The Transport Agency plans to spend more than $50 million tackling risks to its outdated technology that have been rated "critical" for years.
Internal reports showed the agency had so far managed to overhaul its advanced traffic management system that helps keep roads safe.
However, pressure on resources meant it had to go looking for other projects to pause or defer.
One impact was that the national ticketing system had been delayed yet again. The timeline for the one-card-fits-all public transport system had been pushed back by at least six months, to 2023-24 for Canterbury, and for all other regions by 2026.
The reports released to RNZ under an Official Information Act (OIA) request also showed "critical" problems both in getting enough skilled workers, and for the whole agency to cope with all the changes.
Waka Kotahi's technology risk rating has been stuck at "critical" since it introduced the measure in 2018-19.
"A critical risk rating means that it is possible the Transport Agency's technology systems may stop performing, in part or whole, and may not be recoverable for extended periods (weeks or months), with extreme consequences," an annual report said.
The new solution was expected to cost $55m, with $15m to be spent in 2023-24.
The biggest chunks would be $34m needed for tech "remediation [to] alleviate operational risks to core services", and $15m for cybersecurity.
The agency refused to release any details about its cybersecurity - one of its "top risks" - or the briefing it gave the government about them in March.
"Releasing this information may reveal gaps within our digital platforms, which could lead to breaches," it said in the OIA response.
"The impact would be severe. For example, a breach could result in chaos through the transport system, with critical systems misused, accidents, or even death."
By April, 97 out of the agency's 112 websites had firewalls in place, and all were due to be protected by mid-2022.
"We have reduced our ratings across ten of the identified risk categories."
The agency has 51 tech projects on the go - only one, its ITS network fix, was showing "red" for delays, the worst rating on the red-amber-green scale NZTA uses.
Overall, the whole effort was rated amber, though quality was at green, in the latest risk register in a third-quarter report for 2021-22.
"This is a large portfolio of projects to deliver for an organisation of our size and is further impacted by the shortage of skilled project resources," it said in February.
Its executives were "currently reviewing project priorities to identify what projects can be paused or deferred to the new financial year".
It had put a digital strategy in place.
"While some risks have already been mitigated, remediation of other risks will require multi-year programmes of work," its reports said.
The advanced traffic management system needed more urgent fixing.
It is relied upon to connect all cameras, message and speed signs, weather data, tunnel safety systems and more, but in 2020 was "at the end-of-life and has very limited support", which carried "the risk of it failing".
Its upgrade was now largely complete, with the Auckland and Wellington transport operation centres and Lyttleton tunnel getting improved alert systems recently.
The approach to the overall upgrade was itself risky. "High level feasibility analysis will also happen as part of the discovery phase, but unlike traditional Waka Kotahi projects we will not know a detailed design before we commence build."
Also, it said "resourcing remains critical". One response was benchmarking pay against IT market rates - and "risk associated with our inability to predict, assess and absorb enterprise-wide change impacts continues to be rated as critical", the reports said.
Some systems remain years overdue or not delivering what they should, including:
- The National Incident and Event Management System (NIEMS) that is limited to just Wellington and Christchurch; it is up for review in 2024.
- The Traffic Road Event Information System (TREIS) that reports on crashes and the like in real-time; up for review in 2024.
- The national ticketing system. Work began on it in 2016, but just when it will roll out and where remains up in the air.
"Timings ... are still being agreed," Waka Kotahi said in its OIA response.
The latest plan was that Canterbury would trial the ticket system next year instead of in 2022, and the Wellington region, instead of getting it in 2022/23, would join the rest of the country in getting it by 2026.
Greater Wellington Regional Council runs the Metlink public transport system, and said it was conscious that "a progressive nationwide rollout of this size may take some time".
Meantime, NZTA was helping it introduce Snapper cards on all trains, it said.
