A16795735
PO Box 12-209
Wel ington 6144
P +64 4 472 6881
F +64 4 499 3701
www.gcsb.govt.nz
22 September 2022
Mohammed Khan
[FYI request #20334 email]
Tēnā koe Mohammed
Official Information Act request
Thank you for your Official Information Act 1982 (OIA) request of 24 August 2022 to the
Government Communications Security Bureau (GCSB) for the fol owing information:
1) Was the GCHQ's review of Huawei's technology, which proved to the GCHQ that it
was safe for Britain to implement Huawei technology, provided to GCSB?
2) Did GCSB conduct any real review or assessment of Huawei's technology, as the
GCHQ did, or simply rely on the word of your American bosses? If a review or
assessment was conducted, or a report prepared, how many ful time equivalents
were assigned to this, and for how long?
3) At what dates and by what means did Matthew Pottinger contact GCSB and GCSB
personnel between January 2017, and January 2021?
4) Please provide al communications between GCSB and Spark regarding your
decision to reject their use of the proven-safe Huawei 5g technology in 2018.
Response
My response to the first and third questions of your request is that I neither confirm nor
deny the existence or non-existence of any information. This reply is given within the terms
of section 10 of the OIA because disclosing the existence or non-existence of the information
is likely to prejudice the interests protected by section 6(a) of the OIA (the security or
defence of New Zealand or the international relations of the Government of New Zealand).
I can confirm that the GCSB conducted a review into Spark’s proposal and a decision paper
was completed in 2018. Under the Telecommunications (Interception and Capability and
Security) Act 2013 (TICSA), the GCSB assesses potential network security risks on a case by
case basis. It is important to note that TICSA applies a country and vendor neutral approach.
The GCSB uses information from a variety of sources to inform its view, including al relevant
material provided by the network operator, as wel as other available information about
threats to network security, including information obtained from classified intel igence
reporting.
This work was completed by approximately 2.5 FTE for a period of 12 months.
1
Below are the items in scope of question four of your request and where possible copies
have been provided. Disclosure of some of this information would be likely to prejudice the
national security of New Zealand by revealing the GCSB’s methods and capabilities.
Additional y, information provided to the GCSB by network operations is provided on a basis
of confidence and contains commercial y sensitive information. Therefore some information
has been withheld under the fol owing sections of the OIA:
6(a), where the making available of the information would be likely to prejudice the
security or defence of New Zealand or the international relations of the Government
of New Zealand;
Section 9(2)(a), the withholding of the information is necessary to protect the privacy
of natural persons, including that of deceased natural persons;
Section 9(2)(b)(i), the withholding of the information is necessary to protect
information where the making available of the information would disclose a trade
secret;
Section 9(2)(b)(i ), the withholding of the information is necessary to protect
information where the making available of the information would be likely
unreasonably to prejudice the commercial position of the person who supplied or
who is the subject of the information; and
Section 9(2)(ba)(i), the withholding of the information is necessary to protect
information which is subject to an obligation of confidence or which any person has
been or could be compel ed to provide under the authority of any enactment, where
the making available of the information would be likely to prejudice the supply of
similar information, or information from the same source, and it is in the public
interest that such information should continue to be supplied.
Please note that names of GCSB staff have been withheld under sections 6(a) and 18(c)(i) of
the OIA as the making available of the information would be contrary to section 227 of the
Intel igence and Security Act 2017, restriction on publication and broadcasting of
information regarding employees. The names of Spark employees have been withheld
under section 9(2)(a) of the OIA.
Item Date
Description
Release
1
28/11/2018 Letter from GCSB to Spark New Release with redactions under S9(2)(a)
Zealand Ltd providing notice of
network security risks.
2
28/11/2018 Unclassified Decision Paper for Withheld in ful under S9(2)(b)(i),
NCSC-TN-2018-451
S9(2)(b)(i ) and S9(2)(ba)(i)
3
28/11/2018 Classified Decision Paper for Withheld in ful under S6(a), S9(2)(b)(i),
NCSC-TN-2018-451
S9(2)(b)(i ), and S9(2)(ba)(i)
4
8/11/2019 File note of meeting between Withheld in ful under s9(2)(b)(i ) and
Spark and GCSB
s9(2)(ba)(i)
5
14/11/2019 Spark’s withdrawal of TICSA Release with redactions under s 6(a),
notification
s9(2)(a), s18(c)(i)
2
Please note that the classified and unclassified decision papers listed above were the
supporting material for the 28/11/2018 letter from GCSB to Spark. Summaries of the
decision papers have not been provided because the releasable material is already
contained in the 28/11/2018 letter.
Review
If you wish to discuss this response with us, please feel free to contact
[GCSB request email].
You have the right to seek an investigation and review by the Ombudsman of this decision.
Information about how to make a complaint is available at www.ombudsman.parliament.nz
or freephone 0800 802 602.
Ngā mihi
Andrew Hampton
Te Tumu Whakarae mō Te Tira Tiaki
Director-General, GCSB
3
