A note upfront: I'm the primary developer of NZPT (New Zealand Politics Toolbox), including the urgency tracker at nzpt.cjs.nz/urgency. Everything that follows is written through that lens. I have a direct stake in this issue, and I think that's worth knowing.
NZPT is a free, online, and opensource toolbox to help you better understand NZ Politics. You can check it out here.
Democracy runs on information. The entire reason Hansard exists, the reason select committee submissions are published, the reason Parliament broadcasts its debates is that the public has a right to know what is being done in their name. Transparency isn't a feature of Aotearoa New Zealand's democracy; it's the foundation of it.
So when a small, quiet technical change makes that information harder to access not just for journalists, not just for researchers, but for the automated tools that have become essential to modern civic monitoring it's worth asking why.
What happened?
The New Zealand Parliamentary Service has placed its RSS feeds behind Radware Bot Manager, a commercial bot-detection and anti-scraping product. On the surface, this might sound like a reasonable security measure. Radware is designed to protect websites from malicious automated traffic such as DDoS attacks. It's a legitimate tool with legitimate uses.
The Parliament Website has built-in RSS support for its posts, such as the daily progress summary.
But RSS feeds are not a security vulnerability. They are a feature. RSS (Really Simple Syndication) exists specifically so that software can automatically consume and republish structured data. Feed readers, news aggregators, monitoring tools, and civic tech applications all rely on being able to fetch an RSS feed programmatically, on a schedule, without a human sitting there clicking refresh. That's the entire point.
When you put an RSS feed behind a bot-detection wall, you've made a category error. You've applied anti-scraping logic to a feed designed to be consumed by exactly the kind of automated, non-human clients that bot managers are trained to block. The result is predictable: the feed breaks for every legitimate automated consumer, while providing essentially no additional protection from anything that was actually threatening.
A real-life impact.
I built NZPT's urgency tracker because I couldn't find any existing tool that tracked how often the New Zealand Parliament uses urgency to pass legislation without the usual scrutiny. Urgency is not inherently bad. Sometimes genuine emergencies demand it. But it can also be used to rush through legislation without public consultation, without select committee hearings, and without the opposition having adequate time to scrutinise what's being voted on.
As of May 2026, the 54th Parliament has used urgency on 19 occasions, affecting more than half of the bills that have passed through it. That is a significant figure. It matters to New Zealanders who want to understand how their laws are being made. Tracking it requires reliable, automated access to the data Parliament publishes, including via RSS.
The RSS feed, alongside the rest of the Parliament.NZ, is behind a bot-prevention application layer called "Radware". This blocks tools such as NZPT from accessing the information on the site easily.
The notice I have had to put on the urgency tracker says it plainly: Parliament's website has recently undergone changes that have affected the tool's functionality. That's the Radware wall doing its job, blocking the automated requests that the tracker depends on to stay current. Speaking technically, it is easy enough to bypass, but the real problem isn't really a technical one. The problem is that a decision was made, somewhere inside the Parliamentary Service, that automated access to public parliamentary data should be treated as a threat.
Why does this matter?
NZPT is one project made by one person in my spare time. But the principle extends far beyond it.
Civic tech in New Zealand is a small, underfunded, largely volunteer-driven ecosystem. The tools that do exist, these tools that turn raw parliamentary data into something ordinary people can understand and act on, rely on programmatic access to public data. Break that access, and you don't just break the tools. You raise the barrier to entry so high that many potential future tools simply never get built.
A notice on the NZPT Urgency Tracker explaining that the tracker has had issues since the Radware installation by the New Zealand Parliamentary Service.
This is the quiet cost of "security by default" applied without nuance. Radware's own marketing materials describe its target markets as online marketplaces, e-commerce platforms, and classified ad sites. These are businesses with a genuine commercial interest in preventing data theft. Parliament is not a business. Its data is not a competitive asset to be hoarded. It is a public record, produced at public expense, for public benefit.
There is also something faintly ironic about this happening in the context of urgency. One of the arguments against the urgency process is that it can be used to limit public scrutiny of legislation.
When the very tools designed to provide that scrutiny are themselves quietly blocked by an infrastructure decision, the effect (even if entirely unintentional) is the same: less visibility, less accountability, less ability for ordinary New Zealanders to see what is being done in their Parliament.
What should happen?
I'm not suggesting the Parliamentary Service should operate with no security. Genuine threats exist, and protecting public infrastructure from DDoS attacks and malicious actors is reasonable.
But RSS feeds should be explicitly exempted from bot-blocking rules. A properly maintained feed is not a vulnerability; it is a service. The Parliamentary Service could go further and publish a clear data access policy, such as one that acknowledges that programmatic, automated access to public parliamentary data is not just tolerated but encouraged, within reasonable limits. Many overseas parliaments do exactly this, providing structured data feeds and APIs specifically to support civic tech, researchers, and the press.
Small technical decisions have real democratic consequences. An RSS feed blocked by a misconfigured security product might seem trivial. But in a country with no written constitution, no upper house, and a government that has used urgency more aggressively than any MMP-era predecessor in its opening term, the tools that let citizens watch what Parliament is doing are not a luxury. They are part of how accountability works. Please don't quietly break them.
Thank you for reading my ramblings, and for the continued support on NZPT. If you are in a position to do so, I certainly appreciate donations to the project, which you can do so by clicking the Support button below.
With Love,
Hamish 'CJ' Sandall