zealand law, and certainly not tikanga. As RNZ reported, "when our data is stored in Microsoft or Google's cloud, it's governed by the laws of those American companies." Under US law, federal agencies can compel disclosure. Under tikanga, disclosure without consent is a violation of tapu.
The solution: Mandatory onshoring of all Māori health data with hapū-governed encryption keys — exactly the model pioneered by Te Tumu Paeroa's deal with Microsoft, which took years of negotiation to achieve what the Crown should have mandated for every government agency by default.
Example 2: The Facial Recognition Betrayal — Surveillance Without Consent
The Department of Internal Affairs awarded a facial recognition contract to DXC Technology, using Neoface software from Japanese firm NEC, without conducting a full privacy impact assessment. Meanwhile, the Ministry of Social Development extended its own facial recognition system — built on Irish firm Daon's technology — to search the Waka Kotahi driver licence database, without consulting a single Māori data specialist.
The harm: Māori are already over-surveilled by the state — overrepresented in corrections data, welfare data, court data. Facial recognition trained on biased datasets will misidentify Māori at higher rates, compounding existing discriminatory outcomes. The Privacy Commissioner was given no input before deployment. Te Mana Raraunga called it a breach of Te Tiriti obligations. The Waitangi Tribunal agreed that a claim was warranted.
The solution: A moratorium on all facial recognition technology in government until an independent, Māori-led privacy impact assessment is completed. Full implementation of the Te Mana Raraunga principles as binding requirements — not voluntary guidelines — for all government data procurement.
Example 3: The Census Abolition — Destroying the Compass to Hide the Map
In 2025, this government announced it would scrap the national census and replace it with an "administrative" system drawing on day-to-day government data.
As Te Mana Raraunga warned: this creates a form of invisible surveillance — data collection without the informed consent of the individual, aggregated by the same state that has historically used data to dispossess Māori land and suppress Māori culture.
The harm: The Mana Ōrite agreement between Stats NZ and the Data Iwi Leaders Group — which solidified iwi authority over their own data — now faces being bypassed entirely by administrative data flows that Māori never consented to, governed by vendors Māori never vetted. The Waitangi Tribunal found the Crown breached Te Tiriti in its CPTPP e-commerce provisions by posing "significant risks to Māori rights, especially over data sovereignty and the protection of mātauranga Māori."
The solution: Immediate independent analysis of the new census methodology against Te Tiriti principles. Mandatory engagement with the Data Iwi Leaders Group and continuation of the Mana Ōrite agreement as a legal requirement, not a political preference.
The Hidden Architecture: Five Verified Connections
What the mainstream media presents as a "cyber security gap" is in fact a structural colonial data extraction system operating on five interconnected tracks:
- Track One — The OIA Wall: The GCSB refused virtually all OIA questions, citing "commercial sensitivity" for unnamed vendors and "confidentiality" for unnamed agencies. As RNZ documented, the three-page refusal was mostly outlining grounds for refusal. Transparency is structurally disabled — not accidentally, but by design.
- Track Two — The Vendor Concentration Trap: The same Treasury report warned that low competition and high reliance on a few vendors creates systemic risk. This is the neoliberal procurement model executing perfectly: strip public sector capability, outsource to private monopolies, create dependency, then refuse accountability when the monopoly fails.
- Track Three — The Financing Rules Cage: As Treasury's own September 2025 quarterly report confirmed, current capital and operating expenditure rules are "preventing agencies from modernising" their cyber security. The government has simultaneously refused to fund secure onshore infrastructure while handing data to offshore vendors who operate without oversight.
- Track Four — The IDI Redaction: A 2025 RNZ investigation found that over two-thirds of the 95-page business case for overhauling the Integrated Data Infrastructure — the most powerful government database in Aotearoa, holding anonymised records on every New Zealander including Māori — was entirely redacted. The "Commercial Case" and "Financial Case" were blanked out entirely. The system that holds whakapapa-adjacent data is being expanded under a funding model no one is allowed to see.
