Lead Coordination Minister for the Government’s Response to the Royal Commission’s Report into the Terrorist Attack on the Christchurch Mosques
22 November 2022
Scott
[FYI request #20668 email]
Tēnā koe Scott
Official information request
Thank you for your Official Information Act 1982 (OIA) request of 27 September 2022
seeking information that I hold on the classification system review and the release of the
New Zealand Government Information Security Classification System Policy 2022 by the
New Zealand Security Intelligence Service (NZSIS).
You were advised on 26 October 2022 that the time limit for responding to your request had
been extended to 23 November 2022 because the consultations necessary to make a
decision on your request were such that a proper response could not reasonably be made
within the original time limit.
Response The report of the
Royal Commission of Inquiry into the terrorist attack on Christchurch
masjidain (RCOI) included recommendations for updating the security classification system.
Budget bids on updating the security classification system in Budgets 2021 and 2022 related
to the RCOI’s recommendations. The RCOI recommended that the Government direct
intelligence agencies (including the Department of the Prime Minister and Cabinet) to
improve intelligence and security information sharing practices, including:
• driving a change in approach to the need to know principle across relevant Public
sector agencies, with special attention given to local government including the
emergency management structures at the local and regional level, to ensure it
enables rather than just restricts information sharing; and
• overseeing the implementation, within six months, of recommendations in the 2018
Review of the New Zealand Security Classification System.
Work to date on progressing this recommendation (recommendation nine) has delivered a
range of tools, guidance, and training materials to New Zealand Government agencies to
achieve the following objectives:
• improve adoption and correct usage of the New Zealand Government Security
Classification system (the System);
• increase awareness of how classification leads to secure behaviours, better sharing
of information, and transparency;
• improve security culture through education and communication;
• introduce improved classification principles and practices;
• increase awareness and capability to balance 'need-to-know' and 'need-to-share' to
improve the sharing of information;
• have more information regularly and systematically declassified and released for
public use; and
• measure and report on the function and performance of the System.
As you are aware, on 1 July 2022, the revised New Zealand Government Security
Classification System policy came into effect.
You requested the following information:
I would like to request a copy of the briefing the minister received to advise him of the
outcome of NZSIS’s recent review of the classification system and their proposals for
updating the classification system.
Please find enclosed the following documents relevant to this part of your request:
•
Briefing Note: Royal Commission Implications for Classification System
Review (February 2021). Some information in this paper has been withheld pursuant
to the following sections in the OIA:
o Section 6(a), as the making available of that information would be likely to
prejudice the security or defence of New Zealand or the international relations
of the Government of New Zealand; and
o Section 9(2)(a), as the withholding of the information is necessary to protect
the privacy of natural persons.
• I do not believe that the withholding of this information is outweighed by other
considerations which render it desirable, in the public interest, to make that
information available.
•
RCOI Information Sharing Project Minister Briefing Handout (June 2022). This is
from a verbal briefing the Protective Security Requirements Unit gave me on the
project outcomes.
The NZSIS Protective Security Requirements website refers to a proposal to simplify the
classification system which did not receive Cabinet approval:
“We recognize that simplifying the System was identified as a high priority by all of the
agencies involved in the review project in 2019 and 2020. That review found that simplifying
the system wil require significant resources across government to undertake. We did not
receive approval from Cabinet to commit those resources at this time.”
Quote on this webpage:
https://protectivesecurity.govt.nz/resources-centre/common-questions/classification-
system/what-has-changed-in-the-july-2022-policy/
I would like to request a copy of all Cabinet material associated with the update of the
classification system, including the proposal referred to above which did not receive Cabinet
approval.
In response to your question my officials submitted two funding options in Budget 2021 for
the first phase of the classification system change. Treasury approved the option for
$840,000 so the Government could address RCOI recommendations 9a and 9b. I have
enclosed an excerpt from a briefing I received in December 2020 related to initiatives in
Budget 2021. This can be found on page four of this letter. You can read the approved
Budget 2021 initiative on page 94 at the following link:
https:/ www.treasury.govt.nz/sites/default/files/2021-07/b21-wellbeing-budget-v2.pdf
My officials also provided information on the classification related Budget initiative to the
Treasury who were responsible for the Treasury’s final Budget 2022 package considered by
Cabinet. As allowed for by section 16(1)(e) of the OIA, I have also enclosed excerpts in
Appendix One on the classification review budget bid from the wider counter terrorism
budget bid, to protect the interests of sections 6(a) and 9(2)(g)(i) of the OIA.
