A Green MP has raised concerns about cybersecurity vulnerabilities in a failed immigration IT project during an urgent parliamentary debate.

The Biometric Capability Upgrade consumed more than $30 million over approximately 7 years before being terminated last year. Immigration Minister Erica Stanford disclosed the project's failure at a scrutiny hearing last week, saying she was furious that officials deliberately withheld information from her and former Labour ministers.

Greens immigration spokesperson Ricardo Menendez March questioned the security risks posed by the third-party contractor NEC, which MBIE had engaged to deliver the upgrade. "There were multiple attempts to reach agreement with NEC in resolving these vulnerabilities, and the report goes on to say that NEC was often slow or unwilling to address concerns raised by MBIE," March said.

He noted the system would have collected biometric data on refugees, asylum seekers and immigrants. "The biometric information that is supposed to be collected through this upgrade would have included information on refugees and asylum seekers or immigrants, and in the case of the former, we're talking about groups of people who would have been fleeing potentially life-threatening situations," March said.

The context for his concerns includes New Zealand's hosting of the Migration 5 pact, a data-sharing arrangement that connects Five Eyes countries through 36 networks across Anglosphere nations for traveller information exchange. The pact was projected in 2024 to process 8 million border movements annually.

A report on the project accused officials of misleading ministers and using creative accounting to hide the project from Cabinet. Staff who raised doubts were reportedly moved off the project.

Stanford said the original 2019 business case had a whole-of-life cost of $19.49 million, exceeding the $15 million threshold requiring ministerial signoff, but she could find no evidence ministers approved it. Officials in 2020 expanded the scope from an off-the-shelf technology upgrade to a larger workflow programme. The first ministerial paper appeared in November 2021, noting costs had increased above $30 million.

Labour immigration spokesperson Phil Twyford questioned MBIE chief executive Nic Blakeley and deputy Alison McDonald at a select committee in March, saying their answers amounted to flannel and dissembling. The project had already been shut down entirely when they appeared before the committee. Under parliamentary privilege, Twyford said he believed the officials misled Parliament.

Speaker Gerry Brownlee warned that specific allegations of misleading Parliament might be better tested in another forum. NZ First leader Winston Peters said that if officials lied to Parliament it could amount to fraud and criminal prosecution. The Public Service Commission has ordered an investigation into the failed project by Michael Heron KC.