Immigration system approved visas without any human

A fault in Immigration New Zealand's new online system let some visa applications be approved with no immigration officer ever assessing them. More than 55 job checks and visitor visas went through automatically before the problem was found last year. It is one of several flaws identified in the ADEPT platform, part of the $336 million Our Future Services IT programme.

That programme is now under review. Cabinet has asked for a new business case after it emerged that predicted benefits had been overstated by $134 million. It had promised $453 million in savings but, on current estimates, would now cost money if it goes ahead. About $25 million was spent in its first year.

The bigger question is trust. If a system can approve a visa without a person looking at it, how confident can New Zealanders be in the rest of the workflow?

The record

Automated decision-making had already been enabled through legislation, but INZ had not used the power. Last year the agency said Our Future Services would eventually include end-to-end automated decisions, but that the systems were about two years away from the data input, testing and quality assurance needed to make those decisions well. INZ has also previously said only immigration officers would be able to make a decision to reject a visa application.

Months after that, it found a visitor visa had been approved without any manual assessment. A sweep then found 32 visitor visa applications approved that way over the previous three years. It also found 23 Job Check applications approved without manual assessment between February and November 2022.

INZ told immigration minister Erica Stanford that technical advisors had reviewed all 32 visitor visas. Twenty of those visas had been used for travel to New Zealand with no adverse outcome noted. Six applications were reopened for full assessment because of high risk factors, and one was recommended for decline.

The fix took two months. INZ said earlier attempts to deploy it in October were complicated by wider Microsoft issues.

Other faults have since surfaced. In March last year a fix was made for a job token problem affecting accredited employer work visas, involving about 2300 employers whose accreditation had expired and been renewed. Two months later, staff found that 364 parent and grandparent multiple entry visitor visa applicants were not asked whether they had lived in a country with a high incidence of tuberculosis since their last clear chest x-ray. Of those, 295 were granted visas, and another 21 applicants were not asked for an x-ray despite declaring more than six months in such a country.

Most recently, after a system update on 23 August, an unknown number of tourist applications with a secondary applicant could not be submitted. A permanent fix was applied on 26 August.

Open questions

The visitor visa cases stretch across three years, yet the fault was only found last year. What checks would have caught it sooner, and why did none do so?

The agency says a technical fault let the same automated step run more than once, which let an application move past manual assessment. That explains the mechanism. It leaves open whether similar workflow gaps exist elsewhere, and how INZ will show it has ruled them out beyond close monitoring.

Then there is the money. If benefits were overstated by $134 million, who signed off the original figures, and what changed? The new business case is meant to test the strategic case for change, the finances and future delivery, so those answers may come out in that process.

The other side

INZ's position is that it acted quickly once it found the problem. It says it investigated immediately, ran a full sweep for other cases, and had technical advisors review every auto-approved visitor visa. Its online services director, Katy MacLeod, said the cause was a technical fault, not a decision by the system to judge applications.

On the TB issue, officials told the minister that individual risk of currently having TB is still relatively low. INZ intends to contact the affected applicants and ask them to seek medical advice if they have, or develop, symptoms. On the tourist submission problem, MacLeod said it was resolved, and that INZ put measures in place straight away to help affected applicants submit.

There is also a fair case that finding and reporting faults is what a working assurance process should do. The agency notified the minister, and the numbers involved are small next to the total volume of applications. Big IT projects also tend to have teething problems, which is why they are reviewed.

What happens next

Cabinet asked earlier this month for a new business case for Our Future Services. The Ministry of Business, Innovation and Employment must report back to ministers before April next year. It will reassess the programme's strategic case for change, its finances and its future delivery frameworks.

Watch for whether ministers decide to continue, reshape or stop the programme, and for what that means for the planned move to automated decision-making. Watch too for whether further faults are disclosed while the review runs, and how many applicants affected by earlier ones, including the TB cases, are followed up.