- Track Five — The Israeli Surveillance Precedent: This government's use of Cobwebs Technologies — a firm run by Israeli ex-spies and military commanders — to monitor all major social media platforms, including "political information" and "religious preference", was approved by MBIE without Privacy Commissioner oversight. The same institutional culture that permitted Cobwebs is the culture now refusing to disclose which unvetted third parties hold government data offshore.
Previous Essays by The Māori Green Lantern
This essay sits within a body of investigative mahi from The Māori Green Lantern examining how colonial structures weaponise information systems against Māori. Previous investigations include:
- The Honey Trap Whakapapa: How an Israeli Billion-Dollar Blackmail Machine Weaponised Children — tracing how intelligence-linked surveillance operations are exported globally, and how Māori have always understood that those who control information control power.
- Heather Cox-Richardson — Te Taiaha o te Aroha: The Weapon They Cannot Confiscate — examining how white supremacist governments burn information infrastructure while preaching transparency.
- The Māori Green Lantern and the Wharenui That Walked: How a Māori Voice Burned the Colonial Platform and Built a Digital Marae on Sovereign Ground — the essay that established the foundational framework: digital sovereignty is territorial sovereignty by another name, and those who control the data infrastructure control the future of the people.
The Verdict: Colonial Infrastructure, Digital Edition
This Luxon-led National-ACT government — wedded to neoliberal market theology and the Atlas Network's privatise-everything doctrine — has created the precise conditions for this catastrophe. In one devastating act of structural negligence masquerading as governance, it has defunded public sector digital capability through ideological austerity, locked agencies into dependence on private offshore monopolies, refused to fund secure onshore infrastructure, suppressed OIA transparency using commercial sensitivity as a weapon, dismantled the census's consent-based data model, expanded facial recognition without Māori consultation, and left the GCSB to respond to critical security questions 100 days late — only to say nothing. And they did all of this while the Waitangi Tribunal had already declared that Māori data is a taonga, that the Crown has active Treaty obligations to protect it, and that Māori must hold power to determine how their data is used, shared, and protected.
The Crown knows this. It is not ignorance. It is contempt.
This is the architecture of a government that tells you it is protecting Aotearoa's digital future while quietly handing the pātaka keys to strangers in jurisdictions that answer to no one here. The GCSB Director-General sends a three-page apology — 100 days late — explaining why he cannot tell you who the strangers are. Meanwhile, the Waitangi Tribunal rulings gather dust on shelves in the same ministerial buildings where officials are approving offshore vendor contracts in the dark. The pātaka has been left unlocked. The strangers have been given the keys. And those responsible are busy preparing their next press release about fiscal responsibility.
Koha Consideration
The Crown refuses to name the vendors holding your data. The GCSB refuses to name the agencies raising the alarms. The entire redacted architecture of a surveillance state that cannot secure its own house is funded by your taxes — and defended by the people you pay.
This essay exists because someone chose to fund the accountability that those structures will never provide. Every koha to the Māori Green Lantern is a direct investment in the only investigative mahi that names the names, traces the networks, and holds this digital desecration to the light. Your whakapapa deserves a guardian. This is kaitiakitanga in action.
If you are unable to koha — no worries. Subscribe, follow, kōrero, and share with your whānau and friends. That is koha. Every share extends the reach of this taiaha.
Three pathways exist:
Koha directly: Koha — Support the Māori Green Lantern
Subscribe for essays direct to your inbox: Subscribe to The Māori Green Lantern
Direct bank transfer: HTDM — 03-1546-0415173-000
Kia kaha, whānau. Your data is your whakapapa. Do not let them hand it to strangers in the dark.
Research conducted 22 March 2026. Sources verified via RNZ, Te Mana Raraunga, Dr Karaitiana Taiuru's 2025 State of the Nation Report, Te Ara, Waitangi Tribunal findings, and GCSB OIA response as reported by RNZ. The Māori Green Lantern discloses: search_web, fetch_url, and document research tools were used in the preparation of this essay. Ko Ivor Jones — Tohunga mau rākau wairua. The mahi is complete. Kia kaha.
