Warnings before key immigration system pushed back until next year

• Biometric Capability Update was due to go live in less than three weeks' time
• Report a year ago showed deadline would not be met
• Capital expenditure doubled over four years

A $35 million upgrade to immigration identity systems has been deferred until after the busy summer period - despite officials' own advice about the risks of doing so.

Government documents also show warnings from an independent review that Immigration NZ (INZ) would not meet its 'go live' date, a year before this month's deadline, and that successful delivery of the change was 'unlikely'.

The Biometric Capability Update aimed to boost efficiency and security by improving automated checks on travellers' biometric information such as photographs. About 15 percent of checks have to be carried out by staff, because systems could not accurately detect whether a photo matched an existing immigration record.

But the key IT upgrade has now been delayed by six months until April and will cost an additional $1.3m, funded by visa fees.

A briefing to Education Minister Erica Stanford in March showed officials warning against pushing the Labour Weekend deadline back.

"Any decision to defer Go Live for a material amount of time (for whatever reason) will raise the risk profile during the peak holiday period and would not be supported. Deferral of Go Live post the holiday period would have an additional cost impact."

However, INZ spokesperson Michael Alp told RNZ the risk profile had not worsened as a result of the delay.

"The existing risks remain in terms of [the old] platform, the amount of manual resolutions that we have to undertake and coming into peak season just the sheer number of visas that come in - so you always have the risk associated with that and therefore we want to mitigate that as much as possible.

"We always want to reduce risk. But the next best piece of not being able to reduce risk is not increasing risk. So I guess that's where we've landed as the risk hasn't been increased - and certainly, I feel disappointed that we haven't been able to go live this year and all of our people working hard on the project, our vendors, our chief executive will feel disappointed as well that we haven't been able to launch this calendar year."

He said as the deadline approached there were bugs still being found during testing - although the number had been steadily decreasing - which made them wary of launching ahead of the summer rush for visas and electronic visa authorities (NZeTAs).

"So as we get into November, as you appreciate it's peak season and we wanted to ensure that the product that we have was operating properly and we weren't forced into a window where we were able to resolve the bugs and the defects and then have to go live shortly after that. One of the key components is once all the defects have been remedied, that our team does full end-to-end process testing, and things might come out of that - we don't know until that happens and we didn't want to be caught short on that."

System costs

Biometrics are personal data such as fingerprints and photographs, which are stored, matched and shared in automated systems, including with nations overseas such as those in Migration 5 or Five Country Conference countries of Australia, Canada, the US and UK.

"Identity resolution is a core component of INZ's processing of visa and NZeTA travel authority applications, ensuring only bona fide customers can travel to New Zealand," said the March briefing to Stanford. "INZ's identity holdings are also critical in supporting New Zealand's data sharing arrangements with other Migration 5 (M5) countries and is the authoritative source for non-New Zealander identity used by DIA, NZ Police and Ministry of Health."

The Biometric Capability Update (BCU) overhauls the system that checks whether photographs of travellers tally with existing immigration records, and reduces the manual work needed to check facial matches, said Alp.

"It makes the process more efficient and faster, so we would be able to improve the processing times for visa applications just through the automation process, and particularly where there might have been historical mismatches that have come through. So in some cases that could save several hours per application."

The INZ briefing to Stanford showed how the project's cost escalated since 2019, including a doubling of capital expenditure and four increases in as many years to its whole of life cost - from $19.5 million to $35m by last year.

That figure was under the threshold for needing Cabinet-level reports and was instead agreed by delegated ministers.

The March briefing suggested the project's cost would have to increase again to $40m - and go to Cabinet - due to the number of defects found, and infrastructure problems slowing its progress, but that did not eventuate.

INZ's IDme system, which is being retired next year, began in 2016 as part of the Vision2015 transformation programme, but had 'core components' that were sourced in 2012, said the briefing.

"At the time of the BCU business case approval these components were six years old and approaching end of life support during 2020. The initial scoping underestimated the requirements of the project.

"This together with technical challenges led to a full rescope of the project (from being an upgrade of the old system to the implementation of a new system). This allowed for significant changes from the original specifications to ensure that the initiative could work within the wider immigration platform."

Costs of the BCU grew because the project's scope expanded and resourcing constraints caused delays. Other factors included strengthening cyber security requirements, and MBIE's contractual obligations to pay fixed costs during testing and Covid-related delays.

Alp said INZ was also retiring parts of the Immigration Global Management System that provides identity matching and associated processes, and updating the NEC identity engine to provide that functionality.

"A number of smaller updates are required to other parts of the identity system including the identity enrolment, Application Management System (AMS) and Five Country Conference (FCC) to make use of the new data sources."