Details on the approved Budget 2022 initiative can be found at the following link on the
Budget 2022 website, on page 98:
https://budget.govt.nz/budget/pdfs/wellbeing-budget/b22-
wellbeing-budget.pdf. Review If you wish to discuss this decision, please feel free to contact
[Andrew Little request email].
You have the right to seek an investigation and review by the Ombudsman of this decision.
Information about how to make a complaint is available at
www.ombudsman.parliament.nz
or freephone 0800 802 602.
Ngā mihi
Hon Andrew Little
Minister Responsible for the NZSIS
Excerpts from Budget 2022 Initiative Summary –Royal
Commission of Inquiry – Maintaining and Enhancing Cyber
Security Services
Review of New Zealand’s classification Recommendation 9 of the RCOI directed the Department of Prime Minister and Cabinet
system in support of recommendation nine to improve intelligence and security information sharing practices. Meaningful delivery
of the RCOI
of this recommendation is dependent on NZSIS’s Protective Security Requirements
(PSR) unit undertaking policy change in relation to PSR guidance and practices that
govern New Zealand’s classification system.
This initiative seeks funding to build upon the current work underway to implement the
information sharing recommendations set out by the RCOI. Al relevant agencies have
agreed the simplification of New Zealand’s classification system is the key enabler of
improved intelligence and security information sharing practices. The classification
system review is being undertaken by PSR and deliverables include:
• Design of the policy change and its implications to PSR guidance and
practices (classification system, handling instructions, security clearance
levels, and physical security zone changes to align with the simplified
classifications)
• Development of education and training modules for the revised
classification system plus guidance on how to map between the old
classification system and the new.
• Generic transition planning for agencies moving from the old to the new
system.
Previous delivery Classification Review Project: This initiative would build upon previous work including a 2019/20 review of
experience
the classification system to understand the appetite for change, design a more fit-for-purpose Classification
System, and assess the impacts of change on government. The initiatives have been effectively delivered,
managed, and governed in partnership between NZSIS and the consulting firm involved.
Excerpt from Briefing Note: Budget 2021 Initiative Submission (22
January 2021)
Beyond the three cost pressure initiatives I am submitting, the Royal Commission of Inquiry
into the Terrorist Attack on Christchurch Mosques made recommendations around changing
the New Zealand Security Classification System, which would have resourcing implications for
NZSIS. My officials are working with the Department of the Prime Minister and Cabinet
(DPMC) to ensure this issue is addressed in a February report-back to Cabinet on the next
tranche of Royal Commission of Inquiry work streams.
IN CONFIDENCE
Released under the Official Information Act 1982
BRIEFING FOR THE MINISTER FOR NZSIS
ON THE RCOI INFORMATION SHARING PROJECT
CLASSIFICATION SYSTEM CHANGES TO DELIVER ON RCOI
RECOMMENDATION 9 ON INFORMATION SHARING
V1.0
IN CONFIDENCE
June 2022
1
Released under the Official Information Act 1982
RCOI RECOMMENDATION 9
DRIVE CHANGES TO THE NEW ZEALAND SECURITY CLASSIFICATION SYSTEM TO DELIVER ON RECOMMENDATION 9 ON
INFORMATION SHARING BY THE ROYAL COMMISSION OF INQUIRY INTO THE TERRORIST ATTACK ON CHRISTCHURCH MASJIDAIN
9a) Drive a change in approach to the “Need to Know” principle to enable rather than restrict
information sharing.
9b) Implement the fol owing recommendations identified by the IGIS in the 2018 Review of the
New Zealand Security Classification System:
i. Expand the System principles so that no information may remain classified indefinitely
and that where there is doubt, information is classified at the lower level.
ii. Revise and strengthen public sector agency classification guidance and develop training.
iii. Adopt a topic-based approach to systematic declassification of historic records.
iv. Develop indicators of function and performance of the System.
V1.0
IN CONFIDENCE
June 2022
2
Released under the Official Information Act 1982
PURPOSE AND DESIRED OUTCOME
Overcome the barrier to effective information sharing caused by inconsistent use of the
New Zealand Government Security Classification System. This can lead to a culture of secrecy,
over-classification and applying severe information sharing restrictions.
The aim of the project is to realise three key benefits:
More consistent and effective use of the Classification System
More purposeful information sharing, facilitating reduced national security risks and improving delivery of
government services
Continued increase in transparency and public engagement through regular declassification of
information.
V1.0
IN CONFIDENCE
June 2022
3
IN CONFIDENCE
Released under the Official Information Act 1982
KEY PROJECT DELIVERABLES (COMES INTO EFFECT 1 JULY 2022)
# Deliverable
Description
1
New Zealand Government Security
Revised the current policy to introduce higher level principles and refined requirements to drive systems
1
Classification System Policy 2022
level change in support of Recommendation 9 on Information Sharing
2
Classification System guidance
Revised the practitioner guidance to support the revised policy and provide guidance on the steps
2
(PSR Website Content)
agencies should take to adopt the new principles and recommended practices.
3
Online training modules
Created eLearning modules geared towards all staff within agencies to drive greater understanding and
3
consistency of use of the Classification System.
1) Introduction to classification
2) How to classify information
3) How to protect information
4) National security information (coming in latter part of 2022)
4
Declassification guidance
Created new practitioner guidance to support agencies to adopt a systematic approach to
4
Information sharing guidance
declassification and improve their information sharing capability.
5
Classification System performance
Revised the PSR Capability Maturity Model and self-assessment moderation framework to establish the
5
measurement framework
indicators and evidence of performance and measurement for the classification system capability in line
with other protective security capability development. Agencies will report back on their plans in March
2023 and measure their capability in March 2024 in the PSR annual assurance report.
6
Change management support
Created a launch plan, PSR–led workshop sessions for agencies, campaign tools, and change toolkit for
6
agencies to use when implementing the revised policy in their environment. The agency workshops will
be held in end June 2022.
V1.0
IN CONFIDENCE
June 2022
4
IN CONFIDENCE
Released under the Official Information Act 1982
REFERENCE GROUP STAKEHOLDERS ENGAGED
Classification & Education
Information Sharing
Information Declassification
Performance Measurement
Members: 54 people, 21 orgs
Members: 43 people, 23 orgs
Members: 32 people, 18 orgs
Members: 30 people, 14 org
Provided feedback: 15 C + 16 Ed
Provided feedback: 19
Provided feedback: 9
Provided feedback: (due 20/5)
CAA/AVSEC
MPI
CAA/AVSEC
MOJ
DIA / Archives
NZ Customs
DPMC
DIA / Archives
MSD
DIA / Archives
MOT
DPMC
NZ Police
MBIE
DPMC
NEMA
DPMC
MPI
GCSB
NZDF
MFAT
GCSB
NZ Customs
FENZ
MSD
MBIE
NZSIS
MFE
MBIE
NZDF
GCSB
NEMA
MFAT
NZTA
MOH
MFAT
NZ Police
IRD
NZ Customs
MFE
Ombudsman
MSD
MFE
NZSIS
MBIE
NZDF
MOH
RBNZ
NEMA
MOE
NZTA
MFAT
NZ Police
MOJ
NZ Customs
MOH
Ombudsman
MFE
NZSIS
MPI
NZDF
MOJ
RBNZ
MOH
NZTA
MSD
NZ Police
Treasury
Ombudsman
NEMA
NZSIS
Privacy
NZTA
Commissioner
Ombudsman
RBNZ
RBNZ
We want to extend our heart-felt thanks to their involvement and feedback as it was instrumental to
getting a fit-for-purpose and fit-for-use set of deliverables.
V1.0
IN CONFIDENCE
June 2022
5
IN CONFIDENCE
Released under the Official Information Act 1982
3 EXAMPLE SLIDES FROM ONLINE TRAINING MODULES
V1.0
IN CONFIDENCE
June 2022
6
Document Outline
